Enable file sharing on a mapped network drive via Azure - Azure AD joined devices - how to setup security

Question

I currently have setup a Azure file storage, and file share and have successfully mapped this to some of the Windows Laptops.

We only use Azure Active Directory, have nothing on-prem and I want to know how to secure and use the file service across identities. I only want certain people to be able to access the file share, so instead of using the storage account key I want to be able to use our Azure AD to control access. But it seems unclear if this can be done in the absence of an on-prem or hybrid solution?

We're a charity and I'm just using self taught knowledge. If we keep using storage account key does this leave us open to anyone on the internet being able to access the files?

Answer 1

@Joseph Kelly

Thank you for your detailed post and I apologize for the delayed response!

I understand that you set up Azure Files and are now looking at options to secure it - for example, since you only use Azure AD, you'd like to use Azure AD for access control instead of using your Storage Account Key. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

---

Findings:

When it comes to securing access to your Azure Files from within the Azure Portal, you should be able to choose how to authorize access to file data using either your Azure AD account or the storage account access key. For more info.

When trying to control access to your Azure File share data across identities, the only way I found to do this would be through assigning share-level permissions on your storage account, which would only be available once you've enabled an Active Directory (on-prem AD) source.

• Note: You can use Azure Files OAuth over REST to replace storage account key access with OAuth authentication and authorization to access Azure File shares with read-all/write-all privileges. For more info.

Please keep in mind that a storage account key is an administrator key for your storage account, including administrator permissions to all files and folders within the file share you're accessing. If this isn't sufficient for your workload, it's recommended to use Azure File Sync or identity-based authentication over SMB (AD authentication). For more info.

---

Additional Links:

• Choose how to authorize access to file data in the Azure portal
• Identity Based Auth - Access control
• Using an Azure file share with Windows
• Assign Azure RBAC roles using the Azure portal

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.