Unable to access Azure Storage via smb using AADDS

Dom 11

Hi All, I have Azure AD DS (no on-prem) which I'm using for some WVD testing. I'm unable to access Azure Storage that I'm trying to use for FSLogix. I've given the permissions on the azure portal side but whenever I try to map it, it doesn't like the credentials. If I map it using the storage key and try to check the NTFS permissions it says: "The program cannot open the required dialog box because it cannot determine whether the computer named ... is joined to a domain" Any pointers in the right direction would be great.

JamesTran-MSFT 36,496 Reputation points Microsoft Employee

2020-12-02T01:07:40.307+00:00

@Dom
Thank you for your post!

Are you able to provide the documentation that you followed when using AzureAD DS with your Azure Files, so our Files team can get a better understanding of your issue? Is it similar to our Enable Azure Active Directory Domain Services authentication on Azure Files documentation?

I've also removed the azure-active-directory tag and added "azure-files" so our storage experts can take a closer look into your issue.
Dom 11 Reputation points

2020-12-02T10:34:17.557+00:00

Hi James,

Ive followed the article you mentioned and tried another with very similar instructions.

I used WVD to create two machines in a host pool which joined to AADDS.
Dom 11 Reputation points

2020-12-02T12:49:14.693+00:00

I've created a new VM in azure and tried joining it to the domain but I'm getting the error that my accounts are locked out when trying to authorize it.

I'm sure I'm missing something obvious!
Dom 11 Reputation points

2020-12-02T13:32:53.573+00:00

Created a fresh user and used this to join the VM to the domain which worked without issue.

Then tried to access the file share by the DNS " \storagename.file.core.windows.net\containers" whilst logged in as the new user but keep getting the credential pop up and again entering them fires back with incorrect password.
Dom 11 Reputation points

2020-12-02T14:50:07.657+00:00

Spoken with another CSP who said they're running into the same issue on their tenant. Possibly a wider issue?
JamesTran-MSFT 36,496 Reputation points Microsoft Employee

2020-12-02T17:34:21.81+00:00

@Dom
Thank you for the quick responses and detailed explanation! I've reached out to our Storage team on this issue, please allow some time for them to investigate and update.

Thank you for your time and patience throughout this issue.
Austin Craft 11 Reputation points

2020-12-03T19:58:54.233+00:00

I just wanted to chime in to say that I am having the exact same issue.
Dom 11 Reputation points

2020-12-04T01:19:54.047+00:00

I think it's a patience thing... Make sure you've reset your users passwords after creating them so the hash can be stored in Azure AD DS.

When you give your users access to the share as a "Storage File SMB Share Contributor"

The Azure AD to Azure AD DS changes seem to have a little delay on them.

I'm doing some testing and will report back with my findings!

2 answers

deherman-MSFT 34,436 Reputation points Microsoft Employee

2020-12-02T23:59:12.167+00:00

@Dom
Make sure you have enabled Azure AD DS authentication on the storage account. Also confirm you have the proper role assigned to the user. See Assign access permissions to an identity. After you assign share-level permissions with RBAC, you must assign proper NTFS permissions at the root, directory, or file level. Once you have the permissions properly set you should be able to mount using the net use command. It is also possible that this is a WVD specific issue. Please doublecheck the best practices which are listed here.

If it is still not working after double checking these let us know. We may have to take a look at your specific configuration to see why it is having issues.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.
Dom 11 Reputation points

2020-12-03T09:49:04.597+00:00

@deherman-MSFT

Azure AD DS auth is enabled on the storage account and I have assigned the necessary users to the share.

"You can view and configure NTFS permissions on directories and files in an Azure file share by mounting the share and then using Windows File Explorer" When trying this step I'm met with an error that says "Cannot determine if computer is joined to a domain.

I've tried using a separate VM that is not using WVD and get the same results. I'm not able to get to the stage where I can assign NTFS permissions because it doesnt seem to recognize the fact it has Azure AD DS enabled

Jonathan Gomm 1 Reputation point

2020-12-04T16:40:52.153+00:00

Have you made any progress on this issue?

I am having the same problem. It seems that the computer account for the storage account (SPN) is not being created THIS article seems to indicate that the storage account is domain joined when running the "Enable Azure AD DS authentication for your account" action. This seems to be the issue as its not created for me and from your description the same for you?

"To enable Azure AD DS authentication over SMB for Azure Files, you can set a property on storage accounts by using the Azure portal, Azure PowerShell, or Azure CLI. **Setting this property implicitly "domain joins" the storage account with the associated Azure AD DS deployment. Azure AD DS authentication over SMB is then enabled for all new and existing file shares in the storage account.

Jonathan Gomm 1 Reputation point

2020-12-04T16:41:17.71+00:00

https://learn.microsoft.com/en-us/answers/questions/186604/azure-files-aad-ds-auth.html

Dom 11 Reputation points

2020-12-05T18:01:39.18+00:00

Yes, seems like we have the same issue.

I've created a new user and managed to log onto the system but fslogix is throwing up an error that the user doesn't have permissions to the share, and I can't browse to it.

I think the RBAC permissions are taking a while to apply which is why it's happening. It seems to be working for me with some users - I've created a new user and can logon to my WVD infrastructure but I can't access the share with the account. I'm going to leave it and check back in 30 minutes.

Dom 11 Reputation points

2020-12-05T22:47:51.687+00:00

Hours later that I'm checking but it's gone through and all working as expected.

Going to need to check more closely to see how long it takes.
Sign in to comment
Victor 1 Reputation point

2020-12-16T14:36:42.29+00:00

@Dom
@deherman-MSFT
@JamesTran-MSFT

We have been having this issue as well for the past week or so when setting up a new WVD tenant that is cloud based only. We have been pulling our hair out

We have setup dozens of WVD tenants with FSLogix that are in a hybrid topology with no issue so we are aware of the domain integration needed for auth.

It seems that we can only map the drive in the Windows GUI by using the storage key, but all other credentials that are assigned in the IAM properties are not authentication and the user/pass screen just kicks back.
.
Ran through the documentation countless of times as well as deleting and re-provisioning.

Has anyone else seen a resolution to this?
Please sign in to rate this answer.
Jonathan Gomm 1 Reputation point

2020-12-16T15:53:30.777+00:00

Juggling accounts....

I had the same issue which we could only resolve by logging a call and the MS Azure AD team making a backend change

In our case when enabling AAD DS Identity auth on the storage account the corresponding service account and OU were not automatically created. Check your management VM - can you see an OU called AzureFilesConfig and a user account with the same name as your storage account?

Victor 1 Reputation point

2020-12-17T03:18:15.187+00:00

Thank you.
Yes, see the screenshot of my directory via AAD DS.
No storage account related OU nor an object in AD that matches the storage account name.
I placed a ticket in with MSFT with a link to this article.

Thank you very much as I was going nuts on this.

Victor 1 Reputation point

2020-12-29T01:31:51.81+00:00

Do you happen to have a case# number or any specifics on what was done to resolve?
Still on with MSFT support and maybe that information would help point them in the right direction.

Thank you again
Sign in to comment

Share via

Unable to access Azure Storage via smb using AADDS

2 answers