Azure Files identity source where Entra ID hands out the Kerberos tickets for SMB access. It supports hybrid identities and, more recently, cloud-only ones; each storage account can have just one identity source.
Also called Azure AD Kerberos, Azure AD Kerberos.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Entra Kerberos in context, with comparison tables and the common traps.
Terms in this definition
- Azure Files
Azure's managed file shares over SMB or NFS. There is no Archive tier, and a single encryption key applies across the whole storage account.
- IDENTITY
A column property, written IDENTITY(seed, increment), that gives each new row the next number in a rising sequence. SCOPE_IDENTITY reports the latest value created in the current scope, and a rolled-back transaction still uses up the numbers it took.
- WHERE
Limits a SELECT, UPDATE or DELETE to just the rows meeting a condition. Omit it, and the statement hits every row.
- Microsoft Entra ID
Cloud identity service from Microsoft, previously named Azure AD, which provides the tenant behind Microsoft 365 and Azure.
- Kerberos
Authentication protocol based on tickets, native to Windows and Active Directory. Azure Files, Entra Domain Services and application proxy KCD all support it.
- SMB
Protocol for Windows file shares, used by Azure Files and supporting authentication based on identity.
- Storage account
The top-level resource in Azure Storage, giving a unique namespace for table, queue, file and blob data. Location, performance and kind are set when it is created and cannot change.
Related terms
- Cloud Kerberos trust
Microsoft's preferred model for hybrid Windows Hello for Business. Microsoft Entra Kerberos hands out a partial ticket-granting ticket, a domain controller swaps it for a complete one, and there is no need for PKI or synchronising keys.
- TGT
Kerberos clients present one of these when asking for service tickets. Microsoft Entra Kerberos can issue a Cloud version for cloud resources, and also a partial version, containing nothing but the user's SID, which on-premises DCs exchange for a complete ticket.