AZ-104 Question 71
Single answerYou are the Azure Administrator for Contoso. The company has an on-premises Active Directory domain synced with Azure AD. They have created an Azure file share in a storage account, configured Azure AD Domain Services in the same virtual network, and want on-premises domain users to authenticate using their AD credentials. However, users still cannot mount the file share. Which step must be taken to finalize identity-based access for Azure Files?
- A
Deploy DFS Namespaces (DFS-N) in Azure AD Domain Services to host the file share
- B
Set the Active Directory domain name on the storage account and create a corresponding computer account in the on-premises AD domain
- C
Assign the Directory Readers role to a sync service account in Azure AD
- D
Disable SMB encryption on the file share to allow credentials from on-premises Active Directory
Show answer and explanation
Correct answer: B
Explanation
To enable on-premises AD-based authentication to Azure Files, the storage account must be 'joined' to the domain, which involves specifying the correct Active Directory domain name and ensuring a computer account is provisioned in the on-premises AD. This step allows the Azure file share to use Kerberos authentication through the on-premises domain.
- A. Incorrect.
Deploying DFS Namespaces is optional and not mandatory to finalize identity-based access for Azure Files. DFS-N does not solve authentication issues by itself.
- B. Correct.
Creating a computer account for the storage account in the on-prem AD and setting the domain name under the storage account’s configuration is required to enable identity-based authentication using on-premises AD credentials.
- C. Incorrect.
Assigning the Directory Readers role to a sync service account is used for certain synchronization tasks, but it does not configure or fix authentication for Azure Files.
- D. Incorrect.
Disabling SMB encryption is not required and would negatively affect security. SMB encryption does not prevent or enable AD authentication.