A company wants Azure file shares mounted with NTFS-style per-user permissions enforced by on-premises Active Directory identities. Which auth method supports this?
A.Storage account key
Key auth = share-level access only, no per-user ACLs.
B.Identity-based authentication (AD DS or Entra Kerberos) on the share
Identity-based auth enables NTFS-style enforcement. Correct.
C.SAS tokens per user
SAS grants delegate access but don't give per-user NTFS semantics.
D.Anonymous read/write
Anonymous = no auth at all.
Why this answer
Azure Files supports identity-based auth: on-prem AD DS (domain-joined machines) or Microsoft Entra Kerberos for hybrid identities — enabling share-level RBAC + NTFS ACLs on files. Account key mounts authenticate as the share itself — no per-user identity.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Storage Implementation practice session.
Practice Storage Implementation