File Shares Azure Active Directory for RemoteApp

Question

File Shares Azure Active Directory for RemoteApp

Kharche, Prashant 1

We have set AVD Remote App successfully and are able to access the remote app for Azure Active Directory users.
To make the storage persistent, following the steps
https://learn.microsoft.com/en-in/azure/virtual-desktop/fslogix-profile-container-configure-azure-files-active-directory?tabs=adds

When invoking a command Join-AzStorageAccount, I am getting following error

Assert-IsDomainJoined : The cmdlet, script, or module must be run in a domain-joined environment.
At C:\Users\<username>\Documents\WindowsPowerShell\Modules\AzFilesHybrid\0.2.4.0\AzFilesHybrid.psm1:4427 char:9

Assert-IsDomainJoined
~~~~~~~~~~~~~~~~~~~~~
CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Assert-IsDomainJoined

Thanks for any suggestions or help here.

Sumarigo-MSFT 47,471 Reputation points Microsoft Employee Moderator

2022-08-16T12:27:15.363+00:00

@Kharche, Prashant Can you please share the complete screenshot of the error message? Can you please share the complete cmdlets?

Additional information: That cmdlet that you are using is for joining your Azure Files shares to Active Directory. If you want to use traditional NTFS permissions (similar to what you would use on premises) then you need to join to your Active Directory environment - your domain controller(s) would need to be reachable by Azure Files.

To use Azure AD only for authentication to your Azure Files shares you need to use Kerberos and this feature is currently in public preview only.

https://techcommunity.microsoft.com/t5/itops-talk-blog/deep-dive-how-azure-ad-kerberos-works/ba-p/3070889
https://learn.microsoft.com/en-us/azure/virtual-desktop/create-profile-container-azure-ad
Kharche, Prashant 1 Reputation point

2022-08-16T13:34:26.113+00:00

Thanks @Sumarigo-MSFT .

Please see the snapshot, Please let me know if you have any additional comments.

1 answer

Your answer

Sumarigo-MSFT 47,471 Reputation points Microsoft Employee Moderator

2022-08-16T12:27:15.363+00:00

@Kharche, Prashant Can you please share the complete screenshot of the error message? Can you please share the complete cmdlets?

Additional information: That cmdlet that you are using is for joining your Azure Files shares to Active Directory. If you want to use traditional NTFS permissions (similar to what you would use on premises) then you need to join to your Active Directory environment - your domain controller(s) would need to be reachable by Azure Files.

To use Azure AD only for authentication to your Azure Files shares you need to use Kerberos and this feature is currently in public preview only.

https://techcommunity.microsoft.com/t5/itops-talk-blog/deep-dive-how-azure-ad-kerberos-works/ba-p/3070889
https://learn.microsoft.com/en-us/azure/virtual-desktop/create-profile-container-azure-ad
Kharche, Prashant 1 Reputation point

2022-08-16T13:34:26.113+00:00

Thanks @Sumarigo-MSFT .

Please see the snapshot, Please let me know if you have any additional comments.

Answer 1

SaiKishor-MSFT 17,336

@Kharche, Prashant Are you using Azure AD or on-premise AD here? If using Azure AD, here are the steps-

From the Azure portal, open the storage account you created previously.
In the Data storage section, select File shares.
In the main section of the page, next to Active Directory, select Not configured.
In the box for Azure Active Directory Domain Services, select Set up.
Tick the box to Enable Azure Active Directory Domain Services (Azure AD DS) for this file share, then select Save. An Organizational Unit (OU) called AzureFilesConfig will be created at the root of your domain and a computer account named the same as the storage account will be created in that OU.

Please let me know if this helps. Let us know if you have any more questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Kharche, Prashant 1 Reputation point

2022-08-17T10:25:05.06+00:00

Thanks @SaiKishor-MSFT . I am using Azure AD.
I followed the steps but I still get same error message.
SaiKishor-MSFT 17,336 Reputation points

2022-08-18T20:07:13.997+00:00
@Kharche, Prashant Can you please check your environment to make sure of the following?

First, you must check the state of your environment. Specifically, you must check if Active Directory PowerShell is installed, and if the shell is being executed with administrator privileges. Then check to see if the Az.Storage 2.0 module (or newer) is installed, and install it if it isn't. After completing those checks, check your AD DS to see if there is either a computer account (default) or service logon account that has already been created with SPN/UPN as "cifs/your-storage-account-name-here.file.core.windows.net". If the account doesn't exist, create one as described in the following section:

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable#create-an-identity-representing-the-storage-account-in-your-ad-manually

Please let me know if this helps. Thank you!

Share via

File Shares Azure Active Directory for RemoteApp

1 answer

Your answer