You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -44,7 +44,7 @@ Before implementing the incoming trust-based authentication flow, make sure that
44
44
|**Prerequisite**|**Description**|
45
45
| --- | --- |
46
46
| Client must run Windows 10, Windows Server 2012, or a higher version of Windows. ||
47
-
| Clients must be joined to Active Directory (AD). The domain must have a functional level of Windows Server 2012 or higher. | You can determine if the client is joined to AD by running the [dsregcmd command](/azure/active-directory/devices/troubleshoot-device-dsregcmd): `dsregcmd.exe /status`|
47
+
| Clients must be joined to Active Directory (AD). The domain must have a functional level of Windows Server 2012 or higher. | You can determine if the client is joined to Active Directory by running the [dsregcmd command](/azure/active-directory/devices/troubleshoot-device-dsregcmd): `dsregcmd.exe /status`|
48
48
| A Microsoft Entra tenant. | A Microsoft Entra Tenant is an identity security boundary that's under the control of your organization's IT department. It's an instance of Microsoft Entra ID in which information about a single organization resides. |
49
49
| An Azure subscription under the same Entra tenant you plan to use for authentication. ||
50
50
| An Azure storage account in the Azure subscription. | An Azure storage account is a resource that acts as a container for grouping all the data services from Azure Storage, including files. |
@@ -142,8 +142,8 @@ You can configure the API permissions from the [Azure portal](https://portal.azu
142
142
1. Select **Grant admin consent for [Directory Name]** to grant consent for the three requested API permissions (openid, profile, and User.Read) for all accounts in the directory.
143
143
1. Select **Yes** to confirm.
144
144
145
-
> [!IMPORTANT]
146
-
> If you're connecting to a storage account through a private endpoint or private link by using Microsoft Entra Kerberos authentication, add the private link FQDN to the storage account's Entra application. For instructions, see the entry in the [troubleshooting guide](/troubleshoot/azure/azure-storage/files-troubleshoot-smb-authentication?toc=/azure/storage/files/toc.json#error-1326---the-username-or-password-is-incorrect-when-using-private-link).
145
+
> [!IMPORTANT]
146
+
> If you're connecting to a storage account through a private endpoint or private link by using Microsoft Entra Kerberos authentication, add the private link FQDN to the storage account's Entra application. For instructions, see the entry in the [troubleshooting guide](/troubleshoot/azure/azure-storage/files-troubleshoot-smb-authentication?toc=/azure/storage/files/toc.json#error-1326---the-username-or-password-is-incorrect-when-using-private-link).
147
147
148
148
### Disable multifactor authentication on the storage account
149
149
@@ -153,8 +153,8 @@ The storage account app should have the same name as the storage account in the
153
153
154
154
Remember to replace `<your-storage-account-name>` with the proper value.
155
155
156
-
> [!IMPORTANT]
157
-
> If you don't exclude MFA policies from the storage account app, you can't access the file share. Trying to map the file share by using `net use` results in an error message that says "System error 1327: Account restrictions are preventing this user from signing in. For example: blank passwords aren't allowed, sign-in times are limited, or a policy restriction has been enforced."
156
+
> [!IMPORTANT]
157
+
> If you don't exclude MFA policies from the storage account app, you can't access the file share. Trying to map the file share by using `net use` results in an error message that says "System error 1327: Account restrictions are preventing this user from signing in. For example: blank passwords aren't allowed, sign-in times are limited, or a policy restriction has been enforced."
158
158
159
159
For guidance on disabling MFA, see the following articles:
1. Set the common parameters. Customize the script before running it.
219
219
220
-
- Set the `$domain` parameter to your on-premises Active Directory domain name.
221
-
- When prompted by `Get-Credential`, enter an on-premises Active Directory administrator username and password. This account must either be a member of the Domain Admins group for the domain or a member of the Enterprise Admins group for the domain's forest.
222
-
- Set the `$cloudUserName` parameter to the username of a Global Administrator privileged account for Entra ID cloud access.
220
+
- Set the `$domain` parameter to your on-premises Active Directory domain name.
221
+
- When prompted by `Get-Credential`, enter an on-premises Active Directory administrator username and password. This account must either be a member of the Domain Admins group for the domain or a member of the Enterprise Admins group for the domain's forest.
222
+
- Set the `$cloudUserName` parameter to the username of a Global Administrator privileged account for Entra ID cloud access.
223
223
224
-
> [!NOTE]
225
-
> If you want to use your current Windows sign-in account for your on-premises Active Directory access, you can skip the step where you assign credentials to the `$domainCred` parameter. If you take this approach, don't include the `-DomainCredential` parameter in the PowerShell commands following this step.
224
+
> [!NOTE]
225
+
> If you want to use your current Windows sign-in account for your on-premises Active Directory access, you can skip the step where you assign credentials to the `$domainCred` parameter. If you take this approach, don't include the `-DomainCredential` parameter in the PowerShell commands following this step.
