Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
How do I enable Microsoft Entra Kerberos for Cloud Only authentication without getting an error?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 22%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFR%3C/text%3E%3C/svg%3E)
Fred Rappuhn
0
Reputation points
I am trying to enable Microsoft Entra Kerberos for Cloud Only Entra which states it is in Preview now. I am getting a "Operation is forbidden" error. I have followed all of the checks to make sure I have all the right access and that the storage account is setup correctly but still getting the error message.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 10%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shubham Sharma 10,000 Reputation points Microsoft External Staff Moderator2026-01-26T02:07:37.6133333+00:00 Hello Fred Rappuhn
Thank you for reaching out to Microsoft Q&A.
it looks like you're running into a frustrating issue while trying to enable Microsoft Entra Kerberos for Cloud Only authentication. The "Operation is forbidden" error can stem from a few different factors. Here are some steps you can take to troubleshoot this issue:
- Permissions Check: Ensure that the identity you are using to authenticate has the necessary permissions:
- You should have the Microsoft Entra Directory Readers role permission, or the following Microsoft Graph application permissions:
User.Read.All,GroupMember.Read.All, andApplication.Read.All. - You can check these permissions from the Azure portal by navigating to Microsoft Entra ID > Roles and Administrators.
- You should have the Microsoft Entra Directory Readers role permission, or the following Microsoft Graph application permissions:
- Service Principal Consent: Since Microsoft Entra applications for storage accounts auto-generate, you need to ensure you've granted admin consent for the generated service principal:
- Go to Microsoft Entra ID > App registrations > Find your storage account’s app registration.
- Under API permissions, select "Grant admin consent for [Your Directory Name]".
- IaaS Extension: Ensure that the IaaS extension is installed in full mode and is not in a failed state. This is crucial for enabling Azure services that require it.
- Review Group SID Limits: If you're using cloud-only groups for your authentication, ensure your Kerberos tickets' associated SIDs do not exceed the limit. This might require you to adjust your application manifest.
- Recheck Storage Account Setup: Make sure your storage account is configured correctly and check the settings for private endpoints if you're using them.
Let me know if you have any more questions or need further assistance.
Microsoft Docs:-
- Permissions Check: Ensure that the identity you are using to authenticate has the necessary permissions:
-
Shubham Sharma 10,000 Reputation points Microsoft External Staff Moderator
2026-01-27T06:57:49.5533333+00:00 Hello Fred Rappuhn
Following up to check if the resolution provided was helpful. Please let us know if you need any further assistance.
Sign in to comment
Sign in to answer