You have an Azure subscription that is linked to a hybrid Microsoft Entra tenant and contains a storage account named storage1. You have an Azure…

For FSLogix profile containers on Azure Files to be accessed by users on Microsoft Entra joined session hosts, identity-based authentication is required. Microsoft Entra Kerberos is the specific feature that enables seamless Single Sign-On (SSO) by allowing Microsoft Entra joined virtual machines to access SMB file shares using Microsoft Entra credentials. When enabled on the storage account, it allows the user's Kerberos ticket, obtained from Microsoft Entra ID during login, to be used for authenticating and authorizing access to the Azure Files share. This is the designated method for non-hybrid, cloud-native AVD environments.

A. a security profile set to Maximum compatibility

This is a configuration setting for Network File System (NFS) v4.1 shares, not for Server Message Block (SMB) shares, which are required by FSLogix.

B. Microsoft Entra Domain Services

While Microsoft Entra DS can provide identity for Azure Files, it is designed for scenarios requiring traditional domain services. For purely Microsoft Entra joined hosts, Microsoft Entra Kerberos is the more direct and appropriate solution.

D. a security profile set to Maximum security

Similar to option A, this is a security setting for NFS v4.1 shares to enforce Kerberos authentication, but it is not applicable to the SMB protocol used by FSLogix.

---

1. Microsoft Learn

Azure Virtual Desktop Documentation. "Create a profile container with Azure Files and Microsoft Entra ID." Under the section "Enable Microsoft Entra authentication on your storage account

" the documentation states

"To use Microsoft Entra ID as your authentication method

you must enable it on your storage account... For session hosts that are Microsoft Entra-joined

you must use Microsoft Entra Kerberos."

Reference: https://learn.microsoft.com/en-us/azure/virtual-desktop/create-fslogix-profile-container-azure-ad#enable-microsoft-entra-authentication-on-your-storage-account

2. Microsoft Learn

Azure Storage Documentation. "Overview of Azure Files identity-based authentication options for SMB access." This document provides a comparison table showing supported scenarios. For the "Microsoft Entra-joined VMs" client type

the supported identity source is "Microsoft Entra ID" and the required protocol is "SMB with Microsoft Entra Kerberos authentication."

Reference: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview#supported-scenarios-and-restrictions

3. Microsoft Learn

Azure Storage Documentation. "Enable Microsoft Entra Kerberos authentication for Microsoft Entra-joined VMs to access Azure Files." This guide explicitly details the process for the scenario in the question. The prerequisite states: "Enable Microsoft Entra Kerberos authentication on your storage account to authenticate with Microsoft Entra user identities."

Reference: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-azure-ad-kerberos-entras-joined-vms (Prerequisites section)

4. Microsoft Learn

Azure Storage Documentation. "Create an NFS share." This document describes the "Security" tab during NFS share creation

which includes the "Maximum compatibility" and "Maximum security" options

confirming they are specific to NFS and not SMB.

Reference: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-how-to-create-nfs-shares?tabs=azure-portal#create-an-nfs-share (Step 10 in the "Create an NFS share" section)