226
226
227
-
```powershell
228
-
$domain = "your on-premises domain name, for example contoso.com"
229
-
230
-
$domainCred = Get-Credential
231
-
232
-
$cloudUserName = "Azure AD user principal name, for example [email protected]"
233
-
```
227
+
```powershell
228
+
$domain = "your on-premises domain name, for example contoso.com"
229
+
$domainCred = Get-Credential
230
+
$cloudUserName = "Microsoft Entra ID user principal name, for example [email protected]"
231
+
```
234
232
235
233
1. Check the current Kerberos Domain Settings.
236
234
237
-
Run the following command to check your domain's current Kerberos settings:
238
-
239
-
```powershell
240
-
Get-AzureAdKerberosServer -Domain $domain `
241
-
-DomainCredential $domainCred `
242
-
-UserPrincipalName $cloudUserName
243
-
```
244
-
245
-
If this is the first time calling any Microsoft Entra Kerberos command, you're prompted for Entra ID cloud access.
246
-
- Enter the password for your Entra ID Global Administrator account.
247
-
- If your organization uses other modern authentication methods such as Entra multifactor authentication or Smart Card, follow the instructions as requested for sign in.
248
-
249
-
If this is the first time you're configuring Microsoft Entra Kerberos settings, the [Get-AzureAdKerberosServer cmdlet](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises#view-and-verify-the-azure-ad-kerberos-server) displays empty information, as in the following sample output:
250
-
251
-
```output
252
-
ID :
253
-
UserAccount :
254
-
ComputerAccount :
255
-
DisplayName :
256
-
DomainDnsName :
257
-
KeyVersion :
258
-
KeyUpdatedOn :
259
-
KeyUpdatedFrom :
260
-
CloudDisplayName :
261
-
CloudDomainDnsName :
262
-
CloudId :
263
-
CloudKeyVersion :
264
-
CloudKeyUpdatedOn :
265
-
CloudTrustDisplay :
266
-
```
267
-
268
-
If your domain already supports FIDO authentication, the `Get-AzureAdKerberosServer` cmdlet displays Entra service account information, as in the following sample output. The `CloudTrustDisplay` field returns an empty value.
Run the following command to check your domain's current Kerberos settings:
236
+
237
+
```powershell
238
+
Get-AzureAdKerberosServer -Domain $domain `
239
+
-DomainCredential $domainCred `
240
+
-UserPrincipalName $cloudUserName
241
+
```
242
+
243
+
If this is the first time calling any Microsoft Entra Kerberos command, you're prompted for Entra ID cloud access.
244
+
245
+
- Enter the password for your Entra ID Global Administrator account.
246
+
- If your organization uses other modern authentication methods such as Entra multifactor authentication or Smart Card, follow the instructions as requested for sign in.
247
+
248
+
If this is the first time you're configuring Microsoft Entra Kerberos settings, the [Get-AzureAdKerberosServer cmdlet](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises#view-and-verify-the-azure-ad-kerberos-server) displays empty information, as in the following sample output:
249
+
250
+
```output
251
+
ID :
252
+
UserAccount :
253
+
ComputerAccount :
254
+
DisplayName :
255
+
DomainDnsName :
256
+
KeyVersion :
257
+
KeyUpdatedOn :
258
+
KeyUpdatedFrom :
259
+
CloudDisplayName :
260
+
CloudDomainDnsName :
261
+
CloudId :
262
+
CloudKeyVersion :
263
+
CloudKeyUpdatedOn :
264
+
CloudTrustDisplay :
265
+
```
266
+
267
+
If your domain already supports FIDO authentication, the `Get-AzureAdKerberosServer` cmdlet displays Entra service account information, as in the following sample output. The `CloudTrustDisplay` field returns an empty value.
Run the [Set-AzureAdKerberosServer PowerShell cmdlet](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises#create-a-kerberos-server-object) to add the Trusted Domain Object. Be sure to include `-SetupCloudTrust` parameter. If there's no Entra service account, this command creates a new Entra service account. This command only creates the requested Trusted Domain object if there's a Entra service account.
> In a multiple domain forest, to avoid the error *LsaCreateTrustedDomainEx 0x549* when running the command on a child domain:
297
-
>
298
-
> 1. Run the command on root domain (include `-SetupCloudTrust` parameter).
299
-
> 1. Run the same command on the child domain without the `-SetupCloudTrust` parameter.
300
-
301
-
After creating the Trusted Domain Object, you can check the updated Kerberos Settings by using the `Get-AzureAdKerberosServer` PowerShell cmdlet, as shown in the previous step. If the `Set-AzureAdKerberosServer` cmdlet runs successfully with the `-SetupCloudTrust` parameter, the `CloudTrustDisplay` field returns `Microsoft.AzureAD.Kdc.Service.TrustDisplay`, as shown in the following sample output:
> Azure sovereign clouds require setting the `TopLevelNames` property, which is set to `windows.net` by default. Azure sovereign cloud deployments of Azure SQL Managed Instance use a different top-level domain name, such as `usgovcloudapi.net` for Azure US Government. Set your Trusted Domain Object to that top-level domain name by using the following PowerShell command: `Set-AzureADKerberosServer -Domain $domain -DomainCredential $domainCred -CloudCredential $cloudCred -SetupCloudTrust -TopLevelNames "usgovcloudapi.net,windows.net"`. You can verify the setting by using the following PowerShell command: `Get-AzureAdKerberosServer -Domain $domain -DomainCredential $domainCred -UserPrincipalName $cloudUserName | Select-Object -ExpandProperty CloudTrustDisplay`.
