Skip to content

Commit ca171bb

Browse files
committed
Entra Kerberos cleanup for brevity
1 parent bbd030a commit ca171bb

1 file changed

Lines changed: 9 additions & 9 deletions

File tree

articles/storage/files/storage-files-identity-auth-hybrid-identities-enable.md

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.author: kendownie
1313

1414
**Applies to:** :heavy_check_mark: SMB Azure file shares
1515

16-
This article focuses on enabling and configuring Microsoft Entra ID (formerly Azure AD) for authenticating [hybrid](/entra/identity/hybrid/whatis-hybrid-identity) or cloud-only identities (preview).
16+
This article explains how to enable and configure Microsoft Entra ID (formerly Azure AD) for authenticating [hybrid](/entra/identity/hybrid/whatis-hybrid-identity) or cloud-only identities (preview).
1717

1818
- Hybrid identities are on-premises Active Directory Domain Services (AD DS) identities that are synced to Microsoft Entra ID by using either [Microsoft Entra Connect Sync](/entra/identity/hybrid/connect/how-to-connect-sync-whatis) or [Microsoft Entra Cloud Sync](/entra/identity/hybrid/cloud-sync/what-is-cloud-sync).
1919

@@ -32,7 +32,7 @@ Before you enable Microsoft Entra Kerberos authentication over SMB for Azure fil
3232

3333
### Minimum prerequisites
3434

35-
You need the following prerequisites. Without these prerequisites, you can't authenticate by using Microsoft Entra ID.
35+
You need the following minimum prerequisites. Without these prerequisites, you can't authenticate by using Microsoft Entra ID.
3636

3737
- Your Azure storage account can't authenticate with both Entra ID and a second method like AD DS or Microsoft Entra Domain Services. If you already chose another identity source for your storage account, you must disable it before enabling Microsoft Entra Kerberos.
3838

@@ -106,7 +106,7 @@ To enable Microsoft Entra Kerberos authentication by using the [Azure portal](ht
106106

107107
# [Azure PowerShell](#tab/azure-powershell)
108108

109-
To enable Microsoft Entra Kerberos by using Azure PowerShell, run the following command. Remember to replace placeholder values, including brackets, with your values.
109+
To enable Microsoft Entra Kerberos by using Azure PowerShell, run the following command. Replace placeholder values, including brackets, with your values.
110110

111111
```azurepowershell
112112
Set-AzStorageAccount -ResourceGroupName <resourceGroupName> -StorageAccountName <storageAccountName> -EnableAzureActiveDirectoryKerberosForFile $true
@@ -122,15 +122,15 @@ $domainGuid = $domainInformation.ObjectGUID.ToString()
122122
$domainName = $domainInformation.DnsRoot
123123
```
124124

125-
To specify the domain name and domain GUID for your on-premises AD, run the following Azure PowerShell command. Remember to replace placeholder values, including brackets, with your values.
125+
To specify the domain name and domain GUID for your on-premises AD, run the following Azure PowerShell command. Replace placeholder values, including brackets, with your values.
126126

127127
```azurepowershell
128128
Set-AzStorageAccount -ResourceGroupName <resourceGroupName> -StorageAccountName <storageAccountName> -EnableAzureActiveDirectoryKerberosForFile $true -ActiveDirectoryDomainName $domainName -ActiveDirectoryDomainGuid $domainGuid
129129
```
130130

131131
# [Azure CLI](#tab/azure-cli)
132132

133-
To enable Microsoft Entra Kerberos by using Azure CLI, run the following command. Remember to replace placeholder values, including brackets, with your values.
133+
To enable Microsoft Entra Kerberos by using Azure CLI, run the following command. Replace placeholder values, including brackets, with your values.
134134

135135
```azurecli
136136
az storage account update --name <storageaccountname> --resource-group <resourcegroupname> --enable-files-aadkerb true
@@ -146,7 +146,7 @@ $domainGuid = $domainInformation.ObjectGUID.ToString()
146146
$domainName = $domainInformation.DnsRoot
147147
```
148148

149-
To specify the domain name and domain GUID for your on-premises Active Directory, run the following command. Remember to replace placeholder values, including brackets, with your values.
149+
To specify the domain name and domain GUID for your on-premises Active Directory, run the following command. Replace placeholder values, including brackets, with your values.
150150

151151
```azurecli
152152
az storage account update --name <storageAccountName> --resource-group <resourceGroupName> --enable-files-aadkerb true --domain-name <domainName> --domain-guid <domainGuid>
@@ -155,7 +155,7 @@ az storage account update --name <storageAccountName> --resource-group <resource
155155
---
156156

157157
> [!WARNING]
158-
> If you previously enabled Microsoft Entra Kerberos authentication through manual limited preview steps to store FSLogix profiles on Azure Files for Entra-joined VMs, the password for the storage account's service principal expires every six months. Once the password expires, users can't get Kerberos tickets to the file share. To mitigate this, see "Error - Service principal password has expired in Microsoft Entra ID" under [Potential errors when enabling Microsoft Entra Kerberos authentication](/troubleshoot/azure/azure-storage/files-troubleshoot-smb-authentication?toc=/azure/storage/files/toc.json#potential-errors-when-enabling-azure-ad-kerberos-authentication-for-hybrid-users).
158+
> If you previously enabled Microsoft Entra Kerberos authentication through manual limited preview steps to store FSLogix profiles on Azure Files for Entra-joined VMs, the password for the storage account's service principal expires every six months. Once the password expires, users can't get Kerberos tickets to the file share. To mitigate this, see [Error - Service principal password has expired in Microsoft Entra ID](/troubleshoot/azure/azure-storage/files-troubleshoot-smb-authentication?toc=/azure/storage/files/toc.json#error---service-principal-password-has-expired-in-microsoft-entra-id).
159159
160160
## Grant admin consent to the new service principal
161161

@@ -376,6 +376,6 @@ If needed, run the `Debug-AzStorageAccountAuth` cmdlet to conduct a set of basic
376376

377377
## Next steps
378378

379-
- [Mount an Azure file share](storage-files-identity-mount-file-share.md)
380-
- [Potential errors when enabling Microsoft Entra Kerberos authentication](files-troubleshoot-smb-authentication.md#potential-errors-when-enabling-azure-ad-kerberos-authentication-for-hybrid-users)
379+
- [Mount an SMB Azure file share](storage-how-to-use-files-windows.md)
380+
- [Potential errors when enabling Microsoft Entra Kerberos authentication](/troubleshoot/azure/azure-storage/files/security/files-troubleshoot-smb-authentication?tabs=azure-portal#potential-errors-when-enabling-microsoft-entra-kerberos-authentication)
381381
- [Store FSLogix profile containers on Azure Files using Microsoft Entra ID](/fslogix/how-to-configure-profile-container-entra-id-hybrid)

0 commit comments

Comments
 (0)