We’re excited to announce the overall availability (GA) of Entra-Solely identities for Azure Information SMB. With native Microsoft Entra ID authentication, organizations can now grant safe, identity-based entry to SMB file shares utilizing cloud-native-only identities.
We’re excited to announce the overall availability (GA) of Entra-Solely identities for Azure Information SMB. With native Microsoft Entra ID authentication, organizations can now grant safe, identity-based entry to SMB file shares utilizing cloud-only identities.
This implies no Energetic Listing, hybrid sync, or managed area controllers required, considerably simplifying structure whereas decreasing ongoing administration and upkeep prices. Entra-Solely identities elevate Azure Information with a extremely built-in, fashionable id expertise—delivering a number one, best-in-class normal for safe, seamless and complete cloud native entry.
As clients look emigrate to Azure Information, reliance on on-premises Energetic Listing authentication has been seen as a key blocker to a whole cloud-native expertise. Entra-Solely identities assist for Azure Information SMB removes that blocker, enabling organizations to authenticate customers and units instantly via Microsoft Entra ID, serving to modernize storage, compute and id, whereas aligning with Zero-Belief ideas.
Entra-Solely identities allow seamless digital desktop infrastructure (VDI) profile administration on Azure Information whereas assembly fashionable safety requirements. In Azure Digital Desktop (AVD), built-in B2B assist extends this additional, permitting exterior companions to make use of their current identities with FSLogix profiles, with out creating duplicate accounts.
For general-purpose eventualities, this unlocks migration of on-prem Home windows-based workloads to a totally cloud-native platform, retaining native SMB compatibility whereas delivering a extremely built-in id, safety, and administration expertise. Customers can securely entry information from wherever with out area setup, VPNs, or complicated networking necessities. Collectively, these capabilities assist organizations scale back operational complexity whereas strengthening their safety posture.
Why select Entra-Solely identities with Azure Information
Trendy, cloud-native id with simplified operations. Entry to Azure Information is secured utilizing native Entra ID authentication with client-side Intune integration, eliminating overhead of id lifecycle upkeep and compliance, VPNs, and hybrid sync—simplifying deployment, decreasing upkeep overhead, and streamlining administration.
Co-existence with hybrid identities setup. Organizations with a mixture of hybrid and cloud-native identities can use this function concurrently whereas within the journey to retire lively listing.
Safe entry from wherever. Customers can entry file shares through Entra-joined shoppers, enabling seamless distant work with out duplicating identities.
Prolonged assist to MacOS shoppers (restricted preview). Safe file share entry is prolonged to fashionable MacOS shoppers, Entra-joined through Platform SSO, enabling inventive and cross-platform workloads to combine with Azure Information utilizing Entra-based id.
What’s new with Entra-Solely identities
Portal-based NTFS permissions administration: Granular file and listing ACLs for Entra-Solely (and hybrid) customers and teams could be configured instantly from the Azure portal, eliminating the necessity for domain-joined shoppers or legacy instruments. That is now obtainable for all customers throughout all areas.
Expanded RBAC assist for safe authorization: Including share-level RBAC for particular customers and teams is now obtainable for Entra solely customers and teams in restricted areas. For regional availability, please verify right here.
How Entra-Solely identities work with Azure Information
This function modernizes SMB authentication by making Microsoft Entra ID the first Kerberos Key Distribution Middle (KDC). Purchasers authenticate instantly with Microsoft Entra ID to acquire Kerberos tickets for cloud identities, eliminating the necessity for Energetic Listing or Entra Join sync. Whereas the SMB protocol stays unchanged for compatibility, ticket issuance and id validation are utterly dealt with by Entra.
The way it works:
When accessing the file share, the shopper requests a Kerberos ticket from Entra ID for Azure Information.
This ticket, containing cloud-based safety identifiers (SIDs), is introduced through the SMB session setup.
Azure Information validates the ticket and establishes the session—enabling safe, identity-based entry. Authorization continues to make use of NTFS ACLs, now prolonged to Entra-Solely customers and teams. Permissions could be managed instantly within the Azure portal, eradicating reliance on domain-joined shoppers or legacy instruments.
Collectively, this preserves Kerberos safety and scale whereas shifting id management fully to Entra, enabling a clear transition to cloud-native file entry.
Hero workloads modernized with Entra-Solely identities
Re-imagining VDI deployments with Azure Information and Entra-Solely identities
Entra-Solely identities simplify and modernize VDI deployments with Azure Information by enabling a totally cloud-native id, compute and storage stack for consumer profile administration. In Azure Digital Desktop (AVD), FSLogix profile containers could be saved on Azure Information Premium and accessed utilizing Microsoft Entra-based customers through Kerberos, preserving safe, seamless SMB entry.
Why this issues:
It removes dependencies on hybrid id infrastructure.
It simplifies deployments.
It reduces operational overhead, particularly for distributed or distant workforces.
