Azure Files with AD DS authentication; share-level RBAC vs NTFS permissions

By default you mount an Azure file share with the storage account key, which is like a single all-powerful password. For real file server use you want users to connect with their normal domain identity and get per-user permissions. Azure Files supports identity-based access over SMB with on-premises Active Directory Domain Services (AD DS), Microsoft Entra Domain Services, or Microsoft Entra Kerberos for hybrid identities. This lesson focuses on AD DS.