Configuring access and authentication

Storage accounts can provide identity-based authentication through either Active Directory (on-premises) or Azure Active Directory Domain Services (AADDS). Both offer the ability to utilize Kerberos authentication offered by Active Directory. The join is limited to a single forest, whereas multiple forest connections will require the configuration of domain trusts.

For the file share to provide authentication capabilities, it will join the respective directory service as a computer account object. There are three primary permissions (authorization) on the SMB share that you should be cognizant of:

• Storage File Data SMB Share Reader: This permission grants read access to the SMB share files and directories.
• Storage File Data SMB Share Contributor: This grants read, write, list, and delete access to the SMB share files and directories.
• Storage File Data SMB Elevated Contributor: This grants contributor access as well as the ability...