With Entra ID because the authentication authority, customers can sign up to their digital desktops and entry profiles utilizing cloud-native identities, enabling end-to-end single sign-on with out line-of-sight to on-premises methods.
By adopting Entra-Solely id entry with Azure Information, WTW has been capable of ship insurance coverage purposes to clients on AVD utilizing their current Entra identities. FSLogix profile containers saved on Azure File Shares guarantee customers obtain a constant profile expertise throughout any AVD host they hook up with. This answer removes the dependency on legacy area controllers and file share infrastructure, changing it with a totally Entra-joined surroundings backed by AVD hosts and Azure File Shares—leading to a safer, streamlined, and fewer complicated structure.
—Gordon Griffin, Technical Director, Willis Tower Watson
B2B identities assist additional extends VDI eventualities by permitting exterior customers to entry desktops, loading their profiles securely utilizing current identities. Collectively, this allows organizations to ship a constant, scalable, and safe VDI expertise whereas accelerating their transition to a totally cloud-native structure.
Entra-Solely identities with Azure Information mark a significant step ahead in simplifying and securing fashionable desktop and utility environments. By enabling Kerberos-based Entra consumer entry, we will ship a very cloud-native expertise for our clients, with id, compute and storage all in Azure, whereas sustaining seamless SMB compatibility. This considerably reduces deployment complexity and permits organizations to undertake safe, scalable VDI and file entry options quicker than ever earlier than.
—Chuck Mikuzis, Product Supervisor, Nerdio
Simplifying file sharing for the fashionable workforce
Entra-Solely identities streamline general-purpose file sharing and data employee (IW) collaboration. Entry to shared folders is ruled instantly via Entra ID, enabling constant, identity-driven entry throughout distributed groups with out requiring domain-joined units or community connectivity to on-premises infrastructure.
This simplifies onboarding and day-to-day operations—new customers could be granted entry via Entra teams, and permissions are enforced constantly throughout areas. Mixed with NTFS ACL portal assist, organizations can preserve acquainted file-level safety whereas modernizing their entry mannequin.
The outcome:
Sooner onboarding.
Decreased helpdesk overhead.
Seamless collaboration throughout geographies.
Seamless cloud native entry for distant and distributed power workforces
Entra-Solely identities allow oil and fuel organizations to securely entry essential datasets from distant and subject areas with out counting on complicated multi-domain/multi-forest Energetic listing configuration or hybrid infrastructure. Engineers and geoscientists working throughout offshore rigs, exploration websites, and international places of work can authenticate instantly with Entra ID and entry Azure Information, eliminating VPN dependencies and enhancing reliability in low-connectivity environments.
This strategy simplifies deployment and operations whereas sustaining enterprise-grade safety and compliance. Mixed with assist for skinny shoppers and distant entry, groups can collaborate in real-time on giant datasets with out managing distributed infrastructure.
Continued investments in Azure Information id
Safe Entra-native utility entry with Managed Identities (GA)
Managed Identities assist brings Entra-native utility entry to Azure Information, eradicating the necessity for shared keys or secrets and techniques. Purposes, digital machines, or Azure providers use Managed Identities with Entra-issued OAuth tokens establishing safe SMB periods, decreasing credential sprawl and simplifying entry. This helps simplify DevOps workflows and allows scalable integration throughout Azure Kubernetes Service (AKS) and enterprise purposes.
Bringing safe, cloud-native entry to MacOS workloads (restricted preview)
Safe Azure Information assist over MacOS shoppers permits inventive design groups and academic establishments to work seamlessly throughout working system (OS) platforms with un-interrupted entry. Designers, media professionals, and better training professionals can authenticate instantly with Entra ID and entry SMB file shares, aligning Mac workflows with the identical enterprise-grade id used organization-wide.
What’s subsequent with Azure Information Entra-Solely Identities
Native NTFS ACL enhancing expertise
We’re persevering with to boost the permissions administration expertise by bringing native assist for enhancing NTFS ACLs instantly via acquainted shopper workflows. This closes a key hole between cloud and conventional file server environments, enabling directors and customers to handle fine-grained file and listing permissions utilizing the identical instruments and experiences they depend on at the moment.
Including assist in sovereign cloud environments
We’re working to increase Entra-Solely identities for Azure Information to sovereign cloud areas, enabling organizations in extremely regulated environments to undertake cloud-native id for SMB workloads. This unlocks the identical advantages of SMB Kerberos-based authentication, and centralized id administration, whereas assembly compliance and enterprise grade regulatory necessities.
Get began with Entra-Solely identities and different Azure Information investments
Entra-Solely identities for Azure Information SMB is usually obtainable at the moment, supported throughout HDD and SSD shares and all billing fashions, at no further price. Discover our documentation for step-by-step steerage. Make your workload prepared for the longer term!
For questions on enabling on MacOS platforms, please register right here. For different questions, attain out to azurefiles@microsoft.com.
Discover the documentation
Allow Microsoft Entra Kerberos authentication for hybrid and cloud-only identities (preview) on Azure Information.
