AZ-104 Question 72
Select 2You administer an Azure Storage account that must allow on-premises domain users to authenticate with their existing Active Directory credentials to access an Azure file share. You have already configured Azure AD Connect to sync on-premises accounts to Azure AD. Which two steps must you perform in Azure to enforce identity-based access for this file share?
- A
Enable Active Directory Domain Services (AD DS) authentication for the storage account and specify the domain details.
- B
Use the storage account access key to mount the Azure file share from on-premises clients.
- C
Assign built-in Azure RBAC roles such as 'Storage File Data SMB Share Contributor' to the users or groups that need access.
- D
Enable Azure Active Directory B2C for the storage account to handle on-premises domain authentication.
Show answer and explanation
Correct answers: A, C
Explanation
To configure identity-based access for Azure Files in a hybrid environment, you must associate the storage account with your domain via AD DS authentication and assign the appropriate RBAC roles to the users or groups. This setup allows your on-premises domain credentials to be recognized and enforced, ensuring proper authorization for file share access.
- A. Correct.
This step is required to enable Windows-integrated authentication for the Azure file share. You must register the storage account with the on-premises domain to use identity-based access.
- B. Incorrect.
Using the storage account key bypasses identity-based control and does not enforce per-user permissions. It is not the correct way to enforce identity-based access for on-premises AD users.
- C. Correct.
Assigning the appropriate RBAC roles is needed so that Azure understands who can access file data. Roles such as 'Storage File Data SMB Share Contributor' grant necessary permissions at the data layer.
- D. Incorrect.
Azure AD B2C is used for consumer identity and access scenarios, not for on-premises domain users. It does not enable authentication against your corporate Active Directory.