You have an Azure storage account named stdatafiles44 that hosts an Azure file share named templates. You need to configure Microsoft Entra ID authentication over SMB for the file share. The solution must allow cloud-only user accounts in a Microsoft Entra ID group named Designers to read and write files in the share using their Microsoft Entra ID credentials. Which two configurations should you perform? (Select two.)
- Enable Microsoft Entra Kerberos authentication for the storage account.Answer
- Assign the Storage File Data SMB Share Contributor role to the Designers group.Answer
- CEnable Microsoft Entra Domain Services (Domain Services) for the Microsoft Entra tenant.
- DAssign the Storage Blob Data Contributor role to the Designers group.
- EGenerate a Shared Access Signature (SAS) token for the file share and distribute it to the members of the Designers group.
Answer
To enable Microsoft Entra ID authentication over SMB for the file share, you should enable Microsoft Entra Kerberos authentication for the storage account and assign the Storage File Data SMB Share Contributor role to the Designers group.
To enable Microsoft Entra ID authentication over SMB for cloud-only user accounts to access an Azure file share, you must configure Microsoft Entra Kerberos authentication on the storage account. This allows Microsoft Entra ID to issue Kerberos tickets for accessing the file share. Additionally, you must assign an appropriate share-level Azure RBAC role, such as the Storage File Data SMB Share Contributor role, to the Microsoft Entra ID group to authorize read and write operations.
Step-by-Step Solution
Key Concept
Configuring identity-based authentication for Azure Files over SMB using Microsoft Entra Kerberos and share-level Azure RBAC roles.
Estimated Time:1m 30s