You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/storage/files/storage-files-identity-ad-ds-assign-permissions.md
+13-12Lines changed: 13 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,39 +1,40 @@
1
1
---
2
-
title: Control access to Azure file shares by assigning share-level permissions
3
-
description: Learn how to assign share-level permissions to a Microsoft Entra identity that represents a hybrid user to control user access to Azure file shares with identity-based authentication.
2
+
title: Assign share-level permissions for Azure Files
3
+
description: Learn how to control access to Azure Files by assigning share-level permissions to a Microsoft Entra identity that represents a hybrid user to control user access to Azure file shares with identity-based authentication.
# Assign share-level permissions for Azure file shares
15
15
16
16
Once you've enabled an Active Directory (AD) source for your storage account, you must configure share-level permissions in order to get access to your file share. There are two ways you can assign share-level permissions. You can assign them to [specific Microsoft Entra users/groups](#share-level-permissions-for-specific-azure-ad-users-or-groups), and you can assign them to all authenticated identities as a [default share-level permission](#share-level-permissions-for-all-authenticated-identities).
17
17
18
18
> [!IMPORTANT]
19
19
> Full administrative control of a file share, including the ability to take ownership of a file, requires using the storage account key. Full administrative control isn't supported with identity-based authentication.
20
20
21
21
## Applies to
22
+
22
23
| File share type | SMB | NFS |
23
24
|-|:-:|:-:|
24
25
| Standard file shares (GPv2), LRS/ZRS |||
25
26
| Standard file shares (GPv2), GRS/GZRS |||
Share-level permissions on Azure file shares are configured for Microsoft Entra users, groups, or service principals, while directory and file-level permissions are enforced using Windows access control lists (ACLs). You must assign share-level permissions to the Microsoft Entra identity representing the same user, group, or service principal in your AD DS in order to support AD DS authentication to your Azure file share. Authentication and authorization against identities that only exist in Microsoft Entra ID, such as Azure Managed Identities (MSIs), aren't supported.
31
32
32
33
Most users should assign share-level permissions to specific Microsoft Entra users or groups, and then use Windows ACLs for granular access control at the directory and file level. This is the most stringent and secure configuration.
33
34
34
35
There are three scenarios where we instead recommend using a [default share-level permission](#share-level-permissions-for-all-authenticated-identities) to allow contributor, elevated contributor, or reader access to all authenticated identities:
35
36
36
-
- If you are unable to sync your on-premises AD DS to Microsoft Entra ID, you can use a default share-level permission. Assigning a default share-level permission allows you to work around the sync requirement because you don't need to specify the permission to identities in Microsoft Entra ID. Then you can use Windows ACLs for granular permission enforcement on your files and directories.
37
+
- If you're unable to sync your on-premises AD DS to Microsoft Entra ID, you can use a default share-level permission. Assigning a default share-level permission allows you to work around the sync requirement because you don't need to specify the permission to identities in Microsoft Entra ID. Then you can use Windows ACLs for granular permission enforcement on your files and directories.
37
38
- Identities that are tied to an AD but aren't synching to Microsoft Entra ID can also leverage the default share-level permission. This could include standalone Managed Service Accounts (sMSA), group Managed Service Accounts (gMSA), and computer accounts.
38
39
- The on-premises AD DS you're using is synched to a different Microsoft Entra ID than the Microsoft Entra ID the file share is deployed in.
39
40
- This is typical when you're managing multi-tenant environments. Using a default share-level permission allows you to bypass the requirement for a Microsoft Entra ID [hybrid identity](../../active-directory/hybrid/whatis-hybrid-identity.md). You can still use Windows ACLs on your files and directories for granular permission enforcement.
@@ -42,7 +43,7 @@ There are three scenarios where we instead recommend using a [default share-leve
42
43
> [!NOTE]
43
44
> Because computer accounts don't have an identity in Microsoft Entra ID, you can't configure Azure role-based access control (RBAC) for them. However, computer accounts can access a file share by using a [default share-level permission](#share-level-permissions-for-all-authenticated-identities).
