Merge pull request #89999 from roygara/filesAD

Files AD changes

Author: megvanhuygen

articles/storage/common/storage-auth.md

@@ -7,7 +7,7 @@ author: tamram
 
 ms.service: storage
 ms.topic: conceptual
-ms.date: 12/12/2019
+ms.date: 02/19/2020
 ms.author: tamram
 ms.reviewer: cbrooks
 ms.subservice: common
@@ -19,19 +19,21 @@ Each time you access data in your storage account, your client makes a request o
 
 The following table describes the options that Azure Storage offers for authorizing access to resources:
 
-|  |Shared Key (storage account key)  |Shared access signature (SAS)  |Azure Active Directory (Azure AD)  |Anonymous public read access  |
-|---------|---------|---------|---------|---------|
-|Azure Blobs     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |[Supported](storage-auth-aad.md)         |[Supported](../blobs/storage-manage-access-to-resources.md)         |
-|Azure Files (SMB)     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |Not supported         |[Supported, only with AAD Domain Services](../files/storage-files-active-directory-overview.md)         |Not supported         |
-|Azure Files (REST)     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |Not supported         |Not supported         |
-|Azure Queues     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |[Supported](storage-auth-aad.md)         |Not supported         |
-|Azure Tables     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |Not supported         |Not supported         |
+|  |Shared Key (storage account key)  |Shared access signature (SAS)  |Azure Active Directory (Azure AD)  |Active Directory (preview)|Anonymous public read access  |
+|---------|---------|---------|---------|---------|---------|
+|Azure Blobs     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |[Supported](storage-auth-aad.md)         |Not supported|[Supported](../blobs/storage-manage-access-to-resources.md)         |
+|Azure Files (SMB)     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |Not supported         |[Supported, only with AAD Domain Services](../files/storage-files-active-directory-overview.md)         |[Supported, credentials must be synced to Azure AD](../files/storage-files-active-directory-overview.md)|Not supported         |
+|Azure Files (REST)     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |Not supported         |Not supported |Not supported         |
+|Azure Queues     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |[Supported](storage-auth-aad.md)         |Not Supported | Not supported         |
+|Azure Tables     |[Supported](/rest/api/storageservices/authorize-with-shared-key/)         |[Supported](storage-sas-overview.md)         |Not supported         |Not supported| Not supported         |
 
 Each authorization option is briefly described below:
 
 - **Azure Active Directory (Azure AD) integration** for blobs, and queues. Azure AD provides role-based access control (RBAC) for fine-grained control over a client's access to resources in a storage account. For more information regarding Azure AD integration for blobs and queues, see [Authorize access to Azure blobs and queues using Azure Active Directory](storage-auth-aad.md).
 
-- **Azure AD Domain Services (DS) integration (preview)** for files. Azure Files supports identity-based authorization over Server Message Block (SMB) through Azure AD DS. You can use RBAC for fine-grained control over a client's access to Azure Files resources in a storage account. For more information regarding Azure AD integration for files using domain services, see [Overview of Azure Files Azure Active Directory Domain Service (AAD DS) Authentication Support for SMB Access (preview)](../files/storage-files-active-directory-overview.md).
+- **Azure Active Directory Domain Services (Azure AD DS) authentication** for files. Azure Files supports identity-based authorization over Server Message Block (SMB) through Azure AD DS. You can use RBAC for fine-grained control over a client's access to Azure Files resources in a storage account. For more information regarding Azure Files authentication using domain services, refer to our [overview](../files/storage-files-active-directory-overview.md).
+
+- **Active Directory (AD) authentication (preview)** for files. Azure Files supports identity-based authorization over SMB through AD. Your AD domain service can be hosted on on-premises machines or in Azure VMs. SMB access to Files is supported using AD credentials from domain joined machines, either on-premises or in Azure. You can use RBAC for share level access control and NTFS DACLs for directory/file level permission enforcement. For more information regarding Azure Files authentication using domain services, refer to our [overview](../files/storage-files-active-directory-overview.md).
 
 - **Shared Key authorization** for blobs, files, queues, and tables. A client using Shared Key passes a header with every request that is signed using the storage account access key. For more information, see [Authorize with Shared Key](/rest/api/storageservices/authorize-with-shared-key/).
 - **Shared access signatures** for blobs, files, queues, and tables. Shared access signatures (SAS) provide limited delegated access to resources in a storage account. Adding constraints on the time interval for which the signature is valid or on permissions it grants provides flexibility in managing access. For more information, see [Using shared access signatures (SAS)](storage-sas-overview.md).

articles/storage/files/TOC.yml

@@ -43,7 +43,7 @@
       href: ../common/storage-auth.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json
     - name: Azure Storage encryption
       href: ../common/storage-service-encryption.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json
-    - name: Azure AD authentication over SMB
+    - name: Identity-based authentication and authorization
       href: storage-files-active-directory-overview.md
     - name: Use Azure Private Endpoints
       href: ../common/storage-private-endpoints.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json  
@@ -173,7 +173,9 @@
       href: ../common/storage-network-security.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json
     - name: Require secure transfer
       href: ../common/storage-require-secure-transfer.md?toc=%2fazure%2fstorage%2ffiles%2ftoc.json
-    - name: Enable Azure AD authentication over SMB
+    - name: Enable AD authentication and authorization
+      href: storage-files-active-directory-domain-services-enable.md
+    - name: Enable Azure AD DS authentication and authorization
       href: storage-files-active-directory-enable.md
     - name: Enable secure TLS for Azure Storage client
       href: ../common/storage-security-tls.md