How to allow specific group of users to access Storage Account Containers (Files) as mapped network drive with Windows / Azure AD credentials?

Question

Hi All,

I need to find an alternative way to allow multiple / groups or users to open the Azure Files Storage that is mapped as a network drive in the computer & server.

Because the below script was provided by Azure, but it is not secure as the password is hardcoded in the script like below:

$connectTestResult = Test-NetConnection -ComputerName securerepository.file.core.windows.net -Port 445  
if ($connectTestResult.TcpTestSucceeded)  
{  
    # Save the password so the drive will persist on reboot  
    cmd.exe /C "cmdkey /add:`"securerepository.file.core.windows.net`" /user:`"Azure\securerepository`" /pass:`"xasdihbSADhbdfswher24389uvsn=--()*8&#^8^*&T*&^%@$`""  
    # Mount the drive  
    New-PSDrive -Name S -PSProvider FileSystem -Root "\\securerepository.file.core.windows.net\cards" -Persist -Scope Global  
}  
else  
{  
    Write-Error -Message "Unable to reach the Azure storage account via port 445. Check to make sure your organization or ISP is not blocking port 445, or use Azure P2S VPN, Azure S2S VPN, or Express Route to tunnel SMB traffic over a different port."  
}  

and using Group Policy Preference is not working due to: https://support.microsoft.com/en-us/topic/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevation-of-privilege-may-13-2014-60734e15-af79-26ca-ea53-8cd617073c30

Thank you in advance.

Answer 1

@EnterpriseArchitect The script above I assumes you are using the storage account key instead of AD credentials. For users using AD they don’t need to save the password, it will connect on login automatically.

Full instructions and a video here: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

--------------------------------------------------------------------------------------------------------------------------------------------------------------

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.