AZ-500 Question 154
Single answerYou manage an organization that uses an on-premises Active Directory (AD) domain to authenticate Windows servers. You have set up a file share in Azure Files to store departmental data, and you want users to access it using their existing on-premises domain credentials. Which configuration method should you choose to ensure domain-based authentication for your Azure file share with minimal additional overhead?
- A
Use on-premises AD DS authentication over SMB for Azure Files
- B
Deploy Azure AD Domain Services and configure Azure Files for Azure AD DS authentication
- C
Provide a shared access signature (SAS) URI to each user for granular access
- D
Configure shared access keys on each Windows server as credentials
Show answer and explanation
Correct answer: A
Explanation
To ensure that Windows servers in an on-premises AD domain can authenticate to Azure Files with existing domain credentials, the recommended approach is to enable on-premises AD DS authentication for Azure Files over SMB. This approach leverages your existing identity infrastructure, allows for centralized access control, and ensures that all access is logged against specific user accounts. For more details, refer to Microsoft documentation on 'AD DS authentication for Azure file shares' at https://learn.microsoft.com/azure/storage/files/storage-files-active-directory-overview.
- A. Correct.
Correct: Using on-premises AD DS authentication over SMB allows existing domain credentials to be used for Azure Files access. This integrates directly with your on-premises domain controller for user and group validation, ensuring centralized identity management and minimal additional overhead.
- B. Incorrect.
Incorrect: Azure AD Domain Services (Azure AD DS) is useful if your environment is fully in Azure or you do not maintain a traditional on-premises domain. However, if you already have on-premises AD DS, integrating directly with it is more efficient and straightforward for domain-based authentication.
- C. Incorrect.
Incorrect: While SAS URIs offer granular access, they do not integrate with domain credentials. Each user would be granted access via a shared token, which does not provide seamless authentication against on-premises AD or security auditing with the user’s AD identity.
- D. Incorrect.
Incorrect: A shared access key provides a single set of credentials for all users accessing the file share. This does not enforce user-level domain authentication and is less secure and auditable compared to AD-based SMB authentication.