Share via

How to tell if your Azure storage is AD joined (on prem)

Manny Guerra 0 Reputation points
2024-05-24T16:28:30.15+00:00

Followed several articles like this one https://christiaanbrinkhoff.com/2020/03/01/learn-here-how-to-configure-azure-files-with-active-directory-ad-authentication-for-fslogix-profile-container-and-msix-app-attach/

When running the MS recommended debug

Debug-AzStorageAccountAuth -StorageAccountName $StorageAccountName -ResourceGroupName $ResourceGroupName -Verbose

command I get these errors in the output:

VERBOSE: Look up user jr in domain hvac.local

Debug-AzStorageAccountAuth: CheckUserRbacAssignment - FAILED

Debug-AzStorageAccountAuth: Index operation failed; the array index evaluated to null.

Name Result

CheckSidHasAadUser Passed

CheckStorageAccountDomainJoined Failed

CheckChannelEncryption Skipped

CheckDefaultSharePermission Passed

CheckAadKerberosRegistryKeyIsOff Passed

CheckGetKerberosTicket Passed

CheckKerberosTicketEncryption Failed

CheckAadUserHasSid Skipped

CheckUserRbacAssignment Failed

CheckADObjectPasswordIsCorrect Failed

CheckDomainJoined Passed

CheckADObject Failed

CheckUserFileAccess Skipped

CheckPort445Connectivity Passed

CheckDomainLineOfSight Passed

Issues found:

---- CheckStorageAccountDomainJoined ----

ActiveDirectoryProperties is not set for storage account 'tsazurestorage' in resource group 'TSRG'. To set the properties, please use cmdlet Set-AzStorageAccount if the account is already associated with an Active Directory, or use cmdlet Join-AzStorageAccountForAuth to join the account to an Active Directory (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable)

---- CheckKerberosTicketEncryption ----

ActiveDirectoryProperties is not set for storage account 'tsazurestorage' in resource group 'TSRG'. To set the properties, please use cmdlet Set-AzStorageAccount if the account is already associated with an Active Directory, or use cmdlet Join-AzStorageAccountForAuth to join the account to an Active Directory (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable)

---- CheckUserRbacAssignment ----

Index operation failed; the array index evaluated to null.

---- CheckADObjectPasswordIsCorrect ----

ActiveDirectoryProperties is not set for storage account 'tsazurestorage' in resource group 'TSRG'. To set the properties, please use cmdlet Set-AzStorageAccount if the account is already associated with an Active Directory, or use cmdlet Join-AzStorageAccountForAuth to join the account to an Active Directory (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable)

---- CheckADObject ----

ActiveDirectoryProperties is not set for storage account 'tsazurestorage' in resource group 'TSRG'. To set the properties, please use cmdlet Set-AzStorageAccount if the account is already associated with an Active Directory, or use cmdlet Join-AzStorageAccountForAuth to join the account to an Active Directory (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable)

I'm expecting this but the blades are different now:

Old
User's image

New Azure Blade (same area) - Active Directory (AD) not found

User's image

Noticed it did create an account in the specified OU:

User's image

any help would be appreciated.

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,820 questions
Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
1,067 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nehruji R 3,651 Reputation points Microsoft Vendor
    2024-05-27T10:53:10.22+00:00

    Hello Manny Guerra,

    Greetings! Welcome to Microsoft Q&A Platform.

    I understand that you’re encountering some issues with Azure Files identity-based authentication. Consider the following to troubleshoot the issue.

    1**.Error: A required privilege is not held by the client**

    Cause: This error occurs because you don’t have the required Active Directory (AD) permissions to run the AzFilesHybrid module.

    Solution: Refer to the AD privileges or contact your AD admin to provide the necessary permissions.

    Microsoft Entra ID is essentially the new name for Azure Active Directory (AAD). The previous names, including Azure AD and AAD, have been replaced with Microsoft Entra ID. While the core functionality remains similar, Microsoft Entra ID enhances identity management by providing an Identity as a Service (IDaaS) solution for both cloud and on-premises applications. It streamlines user provisioning, improves external identity management, and offers additional features like entitlement management and RBAC. refer for purpose differences - https://learn.microsoft.com/en-us/entra/fundamentals/compare in more details.

    User's image

    To enable AD DS authentication over SMB for Azure file shares, you need to register your Azure storage account with your on-premises AD DS. Think of this process as creating an account representing an on-premises Windows file server in your AD DS. You’ll create a computer account (or service logon account) representing your storage account in AD DS. This step establishes the connection between your Azure storage account and your on-premises AD.

    Set Required Domain Properties: After registering your storage account with AD DS, you’ll need to set the required domain properties on the storage account. These properties include information related to your AD DS domain, such as the domain name, organizational unit (OU), and other relevant details.

    Using the AzFilesHybrid PowerShell Module (Recommended): The AzFilesHybrid PowerShell module provides cmdlets specifically for deploying and configuring Azure Files. It simplifies the process of domain joining storage accounts to your on-premises Active Directory and configuring DNS servers. The cmdlets handle necessary modifications and enable the feature for you. Make sure you have .NET Framework 4.7.2 or higher installed, as it’s required for the AzFilesHybrid module to import successfully. If you prefer to use AES-256 Kerberos encryption, this module is the recommended approach.

    Manual Steps (Option Two): If you’re unable to use the AzFilesHybrid module, you can manually perform the enablement actions. However, this approach requires more steps and attention to detail. Ensure that you follow the documentation closely to avoid any issues.

    Remember to review the prerequisites, understand the supported scenarios, and complete the necessary steps before enabling AD DS authentication for your storage account.

    2.Error 5 when mounting an Azure file share (Access is denied)

    Cause: If end users are accessing the Azure file share using Active Directory Domain Services (AD DS) or Microsoft Entra Domain Services authentication, access to the file share fails with an “Access is denied” error if share-level permissions are incorrect.

    Solution: Validate that permissions are configured correctly.

    This article describes the process for enabling Active Directory Domain Services (AD DS) authentication on your storage account in order to use on-premises Active Directory (AD) credentials for authenticating to Azure file shares.

    For AD DS, assign share-level permissions (supported for groups and users synced from AD DS to Microsoft Entra ID).

    For Microsoft Entra Domain Services, also assign share-level permissions. Confirm that groups and users being assigned share-level permissions are not unsupported “cloud-only” groups.

    Have a look at troubleshooting guidance. The identity you want to access Azure file share resources with must be a hybrid identity that exists in both AD DS and Azure AD. Please check our page which goes over this in more detail.

    Error AadDsTenantNotFound in enabling Microsoft Entra Domain Services authentication for Azure Files

    Cause: This error occurs when you try to enable Microsoft Entra Domain Services authentication for Azure Files on a storage account where Microsoft Entra Domain Services isn’t created on the Microsoft Entra tenant of the associated subscription.

    Solution: Enable Microsoft Entra Domain Services on the Microsoft Entra tenant of the subscription where your storage account is deployed.

    refer - https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable,https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/storage/files/storage-files-identity-auth-hybrid-identities-enable.md,https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files/security/files-troubleshoot-smb-authentication?tabs=azure-portal for more information.

    refer similar thread - [https://learn.microsoft.com/en-us/answers/questions/144680/azure-file-share-ad-ds-authentication-(access-deni](https://learn.microsoft.com/en-us/answers/questions/144680/azure-file-share-ad-ds-authentication-(access-deni), https://stackoverflow.com/questions/76274393/azure-storage-account-domain-join-issues

    Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

    Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    0 comments