Get Your CertAZ-104PlayCompete
‹ All AZ-104 questions

AZ-104 Practice Question 14: Azure Files Identity Source

Microsoft Azure Administrator Associate (AZ-104) · Test 2 · question 4 of 10

Storagemedium

Contoso is a cloud-only organisation: every user account exists only in Microsoft Entra ID, there is no Active Directory Domain Services deployment anywhere, and the laptops are Microsoft Entra joined and used from home as often as from the office.

You must publish an SMB file share in Azure Files so that users sign in with their normal Entra credentials and per-user NTFS permissions apply, with no storage account key handed out and no new domain infrastructure to run.

Which identity source should you enable on the storage account?

Select one answer
Show answer and explanation

Answer:

  • D. Microsoft Entra Kerberos

Azure Files supports identity-based authentication over SMB from one of three identity sources, and Microsoft's own selection guidance points straight at this scenario: "If you want to authenticate cloud-only identities without using domain controllers, choose Microsoft Entra Kerberos," and "if some or all of the clients don't have unimpeded network connectivity to your AD DS ... choose Microsoft Entra Kerberos." Entra ID issues the Kerberos ticket, so Entra-joined laptops can mount the share from anywhere, and directory and file permissions are still enforced as normal Windows ACLs.

Option A inverts the requirement. AD DS authentication needs a real domain the storage account can join, synced to Entra ID with Entra Connect, and clients with unimpeded network connectivity to a domain controller, precisely the infrastructure Contoso does not have and does not want.

Option B works technically but violates two constraints: it means deploying and paying for a managed domain, and Kerberos authentication requires the client to be joined to the Domain Services managed domain, which non-Azure clients cannot do.

Option C is what identity-based access exists to replace. The account key is a shared secret that grants full access to everything in the account, and share-level RBAC alone cannot express per-user file and directory permissions.

Reference: Overview of Azure Files identity-based authentication

Practice Test 2 ›

Study guides for AZ-104

Azure Administrator (AZ-104): jobs, salary and the examAzure administrator role, jobs and pay data, and the AZ-104 exam: five domains, 100 minutes, US$165 / ₹4,865, AZ-900 first or not, and what next.
AZ-400 exam guide: DevOps Engineer Expert in 2026AZ-400 exam guide: the DevOps Engineer Expert prerequisites now that AZ-204 is retired, the five skill areas, price, renewal and a study plan.
Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.
Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.
Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.