Microsoft Certified: Azure Administrator AssociateImplement and manage storageHard
A company is using Azure File Shares for their departmental file storage. They want to connect to these file shares from on-premises Windows 10 client computers. To ensure secure and performant access, they decide to use Azure AD authentication for SMB. Which prerequisite must be configured on the on-premises Windows 10 client computers to enable this authentication method?
- AThe client computers must be joined to an Azure AD Domain Services managed domain.
- BThe client computers must be Azure AD-joined or hybrid Azure AD-joined.
- CThe client computers must have the Azure File Sync agent installed.
- DThe client computers must be joined to an on-premises Active Directory Domain Services (AD DS) domain and synced to Azure AD.
Show answer & explanationAnswer & explanation
Correct answer: B. The client computers must be Azure AD-joined or hybrid Azure AD-joined.
To authenticate with Azure AD for SMB access to Azure File Shares, Windows 10 client computers must be either Azure AD-joined or hybrid Azure AD-joined. This allows the client to obtain a Kerberos ticket from Azure AD for authentication.
Why the other options are wrong
- A. Azure AD Domain Services (AAD DS) is for domain-joining VMs in Azure, not typically for on-premises clients directly accessing Azure Files with Azure AD authentication.
- C. The Azure File Sync agent is for synchronizing files between on-premises servers and Azure File Shares, not for client authentication to the file share itself.
- D. While on-premises AD DS can be synced to Azure AD, for *Azure AD* SMB authentication, the client itself needs to be joined to Azure AD (or hybrid joined), not just joined to on-premises AD.
Azure AD SMB Authentication Prerequisites
To use Azure AD authentication over SMB for Azure File Shares, client machines must be Azure AD-joined or hybrid Azure AD-joined, allowing them to obtain Kerberos tickets from Azure AD.
- Enables password-less Kerberos authentication for SMB.
- Requires the client to be Azure AD-joined or hybrid Azure AD-joined.
- Storage account must be configured for Azure AD authentication.
- Supports Windows 10 client versions 1809 and later.
Memory trick: SMB to Azure Files: AD DS, AAD DS, or Azure AD Join.