Azure Files Premium: Issue with Microsoft Entra Kerberos authentication — Cloud-only Entra ID users not receiving Kerberos tickets

Ruairi Hickey 0 Reputation points
2026-10-29T19:13:07.44+00:00

Problem description

I am experiencing issues with Azure Files Premium in West Europe where cloud-only Microsoft Entra ID users are unable to receive Kerberos tickets for SMB authentication. The 'klist get cifs/...' command fails with STATUS_NO_LOGON_SERVERS, and no cloud Kerberos ticket is issued.

Environment

Azure Files Premium deployment in West Europe, accessed from Windows clients, with cloud-only Microsoft Entra ID users.

What I've already tried

I checked the portal settings for Azure Files identity-based access; the options for cloud-only Entra ID users are not visible, only AD DS, Microsoft Entra Domain Services, and Microsoft Entra Kerberos. I reviewed product guidance and confirmed that Azure Files SMB identity authentication supports Microsoft Entra Kerberos for cloud-only identities. I also verified that the storage account is configured for AADKERB, and that the client device is Entra-joined with valid sign-in state. I attempted to reset the Kerberos ticket cache, signed out and back in, and verified the status of required services like WinHttpAutoProxySvc and iphlpsvc.

Current status

The issue persists with no cloud Kerberos ticket issuance, and the 'klist' command continues to fail with STATUS_NO_LOGON_SERVERS. I seek guidance on enabling cloud-only Entra ID SMB authentication for Azure Files and resolving the Kerberos ticket acquisition failure.

Azure Files
Azure Files

An Azure service that offers file shares in the cloud.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rukshan edirisinghe 2,445 Reputation points
    2026-10-31T02:05:37.5133333+00:00

    Hi @Ruairi Hickey

    You're not missing a portal option. There's no separate "cloud-only" setting: cloud-only users go through the same Microsoft Entra Kerberos option you've already enabled. STATUS_NO_LOGON_SERVERS usually means the client isn't asking Entra ID for a cloud Kerberos ticket at all, so I'd focus there.

    Go through Microsoft's cloud-only checklist in this order:

    1. Client OS build. Cloud-only identities need Windows 11 Enterprise/Pro 24H2 (build 26100.8116 or later), 25H2 (26200.8116 or later), 26H1 (28000.1764 or later), or Windows Server 2025 with the latest updates. Run winver and check the build. Older builds won't get a ticket for cloud-only users.
    2. Ticket retrieval policy. Set Kerberos/CloudKerberosTicketRetrievalEnabled = 1 on the clients. In Intune, use the Settings Catalog, not OMA-URI. Then reboot or force a policy refresh.
    3. Admin consent. In Entra ID, go to App registrations > All applications, open [Storage Account] yourstorageaccount.file.core.windows.net and select Grant admin consent for openid, profile and User.Read.
    4. App manifest tags. For cloud-only identities, the doc says you must update the Tags in that app's manifest, or authentication fails. Follow the group SID limit section in the doc linked below.
    5. MFA exclusion. If a Conditional Access policy requires MFA for all apps, exclude that storage account app. Otherwise mapping fails, usually with system error 1327.
    6. Share permissions. Assign a share-level RBAC role (for example, Storage File Data SMB Share Contributor) to the user or group.

    Then sign out and in, run klist purge, and try klist get cifs/yourstorageaccount.file.core.windows.net again.

    Which Windows build are your clients on?

    If the ticket comes through, please consider accepting it as the answer. If klist still fails after all six checks, let me know and I'll be happy to keep helping.

    Reference:

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.