Azure Storage File Authentication Issue

Question

I added AD DS authentication to my Azure Storage File account by following the article outlined here https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable?WT.mc_id=Portal-Microsoft_Azure_FileStorage I used step 1 auto option.

I selected the ServiceLogonAccount and also Computer Account both options don't seem to work.

I have line of sight to a DC using a point to site VPN connection and can RDP to the DC and can also see ping response to the DC.

I also configured a private IP for the storage account which is resolvable from the end user PC using the Point-to-Site VPN and Site-to-SIte VPN to on prem machines

Using a storage account key method works but AD does not.

Issue:

I'm getting the prompt to enter the AD credentials however, no matter what account or UPN combinations I try always seeing "The username or password is incorrect"

On-Prem DC/End user client outcome

From the on prem DC which has the route to the storage account vNET via a site-to-site VPN, I can get the file share to mount using the \filename.file.core.windows.net\sharename format using AD

However when using the \10.0.0.4\fileshare the login does not succeed.

From a Point-to-site VPN connected machine outcome
From the point to site VPN clients which have a line of sight to the DC, \filename.file.core.windows.net\sharename does not attempt to connect as expected, I have it limited to vNET and to some whitelisted IP's only. Just like the on-prem the \10.0.0.4\fileshare gets the login does not succeed.

To summarize, the private link access does not work on on-prem and VPN brokered (domain joined and non-domain joined) clients. I'm at my wits end in trying to troubleshoot this.

I ran the AzureFileDiagnostics and Debug-AZstorageAccountAuth and both of them attempt to connect using the FQFN of the share and on-prem shows all good and the VPN clients won't connect as expected because of SMB 445 block.

What am I missing?

Answer 1

Hello @Sumarigo-MSFT