44
45
45
-
## Share-level permissions
46
+
## Share-level permissions and Azure RBAC roles
46
47
47
48
The following table lists the share-level permissions and how they align with the built-in Azure RBAC roles:
48
49
@@ -81,7 +82,7 @@ To assign an Azure role to a Microsoft Entra identity, using the [Azure portal](
81
82
1. In the Azure portal, go to your file share, or [create a file share](storage-how-to-create-file-share.md).
82
83
1. Select **Access Control (IAM)**.
83
84
1. Select **Add a role assignment**
84
-
1. In the **Add role assignment** blade, select the [appropriate built-in role](#share-level-permissions) from the **Role** list.
85
+
1. In the **Add role assignment** blade, select the [appropriate built-in role](#share-level-permissions-and-azure-rbac-roles) from the **Role** list.
85
86
1. Storage File Data SMB Share Reader
86
87
1. Storage File Data SMB Share Contributor
87
88
1. Storage File Data SMB Share Elevated Contributor
@@ -117,7 +118,7 @@ az role assignment create --role "<role-name>" --assignee <user-principal-name>
117
118
118
119
## Share-level permissions for all authenticated identities
119
120
120
-
You can add a default share-level permission on your storage account, instead of configuring share-level permissions for Microsoft Entra users or groups. A default share-level permission assigned to your storage account applies to all file shares contained in the storage account.
121
+
You can add a default share-level permission on your storage account, instead of configuring share-level permissions for Microsoft Entra users or groups. A default share-level permission assigned to your storage account applies to all file shares contained in the storage account.
121
122
122
123
When you set a default share-level permission, all authenticated users and groups will have the same permission. Authenticated users or groups are identified as the identity can be authenticated against the on-premises AD DS the storage account is associated with. The default share-level permission is set to **None** at initialization, implying that no access is allowed to files or directories in the Azure file share.
123
124
@@ -131,7 +132,7 @@ To configure default share-level permissions on your storage account using the [
131
132
132
133
:::image type="content" source="media/storage-files-identity-ad-ds-assign-permissions/set-default-share-level-permission.png" alt-text="Screenshot showing how to set a default share-level permission using the Azure portal." lightbox="media/storage-files-identity-ad-ds-assign-permissions/set-default-share-level-permission.png" border="true":::
133
134
134
-
1. Select the appropriate role to be enabled as the default [share permission](#share-level-permissions) from the dropdown list.
135
+
1. Select the appropriate role to be enabled as the default [share permission](#share-level-permissions-and-azure-rbac-roles) from the dropdown list.
You could also assign permissions to all authenticated Microsoft Entra users and specific Microsoft Entra users/groups. With this configuration, a specific user or group will have whichever is the higher-level permission from the default share-level permission and RBAC assignment. In other words, say you granted a user the **Storage File Data SMB Reader** role on the target file share. You also granted the default share-level permission **Storage File Data SMB Share Elevated Contributor** to all authenticated users. With this configuration, that particular user will have **Storage File Data SMB Share Elevated Contributor** level of access to the file share. Higher-level permissions always take precedence.
170
171
171
-
## Next steps
172
+
## Next step
172
173
173
-
Now that you've assigned share-level permissions, you can [configure directory and file-level permissions](storage-files-identity-ad-ds-configure-permissions.md). Remember that share-level permissions can take up to three hours to take effect.
174
+
Now that you've assigned share-level permissions, you can [configure directory and file-level permissions](storage-files-identity-ad-ds-configure-permissions.md). Remember that share-level permissions can take up to three hours to take effect.
Copy file name to clipboardExpand all lines: articles/storage/files/storage-files-identity-ad-ds-configure-permissions.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,16 @@
1
1
---
2
-
title: Control what a user can do at the directory and file level - Azure Files
3
-
description: Learn how to configure Windows ACLs for directory and file level permissions for Active Directory authentication to Azure file shares, allowing you to take advantage of granular access control.
2
+
title: Configure directory and file level permissions for Azure Files
3
+
description: Learn how to configure Windows ACLs for directory and file level permissions for Active Directory (AD) authentication to Azure file shares over SMB for granular access control.
4
4
author: khdownie
5
5
ms.service: azure-file-storage
6
6
ms.topic: how-to
7
-
ms.date: 05/03/2024
7
+
ms.date: 05/09/2024
8
8
ms.author: kendownie
9
9
ms.custom: engagement-fy23
10
10
recommendations: false
11
11
---
12
12
13
-
# Configure directory and file-level permissions over SMB
13
+
# Configure directory and file-level permissions for Azure file shares
14
14
15
15
Before you begin this article, make sure you've read [Assign share-level permissions to an identity](storage-files-identity-ad-ds-assign-permissions.md) to ensure that your share-level permissions are in place with Azure role-based access control (RBAC).
