What access is required for enabling Microsoft Entra Kerberos on storage account

Hi Ram,

To enable Microsoft Entra Kerberos on an Azure storage account, you need to have appropriate access permissions. Specifically, you must have the "Storage Account Contributor" role or higher on the storage account. Additionally, ensure that your Azure Active Directory (AAD) is properly configured to support Kerberos authentication.

1. Azure Storage Account Permissions: You must have permissions to modify the Azure storage account settings.
2. Hybrid Identity Requirements: Microsoft Entra Kerberos authentication primarily supports hybrid identities (on-prem AD DS synced with Microsoft Entra ID). If the customer has cloud-only identities, this method may not be applicable.
3. Network Connectivity: The storage account must be able to communicate with domain controllers for Kerberos authentication, which may require VPN or ExpressRoute connectivity.
4. Key Rotation & Security: Organizations should set up Kerberos key rotation to ensure secure authentication and avoid expired keys disrupting access.
5. Admin Consent: After enabling Microsoft Entra Kerberos authentication, you need to grant admin consent to the new Microsoft Entra application registered in your Microsoft Entra tenant.

These permissions ensure that you can configure the necessary settings and grant the required access for the service principal associated with the storage account.

Enable Microsoft Entra Kerberos authentication for hybrid user accounts
Azure Files identity-based authentication overview
Hope the above suggestion helps! Please let us know do you have any further queries.

Please do consider to “Accepting the answer” wherever the information provided helps you, this can be beneficial to other community members. 

With Storage account contributor role Microsoft Entra Kerberos is getting failed. App registration is getting created

Hi Ram,

To successfully enable Microsoft Entra Kerberos for an Azure Storage account, the following permissions are necessary

You need to ensure that the Azure AD Global Administrator or Privileged Role Administrator role is assigned to the user enabling the Kerberos feature. This is because enabling Kerberos involves registering a service principal in Azure AD, and this step requires higher permissions at the Azure AD level than the "Storage Account Contributor" role provides.
The "Storage Account Contributor" role provides sufficient permissions to manage storage account settings. However, it does not grant the necessary permissions to create or modify Azure AD applications (app registrations).

Ensure you also have permissions to perform actions related to Azure AD integration with the storage account (often requiring tenant-wide Azure AD roles).

Application Registration in Microsoft Entra ID:

When enabling Microsoft Entra Kerberos, a service principal (application registration) is automatically created in the Azure AD tenant to represent the storage account. If this process is failing, the user enabling Kerberos might lack the Application Administrator or Cloud Application Administrator role required to create app registrations.

Ensure the hybrid identity setup is properly configured.

• On-prem AD is synced with Azure AD.
• Domain controllers are accessible for Kerberos.

Confirm admin consent for the registered app.

• In the Microsoft Entra portal, go to Enterprise Applications -> Select the newly registered app -> Grant admin consent.

Troubleshoot Azure Files identity-based authentication and authorization issues (SMB)

Hope the above suggestion helps! Please let us know do you have any further queries.

Hi Ram,

Since the Storage Account Contributor role wasn’t sufficient and the App Registration is getting created, but Kerberos enablement still fails.

Once the app registration is created, Kerberos relies on SPN Verify Kerberos SPN registration status by following the command mentioned below

az storage account show --name <storage-account-name> --resource-group <resource-group-name> --query "azureFilesIdentityBasedAuth.directoryServiceOptions"

This should provide the relevant output you're looking for or else SPN registration likely failed.

Try force registration if the app was created but not linked properly to the storage account

az storage account update --name <storage-account-name> --resource-group <resource-group-name> --enable-files-aadds false --enable-files-azure-active-directory-kernel-support true --enable-files-aad-kubernetes true

As Vinod Kumar Reddy Chilupuri suggested Storage account contributor role is not works for you so go for Global Administrator or any Privileged Role Admin as these roles has privilages to Can Register SPN and Can Enable Entra Kerberos along with Creating App Registration.

Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hi Ram,

Just checking to see if the suggestion provided helped you to solve your issue, please let us know if you have any further queries. If the above suggestion helps you to solve your issue, please Up-vote, this can be beneficial to other community members.