We’re excited to announce the final availability (GA) of Entra-Solely identities for Azure Information SMB. With native Microsoft Entra ID authentication, organizations can now grant safe, identity-based entry to SMB file shares utilizing cloud-native-only identities.
We’re excited to announce the final availability (GA) of Entra-Solely identities for Azure Information SMB. With native Microsoft Entra ID authentication, organizations can now grant safe, identity-based entry to SMB file shares utilizing cloud-only identities.
This implies no Lively Listing, hybrid sync, or managed area controllers required, considerably simplifying structure whereas lowering ongoing administration and upkeep prices. Entra-Solely identities elevate Azure Information with a extremely built-in, trendy id expertise—delivering a number one, best-in-class commonplace for safe, seamless and complete cloud native entry.
As clients look emigrate to Azure Information, reliance on on-premises Lively Listing authentication has been seen as a key blocker to an entire cloud-native expertise. Entra-Solely identities assist for Azure Information SMB removes that blocker, enabling organizations to authenticate customers and units instantly by Microsoft Entra ID, serving to modernize storage, compute and id, whereas aligning with Zero-Belief ideas.
Entra-Solely identities allow seamless digital desktop infrastructure (VDI) profile administration on Azure Information whereas assembly trendy safety requirements. In Azure Digital Desktop (AVD), built-in B2B assist extends this additional, permitting exterior companions to make use of their present identities with FSLogix profiles, with out creating duplicate accounts.
For general-purpose eventualities, this unlocks migration of on-prem Home windows-based workloads to a totally cloud-native platform, retaining native SMB compatibility whereas delivering a extremely built-in id, safety, and administration expertise. Customers can securely entry recordsdata from anyplace with out area setup, VPNs, or complicated networking necessities. Collectively, these capabilities assist organizations scale back operational complexity whereas strengthening their safety posture.
Why select Entra-Solely identities with Azure Information
Trendy, cloud-native id with simplified operations. Entry to Azure Information is secured utilizing native Entra ID authentication with client-side Intune integration, eliminating overhead of id lifecycle upkeep and compliance, VPNs, and hybrid sync—simplifying deployment, lowering upkeep overhead, and streamlining administration.
Co-existence with hybrid identities setup. Organizations with a mixture of hybrid and cloud-native identities can use this function concurrently whereas within the journey to retire lively listing.
Safe entry from anyplace. Customers can entry file shares by way of Entra-joined purchasers, enabling seamless distant work with out duplicating identities.
Prolonged assist to MacOS purchasers (restricted preview). Safe file share entry is prolonged to trendy MacOS purchasers, Entra-joined by way of Platform SSO, enabling inventive and cross-platform workloads to combine with Azure Information utilizing Entra-based id.
What’s new with Entra-Solely identities
Portal-based NTFS permissions administration: Granular file and listing ACLs for Entra-Solely (and hybrid) customers and teams may be configured instantly from the Azure portal, eliminating the necessity for domain-joined purchasers or legacy instruments. That is now out there for all customers throughout all areas.
Expanded RBAC assist for safe authorization: Including share-level RBAC for particular customers and teams is now out there for Entra solely customers and teams in restricted areas. For regional availability, please test right here.
How Entra-Solely identities work with Azure Information
This function modernizes SMB authentication by making Microsoft Entra ID the first Kerberos Key Distribution Middle (KDC). Shoppers authenticate instantly with Microsoft Entra ID to acquire Kerberos tickets for cloud identities, eliminating the necessity for Lively Listing or Entra Join sync. Whereas the SMB protocol stays unchanged for compatibility, ticket issuance and id validation are utterly dealt with by Entra.
The way it works:
When accessing the file share, the consumer requests a Kerberos ticket from Entra ID for Azure Information.
This ticket, containing cloud-based safety identifiers (SIDs), is introduced throughout the SMB session setup.
Azure Information validates the ticket and establishes the session—enabling safe, identity-based entry. Authorization continues to make use of NTFS ACLs, now prolonged to Entra-Solely customers and teams. Permissions may be managed instantly within the Azure portal, eradicating reliance on domain-joined purchasers or legacy instruments.
Collectively, this preserves Kerberos safety and scale whereas shifting id management completely to Entra, enabling a clear transition to cloud-native file entry.
Hero workloads modernized with Entra-Solely identities
Re-imagining VDI deployments with Azure Information and Entra-Solely identities
Entra-Solely identities simplify and modernize VDI deployments with Azure Information by enabling a totally cloud-native id, compute and storage stack for person profile administration. In Azure Digital Desktop (AVD), FSLogix profile containers may be saved on Azure Information Premium and accessed utilizing Microsoft Entra-based customers by way of Kerberos, preserving safe, seamless SMB entry.
Why this issues:
It removes dependencies on hybrid id infrastructure.
It simplifies deployments.
It reduces operational overhead, particularly for distributed or distant workforces.
