Share via

Deploy Azure Files share as a network drive to user's corporate machines

Shawn Goodwin 176 Reputation points
2024-06-06T15:12:46.89+00:00

We are trying to deploy an Azure Files SMB share to users' corporate machines and have that share mapped in their Windows Explorer. The intent is to emulate a traditional on-prem network "share drive". This is easier for on-prem and Hybrid organizations, but it's a bit more challenging for cloud-only organizations. We are 100% cloud-based in M365 and EntraID. I've been reading all the Microsoft docs I can find and trying to cobble together a plan. I cannot find an all-in-one resource for this use case. I'm still fuzzy on some details that I'm sure are implied in the docs, but I am missing. Here goes.

  • We are M365/EntraID based, with a P2 tenant.
  • We have an Azure tenant connected to our M365/EntraID tenant.
  • Resource Group created, call it corporate-storage-RG
  • Storage account created, call it corporate-storage-SA
  • Azure File Share created, call it test-file-share
  • Entra Domain Services created using the same domain as our company, call it my-corp.com. This is our main domain. Creating the Entra Domain Services creates all the necessary Virtual Networks, public IP, security group, etc.
  • Azure File Share Identity Based Access configured as Microsoft Entra Domain Services
  • VM created in corporate-storage-RG, call it corporate-storage-VM.

I'm having trouble joining the VM to the my-corp.com domain services created above. I'm getting an error when using my creds. The error says, "This device is joined to Azure AD. To join an Active Directory domain, you must first go to settings and choose to disconnect your device from your work or school." I go to Settings on the VM, but no work or school connections are shown. Here's my first question, how do I disconnect the VM from work or school? Should I use a different domain name than our main domain? Microsoft examples use aadcontoso vs contoso. I didn't see any direction to use a different name, so I'm asking. If I should use a different domain name, do I have to add that domain in M365 and a corresponding DNS record on our site?

I've read through the https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal multiple times, along with many other docs.

My understanding is that once I get the VM joined to the Azure domain, the VM will connect to the Azure File Share, and the users will access the shares through the VM. Do I have to add the EntraID groups to the Azure domain?

Are there any other gotchas I may be missing?

Azure Files
Azure Files

An Azure service that offers file shares in the cloud.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sumarigo-MSFT 47,511 Reputation points Microsoft Employee Moderator
    2024-07-01T06:19:14.75+00:00

    @Shawn Goodwin Thanks for the update and and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

    Issue: Issue will be deploying Azure Files as network drives to corporate laptops using Entra ID authentication. They have followed the necessary steps to configure Azure Files for Entra ID authentication and have created the required resources such as a resource group, storage account, Azure File share, and a VM. However, they are unable to join the VM to the domain and are receiving an error message stating that the device is already joined to Azure AD. The customer is seeking assistance on how to disconnect the VM from Azure AD. Entra Domain Services authentication over SMB with Azure file shares is only supported on Azure VMs, not on corporate end-user laptops.

    Solution: Presently this feature/functionality is not supported, GSA is still in Preview.
    I would recommend to please subscribe to Azure updates (Customer can stay ahead with new features, maintain compliance, and manage their Azure resources optimally.) https://azure.microsoft.com/en-in/updates/. Once the feature is been released will keep you updated.

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

    Was this answer helpful?

    0 comments
  2. Shawn Goodwin 176 Reputation points
    2024-06-18T15:57:42.9133333+00:00

    It cannot be done yet. GSA is still in Preview.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.