Azure Files Identity Update

Key Concepts

• Entra Kerberos: A feature that allows Microsoft Entra ID to issue Kerberos tickets for authentication to Azure Files.
• Managed Identities (MI): Azure-provided identities for applications (VMs, AKS, Azure Functions) that eliminate the need for hardcoded credentials.
• OAuth vs. Kerberos: The technical bridge enabling Managed Identities (OAuth-based) to authenticate against SMB shares (Kerberos-based).
• Cloud-Only Identities: User accounts existing solely in Entra ID, without synchronization from on-premises Active Directory.
• Platform Single Sign-On (PSSO): A macOS feature that provides a Primary Refresh Token (PRT) to facilitate Kerberos-based authentication.
• Storage File Data SMB MI Admin Role: A specific RBAC role required for Managed Identities to access SMB shares.

---

1. Managed Identity Authentication for SMB

Azure Files now supports authentication via Managed Identities (User-assigned or System-assigned). This allows applications running on Azure VMs, AKS, or Arc-enabled resources to access SMB shares without using storage account keys.

• Technical Mechanism: Since Managed Identities use OAuth and SMB requires Kerberos, the system utilizes the Entra Kerberos.NET library to bridge this gap.
• Role Assignment: Access is controlled at the data plane via the Storage File Data SMB MI Admin role.
• Constraint: Because Managed Identities lack a Security Identifier (SID), NTFS ACLs on the file system are ignored. Access is governed strictly by the RBAC role assigned at the share level.
• Implementation: Developers can use a specific PowerShell module or direct .NET APIs to retrieve the necessary tokens for the storage account.

2. Cloud-Only Identity Support

Azure Files now supports seamless access for cloud-only identities (users not synced from on-premises AD) on Entra-joined Windows 11 devices.

• NTFS ACL Management: Users can now manage NTFS permissions directly through the Azure Portal. While the Windows file server UI currently expects AD, Microsoft is transitioning this to support Microsoft Graph, enabling native permission management for cloud-only accounts.
• Workflow:
  1. The client machine must be Entra-joined.
  2. The user signs in with a cloud-only account.
  3. The system retrieves a Ticket Granting Ticket (TGT) from Entra, which is then exchanged for an SMB access token.
• Result: The system respects NTFS ACLs, allowing for granular file-level access control (e.g., denying access to specific files) for cloud-only users.

3. Native macOS Support

macOS users can now natively mount Azure Files SMB shares without relying on storage account keys.

• Requirement: The macOS device must be enrolled in Entra via Platform Single Sign-On (PSSO).
• Mechanism: PSSO provides the macOS device with a Primary Refresh Token (PRT). This PRT is used to request Kerberos tickets, allowing the macOS native file browser to authenticate against SMB shares using the user's Entra identity.

---

Summary of Key Takeaways

The updates to Azure Files significantly reduce the reliance on legacy storage account keys, which are a security risk. By enabling Managed Identities, Cloud-Only Identities, and macOS PSSO integration, Microsoft has modernized the authentication stack for SMB shares.

• For Developers: Managed Identities provide a secure, keyless way to connect services to file storage.
• For IT Admins: Cloud-only identities and Entra-joined devices allow for a unified, modern identity experience that respects NTFS permissions without needing on-premises AD synchronization.
• For End Users: macOS users gain a native, seamless experience that aligns with modern identity standards (PSSO/PRT).

Significant Statement: "Managed identities work with OAuth, while SMB only works with Kerberos... there's been a number of changes made to enable this, and it's going to use the Entra Kerberos.NET library."