With Entra ID because the authentication authority, customers can check in to their digital desktops and entry profiles utilizing cloud-native identities, enabling end-to-end single sign-on with out line-of-sight to on-premises techniques.
By adopting Entra-Solely id entry with Azure Information, WTW has been in a position to ship insurance coverage purposes to clients on AVD utilizing their present Entra identities. FSLogix profile containers saved on Azure File Shares guarantee customers obtain a constant profile expertise throughout any AVD host they hook up with. This answer removes the dependency on legacy area controllers and file share infrastructure, changing it with a totally Entra-joined surroundings backed by AVD hosts and Azure File Shares—leading to a safer, streamlined, and fewer complicated structure.
—Gordon Griffin, Technical Director, Willis Tower Watson
B2B identities assist additional extends VDI eventualities by permitting exterior customers to entry desktops, loading their profiles securely utilizing present identities. Collectively, this permits organizations to ship a constant, scalable, and safe VDI expertise whereas accelerating their transition to a totally cloud-native structure.
Entra-Solely identities with Azure Information mark a significant step ahead in simplifying and securing trendy desktop and utility environments. By enabling Kerberos-based Entra person entry, we are able to ship a very cloud-native expertise for our clients, with id, compute and storage all in Azure, whereas sustaining seamless SMB compatibility. This considerably reduces deployment complexity and permits organizations to undertake safe, scalable VDI and file entry options quicker than ever earlier than.
—Chuck Mikuzis, Product Supervisor, Nerdio
Simplifying file sharing for the fashionable workforce
Entra-Solely identities streamline general-purpose file sharing and knowledge employee (IW) collaboration. Entry to shared folders is ruled instantly by Entra ID, enabling constant, identity-driven entry throughout distributed groups with out requiring domain-joined units or community connectivity to on-premises infrastructure.
This simplifies onboarding and day-to-day operations—new customers may be granted entry by Entra teams, and permissions are enforced persistently throughout places. Mixed with NTFS ACL portal assist, organizations can keep acquainted file-level safety whereas modernizing their entry mannequin.
The consequence:
Sooner onboarding.
Lowered helpdesk overhead.
Seamless collaboration throughout geographies.
Seamless cloud native entry for distant and distributed vitality workforces
Entra-Solely identities allow oil and gasoline organizations to securely entry crucial datasets from distant and subject places with out counting on complicated multi-domain/multi-forest Lively listing configuration or hybrid infrastructure. Engineers and geoscientists working throughout offshore rigs, exploration websites, and world places of work can authenticate instantly with Entra ID and entry Azure Information, eliminating VPN dependencies and enhancing reliability in low-connectivity environments.
This strategy simplifies deployment and operations whereas sustaining enterprise-grade safety and compliance. Mixed with assist for skinny purchasers and distant entry, groups can collaborate in real-time on massive datasets with out managing distributed infrastructure.
Continued investments in Azure Information id
Safe Entra-native utility entry with Managed Identities (GA)
Managed Identities assist brings Entra-native utility entry to Azure Information, eradicating the necessity for shared keys or secrets and techniques. Functions, digital machines, or Azure companies use Managed Identities with Entra-issued OAuth tokens establishing safe SMB periods, lowering credential sprawl and simplifying entry. This helps simplify DevOps workflows and allows scalable integration throughout Azure Kubernetes Service (AKS) and enterprise purposes.
Bringing safe, cloud-native entry to MacOS workloads (restricted preview)
Safe Azure Information assist over MacOS purchasers permits inventive design groups and academic establishments to work seamlessly throughout working system (OS) platforms with un-interrupted entry. Designers, media professionals, and better schooling professionals can authenticate instantly with Entra ID and entry SMB file shares, aligning Mac workflows with the identical enterprise-grade id used organization-wide.
What’s subsequent with Azure Information Entra-Solely Identities
Native NTFS ACL modifying expertise
We’re persevering with to reinforce the permissions administration expertise by bringing native assist for modifying NTFS ACLs instantly by acquainted consumer workflows. This closes a key hole between cloud and conventional file server environments, enabling directors and customers to handle fine-grained file and listing permissions utilizing the identical instruments and experiences they depend on at the moment.
Including assist in sovereign cloud environments
We’re working to broaden Entra-Solely identities for Azure Information to sovereign cloud areas, enabling organizations in extremely regulated environments to undertake cloud-native id for SMB workloads. This unlocks the identical advantages of SMB Kerberos-based authentication, and centralized id administration, whereas assembly compliance and enterprise grade regulatory necessities.
Get began with Entra-Solely identities and different Azure Information investments
Entra-Solely identities for Azure Information SMB is usually out there at the moment, supported throughout HDD and SSD shares and all billing fashions, at no further value. Discover our documentation for step-by-step steerage. Make your workload prepared for the longer term!
For questions on enabling on MacOS platforms, please register right here. For different questions, attain out to azurefiles@microsoft.com.
Discover the documentation
Allow Microsoft Entra Kerberos authentication for hybrid and cloud-only identities (preview) on Azure Information.
