Any ideas to authenticate access for Entra users to shared folders on Windows Server?
Eventually this entire system needs to be torn down and rebuilt, but I need a "temporary" solution that will work for now until that is done. Existing Setup: Server: Windows Server 2019 It is not a DC, because no on-premises AD is being used. It's just a…
Eventually this entire system needs to be torn down and rebuilt, but I need a "temporary" solution that will work for now until that is done. Existing Setup: Server: Windows Server 2019 It is not a DC, because no on-premises AD is being used. It's just a glorified application and file server. Running an ancient accounting program. Shared Folders, which must be Mapped as Network Drives on client machines running Windows. Users defined locally in Windows Server with permission to access Shared Folder. Client Machines: Windows 11 Pro Managed by InTune Login via Entra credentials. Manually mapping a Network Drive for each User to the Server, using their local User defined on the Server. I'd love to be able to Map the Network Drive using each user's Entra credentials, but to do this, the Windows Server would have to be aware of the Entra Users. I know there is no great way to synchronize users from Entra back to an on-premises AD DC, but that's not really what I need. I just need to be able to authenticate Shared Folder access with Entra credentials. Could the Windows Server act as a "pass-through" where it hands off authentication to an LDAP server? I've already set up the AzureAD-LDAP-Wrapper on my local Synology to allow for Entra-based authentication of the Synology's Shared Folders, and it's working well. Is there any way I could point the Windows Server to that same LDAP Wrapper, and then set permissions for the Shared Folders on the Windows Server based on those LDAP users? I'm thinking maybe this is what I need? Configure AD FS to authenticate users stored in LDAP directories in Windows Server 2016 or later Does anyone have any experience trying to do something this stupid?
Collected discussion
Microsoft Entra Connect: It’ll sync your on-prem AD with Entra ID. Assuming you’ve already got both environments, it’s a bit of planning but entirely doable. Then enable Cloud Kerberos Trust, and it works pretty much exactly how you’d expect for a domain-joined PC. This means you’re no longer really thinking about two accounts you create an account in active Directory and that Account sinks up into 365 and then just add a license to it so it means no more two sets of passwords. Look after everything just gets a lot simpler and with the cloud cover trust even an ID join the computer can just authenticate.
No, it's all Microsoft Cloud.
No on-prem AD. I should mention that.
I don't fully understand the existing ancient accounting software yet, but it is running on the server, as a server, and then the clients access the Shared Folder. It all needs to be on the Windows Server where it was set up, for now, until I understand it better (or replace it entirely with something newer.)
Worth a test on an endpoint. Copy files over to the NAS, map the share on an endpoint. The client software (assuming this is a fat client for a MSSQL-based server application) shouldn't care as long as the drive letter is correct. Permissions may be a sticky point. I assume the server ingests POs and invoices via the mapped drive and/or reports exported from the server show up here.
they have to authenticate vs something on prem. if that something is running windows server, just setup AD in my opinion.
Since when? I thought the opposite was true and Microsoft had deprecated writeback functionality long ago, after the brand changing from AzureAD to Entra.
Do you have a good guide on that last one? I'm in a similar situation and don't want to mess up the whole thing with a bad server implementation.
If you have space on the Synology NAS, could you mount the Synology share on the Windows Server and write the files to the share(s) there? You confirmed the Entra auth method works on the Synology using the wrapper. If you can't use a mapped drive on the Windows Server, use Syncthing to sync files from the server to the NAS SMB share. Resilio Sync would work too.
I do NOT recommend Azure Files as a NAS replacement. Our management decided campus offices should have NO servers whatsoever and replaced all the NASes with Azure Files, and the business units have been screaming about the crap, slow connections ever since then to the point we’re now talking about putting NASes back in at least the primary data center. It might be better if there’s absolutely no WAN links whatsoever between the users and the AF storage accounts, but do NOT centrally backhaul any Azure Files traffic if you value your sanity, which is obviously going to put it out of the running if your security team enforces sensitive data only through private links that they can monitor for DLP.
Cloud sync can now be set up bidirectionally, so if you stood up on prem AD, you could sync your entra users down. But if you're unable or unwilling to stand up AD and don't want to deal with entra domain services in the cloud, then I think you're back to 2000s days and looking at login.bat scripts
Look at Entra Domain Services. It's meant for legacy apps only supporting AD authentication, but I had a couple Synology joined to a DS domain and used that to manage ACLs.
What you are looking for is Entra domain services. Because you don’t have an on-prem AD there is no way to authenticate the users. Join the server to this “cloud first” domain and it will then allow you to set NTFS permissions. But personally I would move the file server to a non windows server and use LDAP(s) with Entra Domain Services. Another solution if you are looking to cut back on the on-prem resources is Azure Files which is like a cloud hosted network drive / SMB share.
Your server is not directory aware. Its not AD aware or Entra aware. So its does not have the capability to authenticate a credential that is passed to it that is from an external directory. Window server will not be that synology aware either. unless you can make it. Nothing native in windows that will support that. Other than creating local accounts on the server with passwords and giving to the users.
Do you not have on-prem AD?
i guess maybe what I would try in this f’ed up situation is to set up an Azure Files smb share with entra auth and mount that on the server with the storage account key, then have the users mount it as well. idk how well that’d work. idk why youre running legacy stuff without active directory in the first place tho. this is super easy with on prem AD, entra connect, and cloud kerberos
What about local users on the server for every user/computer and then adding these credentials on Credentials Manager of the relevant user/computer? Aka poor man's AD? Edit: I saw that you already do this so please disregard as this isn't the problem you try to solve.
Microsoft says there’s a ton of demand for EntraID enablement on servers, but they have decided not to pursue setting that up SharePoint is your most effective option or local users
I would keep it as is or upload the files to sharepoint, from there you can sync the files/folders to user's PCs using onedrive. And control permissions on the sharepoint site.
Two way passtrhough does work and is supported. AFAIK there is no way for ntfs permissions to do entra only users. This is just a hard limitation.
If it’s not worth the effort to setup AD, it sounds like it’s a “ain’t broke don’t fix it” situation. What’s the advantage of using entra credentials for your small subset of users? Windows can handle pass through authentication, it’s AD. The article you linked to requires AD. Synology can host the AD for you.
I'm experimenting with EntraAD joined Azure Windows Server 2025 along with EntrAD joined Windows 11 Pro clients, including a Cloud PC in the same VNET as the server. I created a Windows File share. I add the Entra users to a local group on the Windows Server. Add-LocalGroupMember -Group "L-Accounting" -Member "AzureAD\\user@yourdomain.com" Note: Adding an Entra Group to a local group doesn't work. I applied file permissions based on the local group "L-Accounting". I haven't tried share permissions yet. [My test share is currently "everyone"] I can connect to it over an Azure VPN using the IPv4 address: \\192.168.48.8\Accounting I haven't completed my testing, but the Windows Server does know and recognize the Entra user on the Windows 11 Pro client and enforce file permissions based on Entra user.
If you can upgrade the server to 2025, you can Azure Arc attach it and install the Entra Authentication extension, effectively Entra joining it, and now you can grant permissions to Entra users. That would at least handle the file shares. - https://learn.microsoft.com/en-us/entra/identity/devices/howto-arc-sign-in-windows I played around with it a bit last year here: https://anthonyfontanez.com/index.php/2025/07/27/internet-facing-file-servers-with-a-dash-of-entra-authentication/
Install the DC role on that server, setup an AD and entra cloud sync. Problem solved. I haven't seen a non domain joined windows server in 20 years.