AZ-500 Question 156
Single answerYou have a company with on-premises Active Directory (AD) synchronized to Azure AD. They want to host confidential user data in Azure file shares and require centralized, domain-based access control. Users must be able to mount the Azure file share using their existing on-premises domain credentials and have their access governed by AD security groups. Which method should you configure for secure file share access?
- A
Use a shared access signature (SAS) token for each user to mount the Azure file share
- B
Enable identity-based authentication (Kerberos) for SMB by integrating Azure Files with the on-premises AD environment
- C
Grant access via the storage account key and manually store credentials on each domain-joined client
- D
Enable Azure AD SAML-based authentication to directly grant permissions per user
Show answer and explanation
Correct answer: B
Explanation
When you need domain-based user authentication and group-based authorizations for Azure file shares, enabling Active Directory (or Azure AD DS) authentication for SMB is the recommended approach. It leverages Kerberos-based authentication, aligning with on-premises AD security group policies and user credentials. Refer to Microsoft documentation on Azure Files and Active Directory integration (https://learn.microsoft.com/azure/storage/files/storage-files-active-directory-overview) for more details.
- A. Incorrect.
Option 1: A SAS token is typically used for client applications or scripts to directly access storage resources without user context. It doesn’t integrate with on-premises AD security groups and can be difficult to manage at a per-user level in a domain environment. Hence, it’s not the best approach for centralized domain-based control.
- B. Correct.
Option 2 (Correct): Enabling identity-based authentication for SMB with Azure Files allows users to use their on-premises AD credentials to mount the file share. By integrating Azure Storage with the domain (e.g., using Active Directory or Azure AD DS), you can enforce AD security group permissions just like on-premises file servers.
- C. Incorrect.
Option 3: Using the storage account key is a less secure, account-wide secret that grants broad permissions. You cannot leverage AD security groups for granular access control when using account keys. This method doesn’t meet the need for domain-based, per-user access requirements.
- D. Incorrect.
Option 4: Azure AD SAML-based sign-in does not currently provide the seamless SMB mount experience using on-premises domain credentials for Azure file shares. SMB relies on Kerberos or NTLM, typically provided by AD or Azure AD DS, not SAML tokens.