Copy file name to clipboardExpand all lines: articles/storage/files/storage-files-identity-ad-ds-enable.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,16 @@
1
1
---
2
-
title: Enable AD DS authentication for Azure file shares
3
-
description: Learn how to enable Active Directory Domain Services authentication over SMB for Azure file shares. Your domain-joined Windows virtual machines can then access Azure file shares by using AD DS credentials.
2
+
title: Enable AD DS authentication for Azure Files
3
+
description: Learn how to enable Active Directory Domain Services authentication over SMB for Azure file shares. Your domain-joined Windows virtual machines can then access Azure file shares by using AD DS credentials.
# Enable AD DS authentication for Azure file shares
13
+
# Enable Active Directory Domain Services authentication for Azure file shares
14
14
15
15
This article describes the process for enabling Active Directory Domain Services (AD DS) authentication on your storage account in order to use on-premises Active Directory (AD) credentials for authenticating to Azure file shares.
16
16
@@ -269,6 +269,6 @@ DomainSid:<yourSIDHere>
269
269
AzureStorageID:<yourStorageSIDHere>
270
270
```
271
271
272
-
## Next steps
272
+
## Next step
273
273
274
274
You've now successfully enabled AD DS on your storage account. To use the feature, you must [assign share-level permissions](storage-files-identity-ad-ds-assign-permissions.md).
Copy file name to clipboardExpand all lines: articles/storage/files/storage-files-identity-ad-ds-mount-file-share.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,10 @@
1
1
---
2
2
title: Mount SMB Azure file share using AD DS credentials
3
-
description: Learn how to mount an SMB Azure file share using your on-premises Active Directory Domain Services credentials.
3
+
description: Learn how to mount an SMB Azure file share using your on-premises Active Directory Domain Services (AD DS) credentials.
4
4
author: khdownie
5
5
ms.service: azure-file-storage
6
6
ms.topic: how-to
7
-
ms.date: 12/21/2023
7
+
ms.date: 05/09/2024
8
8
ms.author: kendownie
9
9
ms.custom: engagement-fy23
10
10
recommendations: false
@@ -106,6 +106,6 @@ To use this method, complete the following steps:
106
106
107
107
You should now be able to mount the file share using *storageaccount.domainname.com*. You can also mount the file share using the storage account key.
108
108
109
-
## Next steps
109
+
## Next step
110
110
111
111
If the identity you created in AD DS to represent the storage account is in a domain or OU that enforces password rotation, you might need to [update the password of your storage account identity in AD DS](storage-files-identity-ad-ds-update-password.md).
Copy file name to clipboardExpand all lines: articles/storage/files/storage-files-identity-ad-ds-update-password.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,10 @@
1
1
---
2
-
title: Update AD DS storage account password
3
-
description: Learn how to update the password of the Active Directory Domain Services computer or service account that represents your storage account. This prevents authentication failures and keeps the storage account from being deleted when the password expires.
2
+
title: Update password for an AD DS storage account identity
3
+
description: Learn how to update the password of the Active Directory Domain Services (AD DS) identity that represents your storage account. This prevents authentication failures and keeps the storage account from being deleted when the password expires.
4
4
author: khdownie
5
5
ms.service: azure-file-storage
6
6
ms.topic: how-to
7
-
ms.date: 11/17/2022
7
+
ms.date: 05/09/2024
8
8
ms.author: kendownie
9
9
recommendations: false
10
10
---
@@ -16,20 +16,21 @@ If you registered the Active Directory Domain Services (AD DS) identity/account
16
16
To prevent unintended password rotation, during the onboarding of the Azure storage account in the domain, make sure to place the Azure storage account into a separate organizational unit in AD DS. Disable Group Policy inheritance on this organizational unit to prevent default domain policies or specific password policies from being applied.
17
17
18
18
> [!NOTE]
19
-
> A storage account identity in AD DS can be either a service account or a computer account. Service account passwords can expire in AD; however, because computer account password changes are driven by the client machine and not AD, they don't expire in AD.
19
+
> A storage account identity in AD DS can be either a service account or a computer account. Service account passwords can expire in Active Directory (AD); however, because computer account password changes are driven by the client machine and not AD, they don't expire in AD.
