Unsolved Can't mount Azure file share using IAM

---

Hello ITPro, I am going through the latest AZ-104 training and came across the module "Configure Azure AD Auth for a storage account".

I am able to mount a share using the Access Key over the public internet, no problem. However I am having trouble getting User Access to shares. I did deploy Azure Active Directory Directory Services into its own resource group successfully and enabled this option on the storage account...

I am using the "Owner" account which should have full blown rights already. I didn't go ahead and apply additional permissions. Ie...

I keep getting this error when attempting to map the drive though. What did I miss?

I came across this article while troubleshooting...
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-mount-file-share

What does this mean exactly? You can mount the share over the internet without a VPN using the key, but you can't using a user account? I know you can connect to file server shares on-prem without the client being joined to the domain, you just have to manually type creds. This isn't supported by Azure file shares?

Regards,
Adam Tyler

@Adam-Tyler ,

I hope all is well. The immediate issue that you are having is most likely a permission issue being caused by the assumption that the "owner" will automatically have permissions to use the share.

If you take a look at the following, which also parallels the information in the beginning of the episode where I discuss the pre-requisites, you will see that any account that will access the share needs to have a role defined permission assigned, & that FULL ADMINISTRATIVE ACCESS IS ONLY GRANTED VIA THE USE OF THE KEY.

https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions

Start by fixing the permissions issue and see how things go from there. The machine does need to be Domain Joined, as I also discuss in the pre-requisites section as well.

Good Luck !!!

@Adam-Gordon Hi Adam! I did run across this how-to from Microsoft explaining 4 steps for connecting to an SMB share using an identity instead of the key. Part two does touch on "share permissions" and through my hours of troubleshooting I did finally grant "Storage File Data SMB Share Elevated Contributor" on the storage account containing the SMB share. I still get the same error.

https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable?WT.mc_id=Portal-Microsoft_Azure_Storage#overview

In this case my test account is Brent Scott.

I even went as far as to deploy a Windows server VM into the AADDS vnet, joined to the AADDS domain (that was a trick in and of itself), then installed the AD RSAT tool set. My user and storage account appear to be joined to the domain successfully and I was able to login to this member server using the testing Brent Scott account. So Azure AD and AADDS both like the password....

And the storage account appears to be joined to the AADDS instance just fine...

Still getting error.. I am using a client machine (Windows 10 2004) that is only joined to Azure Active Directory. There is no on premise AD yet, I plan to get there. Is that a requirement too or can I use an Azure AD account and computer only to manage SMB shares using an identity?

I also ran across this bit of direction...

Ooooooookay.. So I connected to the SMB share using the key on the Azure Joined AD machine. I thought that I would be able to modify NTFS permissions using the traditional method, but the Azure AD domain is not available. I only have the storage account context to choose from. Not sure what I am missing, but this is crazy complicated and difficult. Hours and hours into it already, still can't connect to a share as a user. Sorta dumb...

Regards,
Adam Tyler

So.. Update. Remember that VM I deployed within the same vnet as the AADDS implementation? Well, if I run the connection script to map the drive using the test account bscott, the drive gets connected and it works just as I would expect. I am only having trouble connecting in this manner on a computer that is not hosted within Azure that is joined to the Azure Active Directory. Is that my problem? Does there need to be some kind of VPN in place to allow the remote VM to query the AADDS directly? I was hoping that Azure Active Directory could provide this access over the internet instead, but maybe not?

Regards,
Adam Tyler