Merge pull request #208339 from khdownie/kendownie081722

Thanks Leslie for the clarification

Author: prmerger-automator[bot]

articles/storage/files/storage-files-identity-auth-active-directory-domain-service-enable.md

@@ -4,7 +4,7 @@ description: Learn how to enable identity-based authentication over Server Messa
 author: khdownie
 ms.service: storage
 ms.topic: how-to
-ms.date: 08/16/2022
+ms.date: 08/17/2022
 ms.author: kendownie
 ms.subservice: files
 ms.custom: contperf-fy21q1, devx-track-azurecli, devx-track-azurepowershell
@@ -146,11 +146,16 @@ az storage account update -n <storage-account-name> -g <resource-group-name> --e
 
 ## Recommended: Use AES-256 encryption
 
-By default, Azure AD DS authentication uses Kerberos RC4 encryption. We recommend configuring it to use Kerberos AES-256 encryption instead by following these steps:
+By default, Azure AD DS authentication uses Kerberos RC4 encryption. We recommend configuring it to use Kerberos AES-256 encryption instead by following these instructions.
 
-As an Azure AD DS user with the required permissions (typically, members of the **AAD DC Administrators** group will have the necessary permissions), execute the following Azure PowerShell commands. If using Azure Cloud Shell, be sure to run the `Connect-AzureAD` cmdlet first.
+The action requires running an operation on the Active Directory domain that's managed by Azure AD DS to reach a domain controller to request a property change to the domain object. The cmdlets below are Windows Server Active Directory PowerShell cmdlets, not Azure PowerShell cmdlets. Because of this, these PowerShell commands must be run from a machine that's domain-joined to the Azure AD DS domain.  
 
-```azurepowershell
+> [!IMPORTANT]
+> Azure Cloud Shell won't work in this scenario. 
+
+As an Azure AD DS user with the required permissions (typically, members of the **AAD DC Administrators** group will have the necessary permissions), execute the following PowerShell commands.
+
+```powershell
 # 1. Find the service account in your managed domain that represents the storage account.
 
 $storageAccountName= “<InsertStorageAccountNameHere>”