Document Details

Storage Files Identity Auth Hybrid Identities Enable
Home / Scan #41 / Storage Files Identity Auth Hybrid Identities Enable
Sad Tux - Windows bias detected
This page contains Windows bias

About This Page

This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
GitHub View on GitHub 📚 View on Microsoft Learn

Bias Analysis

Detected Bias Types
windows_first
missing_linux_example
windows_tools
powershell_heavy
Summary
The documentation is heavily oriented toward Windows environments. All operating system prerequisites, configuration steps, and client instructions are specific to Windows (Windows 10/11, Windows Server). Only Windows tools and patterns are described (PowerShell, Group Policy, Intune, Registry, ksetup, Windows File Explorer, icacls), and there are no examples or guidance for Linux or macOS clients. The documentation does not mention or address how to use Microsoft Entra Kerberos authentication for Azure Files from non-Windows platforms, nor does it clarify if such scenarios are unsupported.
Recommendations
  • Explicitly state whether Linux and macOS clients are supported or unsupported for Microsoft Entra Kerberos authentication with Azure Files.
  • If Linux/macOS support exists or is planned, provide equivalent configuration and usage instructions for those platforms (e.g., using smbclient, mount.cifs, krb5.conf configuration, kinit, etc.).
  • If only Windows is supported, add a clear note at the top of the documentation to inform users of this limitation.
  • Where possible, provide cross-platform examples for Azure CLI and other tools, or clarify any OS-specific differences.
  • Consider including a section on interoperability, outlining what is and isn't possible from non-Windows clients.
GitHub Create Pull Request

Scan History

Date Scan Status Result
2026-01-14 00:00 #250 in_progress Biased Biased
2026-01-13 00:00 #246 completed Biased Biased
2026-01-11 00:00 #240 completed Biased Biased
2026-01-10 00:00 #237 completed Biased Biased
2026-01-09 00:34 #234 completed Biased Biased
2026-01-08 00:53 #231 completed Biased Biased
2025-09-06 00:00 #103 completed Clean Clean
2025-08-19 00:01 #85 completed Clean Clean
2025-07-13 21:37 #48 completed Clean Clean
2025-07-12 23:44 #41 cancelled Biased Biased

Flagged Code Snippets

reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1

Set-AzStorageAccount -ResourceGroupName <resourceGroupName> -StorageAccountName <storageAccountName> -EnableAzureActiveDirectoryKerberosForFile $true

$domainInformation = Get-ADDomain
$domainGuid = $domainInformation.ObjectGUID.ToString()
$domainName = $domainInformation.DnsRoot

Set-AzStorageAccount -ResourceGroupName <resourceGroupName> -StorageAccountName <storageAccountName> -EnableAzureActiveDirectoryKerberosForFile $true -ActiveDirectoryDomainName $domainName -ActiveDirectoryDomainGuid $domainGuid

az storage account update --name <storageaccountname> --resource-group <resourcegroupname> --enable-files-aadkerb true

$domainInformation = Get-ADDomain
$domainGuid = $domainInformation.ObjectGUID.ToString()
$domainName = $domainInformation.DnsRoot

az storage account update --name <storageAccountName> --resource-group <resourceGroupName> --enable-files-aadkerb true --domain-name <domainName> --domain-guid <domainGuid>

ksetup /addhosttorealmmap <hostname> <REALMNAME>

reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 0

ksetup /delhosttorealmmap <hostname> <realmname>

Set-AzStorageAccount -ResourceGroupName <resourceGroupName> -StorageAccountName <storageAccountName> -EnableAzureActiveDirectoryKerberosForFile $false