20
20
21
21
There are two options for triggering password rotation. You can use the `AzFilesHybrid` module or Active Directory PowerShell. Use one method, not both.
22
22
23
23
## Applies to
24
+
24
25
| File share type | SMB | NFS |
25
26
|-|:-:|:-:|
26
27
| Standard file shares (GPv2), LRS/ZRS |||
27
28
| Standard file shares (GPv2), GRS/GZRS |||
You can run the `Update-AzStorageAccountADObjectPassword` cmdlet from the [AzFilesHybrid module](https://github.com/Azure-Samples/azure-files-samples/releases). This command must be run in an on-premises AD DS-joined environment by a [hybrid identity](../../active-directory/hybrid/whatis-hybrid-identity.md) with owner permission to the storage account and AD DS permissions to change the password of the identity representing the storage account. The command performs actions similar to storage account key rotation. Specifically, it gets the second Kerberos key of the storage account and uses it to update the password of the registered account in AD DS. Then it regenerates the target Kerberos key of the storage account and updates the password of the registered account in AD DS.
33
+
You can run the `Update-AzStorageAccountADObjectPassword` cmdlet from the [AzFilesHybrid module](https://github.com/Azure-Samples/azure-files-samples/releases). You must run this command in an on-premises AD DS-joined environment by a [hybrid identity](../../active-directory/hybrid/whatis-hybrid-identity.md) with owner permission to the storage account and AD DS permissions to change the password of the identity representing the storage account. The command performs actions similar to storage account key rotation. Specifically, it gets the second Kerberos key of the storage account and uses it to update the password of the registered account in AD DS. Then it regenerates the target Kerberos key of the storage account and updates the password of the registered account in AD DS.
33
34
34
35
```PowerShell
35
36
# Update the password of the AD DS account registered for the storage account
This action will change the password for the AD object from kerb1 to kerb2. This is intended to be a two-stage process: rotate from kerb1 to kerb2 (kerb2 will be regenerated on the storage account before being set), wait several hours, and then rotate back to kerb1 (this cmdlet will likewise regenerate kerb1).
44
45
45
-
## Use Active Directory PowerShell
46
+
## Option 2: Use Active Directory PowerShell
46
47
47
48
If you don't want to download the `AzFilesHybrid` module, you can use [Active Directory PowerShell](/powershell/module/activedirectory).
Copy file name to clipboardExpand all lines: articles/storage/files/storage-files-identity-auth-active-directory-enable.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,15 @@
1
1
---
2
-
title: Overview - On-premises AD DS authentication to Azure file shares
3
-
description: Learn about Active Directory Domain Services (AD DS) authentication to Azure file shares. This article goes over supported scenarios, availability, and explains how the permissions work between your AD DS and Microsoft Entra ID.
2
+
title: Overview of on-premises AD DS authentication for Azure Files
3
+
description: Learn about Active Directory Domain Services (AD DS) authentication to Azure file shares over SMB, including supported scenariosand how permissions work between AD DS and Microsoft Entra ID.
4
4
author: khdownie
5
5
ms.service: azure-file-storage
6
6
ms.topic: how-to
7
-
ms.date: 03/04/2024
7
+
ms.date: 05/09/2024
8
8
ms.author: kendownie
9
9
recommendations: false
10
10
---
11
11
12
-
# Overview - on-premises Active Directory Domain Services authentication over SMB for Azure file shares
12
+
# Overview: On-premises Active Directory Domain Services authentication over SMB for Azure file shares
@@ -95,6 +95,6 @@ The following diagram illustrates the end-to-end workflow for enabling AD DS aut
95
95
96
96
Identities used to access Azure file shares must be synced to Microsoft Entra ID to enforce share-level file permissions through the [Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md) model. Alternatively, you can use a default share-level permission. [Windows-style DACLs](/previous-versions/technet-magazine/cc161041(v=msdn.10)) on files/directories carried over from existing file servers will be preserved and enforced. This offers seamless integration with your enterprise AD DS environment. As you replace on-premises file servers with Azure file shares, existing users can access Azure file shares from their current clients with a single sign-on experience, without any change to the credentials in use.
97
97
98
-
## Next steps
98
+
## Next step
99
99
100
100
To get started, you must [enable AD DS authentication for your storage account](storage-files-identity-ad-ds-enable.md).
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments