Azure Files
An Azure service that offers file shares in the cloud.
1,398 questions
Azure files not authenticating
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 47%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
Matthew Strunk
0
Reputation points
Hello Support,
I'm trying to connect Azure files but its not authenticating when i use SSO / won't map the drive.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(291.2, 38%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMP%3C/text%3E%3C/svg%3E)
Marcin Policht 44,345 Reputation points MVP2025-03-28T22:45:22.0233333+00:00 If Microsoft Entra ID authentication for Azure Files is not working when using SSO or if the drive wont map, here are key troubleshooting steps to resolve the issue.
1. Check if Azure Files is configured for Entra ID Authentication
Azure Files supports authentication via:- Microsoft Entra Kerberos for Hybrid Users (Recommended)
- Active Directory Domain Services (AD DS)
- Microsoft Entra Domain Services (Entra DS)
Run the following command to check if Entra ID-based authentication is enabled:
Get-AzStorageAccount -ResourceGroupName "<ResourceGroup>" -Name "<StorageAccountName>" | Select-Object -ExpandProperty AzureFilesIdentityBasedAuthIf its not enabled, set it up with:
Set-AzStorageAccount -ResourceGroupName "<ResourceGroup>" -Name "<StorageAccountName>" -AzureFilesIdentityBasedAuth ActiveDirectoryFor Microsoft Entra Kerberos, enable it with:
Set-AzStorageAccount -ResourceGroupName "<ResourceGroup>" -Name "<StorageAccountName>" -EnableAzureADKerberosForFiles $true2. Verify User Permissions on the File Share Ensure the user has both RBAC and NTFS permissions:
RBAC Permissions (Storage Account Level)
- Go to Storage Account → File Shares → Access Control (IAM).
- Assign the user Storage File Data SMB Share Contributor.
NTFS Permissions (On the File Share)
- Open Command Prompt and run:
icacls Z:\ /grant "<YourUser>@domain.com:F"3. Ensure the client is Kerberos-enabled For Microsoft Entra Kerberos, check if your device is properly joined:
dsregcmd /statusLook for "AzureAdPrt = YES" under
Device State.If needed, force a reauthentication:
klist purge gpupdate /force4. Manually map the drive for debugging If SSO is failing, try manually mapping:
net use Z: \\<storageaccount>.file.core.windows.net\<sharename> /user:Azure\<StorageAccountName> <StorageAccountKey>Or use Microsoft Entra credentials:
cmdkey /add:<storageaccount>.file.core.windows.net /user:<EntraIDUser> /pass:<Password> net use Z: \\<storageaccount>.file.core.windows.net\<sharename>5. Check Group Policy for Kerberos delegation (for hybrid) If using on-prem AD with Entra Kerberos, ensure Kerberos delegation is properly configured:
- Open Group Policy Management (
gpmc.msc). - Go to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options.
- Verify that "Network security: LAN Manager authentication level" is set to
Send NTLMv2 response only. Refuse LM & NTLM. - Ensure your machine is trusted for Kerberos delegation:
- Open Active Directory Users and Computers (
dsa.msc). - Locate your computer object.
- Open Delegation tab → Select "Trust this computer for delegation to specified services only" and allow
CIFS.
- Open Active Directory Users and Computers (
6. Check event logs for authentication errors
- Open Event Viewer (
eventvwr.msc). - Navigate to Application and Services Logs → Microsoft → Windows → SMBClient → Connectivity.
- Look for authentication failures.
For more details, follow https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview
If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.
hth
Marcin
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 6%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKD%3C/text%3E%3C/svg%3E)
Keshavulu Dasari 4,555 Reputation points Microsoft External Staff2025-03-31T14:11:18.21+00:00 Hi Matthew Strunk,
Adding more information to the above response!
I understand the issue with authenticating Azure Files using Single Sign-On and mapping the drive. I Suggest steps to resolve this issue.
Ensure that Azure Active Directory Domain Services is correctly configured and synchronized with your Azure AD.
Make sure that the user account you are using has the necessary permissions to access the Azure file share. The user should be part of the appropriate Azure AD group that has access to the file share.
Ensure that the Group Policy settings for network drive mapping are correctly configured. You might need to update the Group Policy to allow SSO for Azure Files.
Ensure that the Azure AD PowerShell module is installed and up to date on the client machine.
Verify that you are using the correct UNC path to map the drive. The path should be in the format:
\\<storage-account-name>.file.core.windows.net\<file-share-name>.Ensure that the SMB protocol is enabled and correctly configured on the client machine. Azure Files supports SMB 3.0.
Check the event logs on the client machine for any errors related to authentication or network drive mapping.
Please let us know in the comments below, if the issue is resolved or still persists. We will be glad to assist you closely.
Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
-
Keshavulu Dasari 4,555 Reputation points Microsoft External Staff
2025-04-01T17:24:14.76+00:00 Hi Matthew Strunk,
Just checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be glad to assist you.
Sign in to comment
Sign in to answer