Two Methods to Mount Azure Files over SMB: AD DS and Storage Account Key
A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.
Quick Answer
The correct answer is Active Directory Domain Services credentials and the storage account key. This is because Azure Files supports two distinct SMB authentication methods: identity-based authentication via AD DS, which allows domain-joined Windows and Linux VMs to mount the share using their domain credentials, and shared-key authentication using the storage account key, which grants full administrative access to the share from any SMB client. On the AZ-104 exam, this question tests your understanding of Azure Files authentication options and the distinction between identity-based access and key-based access. A common trap is assuming that only Windows VMs can use AD DS authentication, but Linux VMs joined to the same domain can also authenticate with AD DS credentials. Remember the memory tip: “Key for admin, domain for identity”—the storage account key is like a master key for full control, while AD DS credentials enforce user-level permissions.
⚠ Common exam trap
Many exam-takers confuse Azure Files authentication with Blob Storage authentication, mistakenly selecting a SAS token as a valid method for SMB mounting, when in fact SAS tokens are only used for REST-based access to Blob or File storage (via HTTPS), not for SMB protocol.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Storage account key
The storage account key provides administrative access to the Azure Files share, allowing any SMB client (Windows or Linux) to mount the share by using the key as the credential. Option B is correct because when both VMs are joined to the same Active Directory Domain Services domain, the Azure Files share can be enabled for AD DS authentication, allowing domain-joined clients to mount the share using their domain credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Storage account key
Why this is correct
The storage account key can authenticate SMB mounts from supported Windows and Linux clients.
- ✓
Active Directory Domain Services credentials
Why this is correct
Domain credentials support identity-based SMB access for Azure Files in an AD DS environment.
- ✗
Blob SAS token
Why it's wrong here
A blob SAS token is for blob data, not for mounting an Azure Files SMB share.
When this WOULD be correct
A question asking how to grant time-limited, delegated access to a specific blob in an Azure Storage container without sharing the storage account key. The correct answer would be a Blob SAS token.
- ✗
Network security group rule
Why it's wrong here
NSG rules control traffic flow, but they do not authenticate file-share access.
When this WOULD be correct
In a question about securing access to an Azure VM, an NSG rule would be the correct answer to allow or deny specific traffic (e.g., RDP or SSH) to the VM's network interface.
- ✗
Azure resource lock
Why it's wrong here
A lock protects the storage account from changes, but it does not help clients mount the share.
When this WOULD be correct
In a scenario where an administrator needs to protect an Azure Files share from accidental deletion or modification, applying an Azure resource lock (e.g., CanNotDelete or ReadOnly) would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Storage account keyCorrect answer▾
Why this is correct
The storage account key can authenticate SMB mounts from supported Windows and Linux clients.
✗Blob SAS tokenWrong answer — click to see why▾
Why this is wrong here
A Blob SAS token provides delegated access to Azure Blob Storage, not to Azure Files SMB shares. Azure Files supports SMB authentication via storage account key or AD DS credentials, not SAS tokens.
★ When this WOULD be the correct answer
A question asking how to grant time-limited, delegated access to a specific blob in an Azure Storage container without sharing the storage account key. The correct answer would be a Blob SAS token.
Why candidates choose this
Candidates may confuse Azure Files with Azure Blob Storage, or assume that SAS tokens are a universal authentication method for all Azure Storage services, including SMB-based file shares.
✗Network security group ruleWrong answer — click to see why▾
Why this is wrong here
Network security group (NSG) rules control inbound/outbound traffic to Azure resources but are not authentication methods for mounting an Azure Files share over SMB.
★ When this WOULD be the correct answer
In a question about securing access to an Azure VM, an NSG rule would be the correct answer to allow or deny specific traffic (e.g., RDP or SSH) to the VM's network interface.
Why candidates choose this
Candidates may confuse network-level access control (NSG) with authentication, thinking that allowing traffic through an NSG is sufficient to mount a file share.
✗Azure resource lockWrong answer — click to see why▾
Why this is wrong here
Azure resource locks prevent accidental deletion or modification of resources but do not provide any authentication mechanism for mounting an Azure Files share over SMB.
★ When this WOULD be the correct answer
In a scenario where an administrator needs to protect an Azure Files share from accidental deletion or modification, applying an Azure resource lock (e.g., CanNotDelete or ReadOnly) would be the correct answer.
Why candidates choose this
Candidates may confuse resource locks with access control mechanisms, thinking they can restrict access to the share, but locks only affect management operations, not data access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Azure Files
Azure Files is a cloud-based file sharing service that lets you create and access file shares using the Server Message Block (SMB) protocol or Network File System (NFS) protocol, just like you would access files on a local network drive.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Windows VM and a Linux VM in the same on-premises Active Directory Domain Services domain must mount the same Azure Files share over SMB. Security policy forbids storage account keys and long-lived SAS tokens. What should the administrator configure?
hard- ✓ A.Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.
- B.Use a private endpoint and rely on network isolation instead of authentication.
- C.Use the storage account access key because SMB requires shared-key authentication.
- D.Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.
Why A: Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). By enabling AD DS authentication for the storage account and granting share-level permissions to an AD group that includes both the Windows and Linux VMs, the administrator can mount the Azure Files share without using storage account keys or SAS tokens. This satisfies the security policy while allowing SMB access from both operating systems.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.