Using Azure AD account to give NTFS level permission on onpremises server

Mahesh Mahi 46 Reputation points
2020-07-06T08:00:35.913+00:00

Is it possible to use Azure AD account (account created in Azure AD) to provide NTFS level permission on an on-premises Windows 2019 Server? Can we achieve this with hybrid Azure AD joined server? Or the only way is to deploy server in Azure IaaS platform and join it to Azure AD?
Please mention if any other options.

Microsoft Entra
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,532 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Shashi Shailaj 7,581 Reputation points Microsoft Employee
    2020-07-06T19:28:40.35+00:00

    Hello @MaheshMahi-7462 ,

    An account created only in azure AD would not be able to authenticate as far as I know. NTFS level permission for a account related to the account being able to use Kerberos/NTLM for access but the Azure AD account belongs to AAD identity system which does not directly support legacy auth protocols like Kerberos/NTLM. However you can use Azure file shares which uses Azure file sync to sync the files to azure. You can enable the on-prem account authentication on Azure file share provided the account is synced to azure. You can read more on the article on-premises Active Directory Domain Services authentication over SMB for Azure file shares . Azure AD and On-prem AD are different kind of authentication systems. The way they store user objects is similar but the protocols that they support are different because Azure AD is designed with modern application in mind which operate over the web hence oAuth and SAML are the protocols it supports but on-premise system does not support the same.

    In any case when you would try to edit NTFS permission for an object , you would not see the option to select from Non-Active directory locations. the locations button will only bring up the trusted Active directory forests so you will not be able to add any azure AD only created account as the system has no way to search them .

    11309-objectpicker.jpg

    I am not sure of the use case you have but I believe the details in this answer would give you some clarity . I don't think you can achieve this on a windows server which is hybrid joined. I have not tested the azure AD joined machine for this scenario but as far as my knowledge about on-prem AD and SMD shares go I do not think it will work. Hope the information is useful for you . In case the information in this post helps , please do accept this post as answer so that it could help other members of the community . Should you have any further queries , please feel free to let us know and we will be happy to help .

    Thank you.

    1 person found this answer helpful.