Azure Files On-Premises AD Authentication — Enforce Active Directory Credentials
Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?
Quick Answer
The correct answer is to enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share. This works because Azure Files authentication with on-premises Active Directory relies on a hybrid identity bridge: Azure AD Connect synchronizes your on-premises AD users to Azure AD, allowing the storage account to validate Kerberos tickets from domain-joined clients. Once authentication is enabled, you enforce granular access by setting NTFS ACLs directly on the file share, just as you would on a Windows file server. On the AZ-500 exam, this scenario tests your understanding of identity-based access control for Azure Files, and the common trap is confusing Azure AD DS (a managed domain service) with on-premises AD DS—they are not interchangeable. Remember the three-step sequence: sync, enable, and permission. A useful memory tip is “Sync the source, enable the store, lock the door with NTFS.”
⚠ Common exam trap
Test-takers frequently confuse Azure AD DS (a managed domain) with on-premises AD DS, or they assume RBAC roles alone are sufficient for SMB file access, forgetting that NTFS permissions are required for actual file-level control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.
Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Azure AD using Azure AD Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Azure AD Domain Services authentication and join the storage account to the managed domain.
Why it's wrong here
Azure AD DS is not on-prem AD.
- ✗
Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.
Why it's wrong here
RBAC roles are for share-level permissions, not NTFS.
- ✓
Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.
Why this is correct
This allows on-prem AD authentication.
- ✗
Use storage account keys to mount the share and rely on Windows ACLs.
Why it's wrong here
Storage account keys bypass identity-based control.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Azure Files shares. You need to ensure that users authenticate using on-premises Active Directory credentials and that access is logged. What should you do?
medium- A.Configure a firewall rule to allow on-premises IPs and enable diagnostic logs
- B.Use shared access signatures (SAS) for access and enable diagnostic logs
- ✓ C.Enable identity-based authentication for Azure Files and configure diagnostic logs
- D.Configure Azure RBAC for the share and enable diagnostic logs
Why C: Azure Files supports identity-based authentication using on-premises Active Directory Domain Services (AD DS) via Kerberos. This allows users to authenticate with their on-premises AD credentials and access the file share seamlessly. Enabling diagnostic logs captures access events, meeting the logging requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.