288
+
Run the [Set-AzureAdKerberosServer PowerShell cmdlet](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises#create-a-kerberos-server-object) to add the Trusted Domain Object. Be sure to include `-SetupCloudTrust` parameter. If there's no Entra service account, this command creates a new Entra service account. This command only creates the requested Trusted Domain object if there's a Entra service account.
> In a multiple domain forest, to avoid the error *LsaCreateTrustedDomainEx 0x549* when running the command on a child domain:
296
+
>
297
+
> 1. Run the command on root domain (include `-SetupCloudTrust` parameter).
298
+
> 1. Run the same command on the child domain without the `-SetupCloudTrust` parameter.
299
+
300
+
After creating the Trusted Domain Object, you can check the updated Kerberos Settings by using the `Get-AzureAdKerberosServer` PowerShell cmdlet, as shown in the previous step. If the `Set-AzureAdKerberosServer` cmdlet runs successfully with the `-SetupCloudTrust` parameter, the `CloudTrustDisplay` field returns `Microsoft.AzureAD.Kdc.Service.TrustDisplay`, as shown in the following sample output:
> Azure sovereign clouds require setting the `TopLevelNames` property, which is set to `windows.net` by default. Azure sovereign cloud deployments of Azure SQL Managed Instance use a different top-level domain name, such as `usgovcloudapi.net` for Azure US Government. Set your Trusted Domain Object to that top-level domain name by using the following PowerShell command: `Set-AzureADKerberosServer -Domain $domain -DomainCredential $domainCred -CloudCredential $cloudCred -SetupCloudTrust -TopLevelNames "usgovcloudapi.net,windows.net"`. You can verify the setting by using the following PowerShell command: `Get-AzureAdKerberosServer -Domain $domain -DomainCredential $domainCred -UserPrincipalName $cloudUserName | Select-Object -ExpandProperty CloudTrustDisplay`.
322
321
323
322
## Configure the clients to retrieve Kerberos tickets
324
323
@@ -328,22 +327,22 @@ Set this Group Policy on the clients to "Enabled": `Administrative Templates\Sys
328
327
329
328
1. Deploy the following Group Policy setting to client machines by using the incoming trust-based flow:
330
329
331
-
1. Edit the **Administrative Templates\System\Kerberos\Specify KDC proxy servers for Kerberos clients** policy setting.
332
-
1. Select **Enabled**.
333
-
1. Under **Options**, select **Show...**. This selection opens the Show Contents dialog box.
330
+
1. Edit the **Administrative Templates\System\Kerberos\Specify KDC proxy servers for Kerberos clients** policy setting.
331
+
1. Select **Enabled**.
332
+
1. Under **Options**, select **Show...**. This selection opens the Show Contents dialog box.
334
333
335
-
:::image type="content" source="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy.png" alt-text="Screenshot of dialog box to enable 'Specify KDC proxy servers for Kerberos clients'. The 'Show Contents' dialog allows input of a value name and the related value." lightbox="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy.png":::
334
+
:::image type="content" source="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy.png" alt-text="Screenshot of dialog box to enable 'Specify KDC proxy servers for Kerberos clients'. The 'Show Contents' dialog allows input of a value name and the related value." lightbox="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy.png":::
336
335
337
-
1. Define the KDC proxy servers settings using mappings as follows. Substitute your Entra tenant ID for the `your_Azure_AD_tenant_id` placeholder. Note the space following `https` and before the closing `/` in the value mapping.
336
+
1. Define the KDC proxy servers settings using mappings as follows. Substitute your Entra tenant ID for the `your_Azure_AD_tenant_id` placeholder. Note the space following `https` and before the closing `/` in the value mapping.
:::image type="content" source="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy-server-settings-detail.png" alt-text="Screenshot of the 'Define KDC proxy server settings' dialog box. A table allows input of multiple rows. Each row consists of a value name and a value." lightbox="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy-server-settings-detail.png":::
342
+
:::image type="content" source="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy-server-settings-detail.png" alt-text="Screenshot of the 'Define KDC proxy server settings' dialog box. A table allows input of multiple rows. Each row consists of a value name and a value." lightbox="media/storage-files-identity-auth-hybrid-cloud-trust/configure-policy-kdc-proxy-server-settings-detail.png":::
344
343
345
-
1. Select **OK** to close the 'Show Contents' dialog box.
346
-
1. Select **Apply** on the 'Specify KDC proxy servers for Kerberos clients' dialog box.
344
+
1. Select **OK** to close the 'Show Contents' dialog box.
345
+
1. Select **Apply** on the 'Specify KDC proxy servers for Kerberos clients' dialog box.
0 commit comments