AZ-104 Question 70
Single answerContoso Ltd. has an on-premises Active Directory domain and uses Azure File shares for file storage. They want to allow users on domain-joined machines to seamlessly access Azure Files using their on-prem AD credentials. After configuring the storage account for AD DS authentication, users continue to get prompted for their credentials. Which additional configuration step must be performed to allow seamless access without repeated authentication prompts?
- A
Enable Azure Active Directory Domain Services (AAD DS) within the Organizational Unit (OU) for the domain
- B
Create a matching computer account in the on-premises Active Directory corresponding to the storage account and configure Kerberos constrained delegation
- C
Switch from SMB 3.0 to SMB 2.1 for file shares to simplify authentication
- D
Configure a managed identity on the storage account and grant Azure RBAC roles for file share access
Show answer and explanation
Correct answer: B
Explanation
To configure seamless, identity-based access for Azure Files using on-prem AD credentials, you must create and configure a computer account in Active Directory that matches the Azure Storage account name. This ensures the appropriate Kerberos handshake, preventing users from being repeatedly prompted for credentials.
- A. Incorrect.
Enabling Azure Active Directory Domain Services can help if you don’t have a domain environment, but here you already have on-prem AD. This won't directly address the repeated authentication prompts when using on-prem credentials for Azure Files.
- B. Correct.
When using on-prem AD for identity-based access, you must create a corresponding computer account in AD for the storage account. This allows proper Kerberos authentication and ensures users are not constantly prompted for credentials.
- C. Incorrect.
SMB 3.0 is a more secure and modern protocol. Downgrading to SMB 2.1 does not solve repeated prompts related to missing AD domain computer accounts and proper authentication configuration.
- D. Incorrect.
A managed identity and Azure RBAC can govern access within Azure, but they don’t address the Kerberos authentication needed for on-prem domain-joined users accessing Azure Files.