This post is to summarize the steps to have your remote AAD joined Windows machine to access Azure storage file shares with proper access control. 


Create AAD Users & Groups

Create AAD Users

Create AAD Groups

Get Windows Client AAD Joined


Operating Systems All Windows 11 and Windows 10 devices except Home editions
Windows Server 2019 Virtual Machines running in Azure (Server core isn’t supported)

Azure AD join can be used in various scenarios like:

  • You want to transition to cloud-based infrastructure using Azure AD and MDM like Intune.
  • You can’t use an on-premises domain join, for example, if you need to get mobile devices such as tablets and phones under control.
  • Your users primarily need to access Microsoft 365 or other SaaS apps integrated with Azure AD.
  • You want to manage a group of users in Azure AD instead of in Active Directory. This scenario can apply, for example, to seasonal workers, contractors, or students.
  • You want to provide joining capabilities to workers who work from home or are in remote branch offices with limited on-premises infrastructure

Difference between Domain / Hybrid / Azure AD Joined / Azure AD registered device:


MMC –  Add/Remove Snap-in – Certificate – Computer account – Local computer


dsregcmd /status

Create Storage Accounts and File Shares

Create AAD Joined Windows 2019 Azure VM and Assign AAD Users Permission to VM

You can now join Windows 2019 Server to Azure AD using Azure AD domain Join. This uses Azure Active Directory (AD) authentication for Azure virtual machines running Windows Server 2019 Datacenter edition or Windows 10 1809 and later.

This provides a centrally controlled, policy driven method for logging on to VMs and authenticating using Azure AD.

This is carried out by using Azure tools such as Azure AD Conditional Access for MFA and Azure Role-Based Access Control (RBAC) to control access.

Create Storage Sync Service and Set up Tiered Sync and Shares

Create storage sync service:

Cloud Tiering :

After enabled cloud tiering, you can try to upload files to local VM folders or upload to Azure Storage share folders, it will automatically sync between them. But only file name and structure will be saved on local VM’s folders. 
As you can see from following screenshots, the size on disk is 0 bytes, although size column shows it has 362MB.. 

Assign AAD Users Permission to Share Folder

Add AAd accounts to have access to virtual machine

Assign permission to share folders

Create P2S VPN

Please refer to this post:

Access Azure VM’s File Share

After VPN connection built, try to ping Azure VM’s private ip address. In my this example, it is

PS C:\Users\test2> ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0:
   Connection-specific DNS Suffix  . : lan
   Link-local IPv6 Address . . . . . : fe80::fd79:1858:9a7c:5a4f%4
   IPv4 Address. . . . . . . . . . . :
   Subnet Mask . . . . . . . . . . . :
   Default Gateway . . . . . . . . . :
PPP adapter rg-storage-file-share-access-vnet:
   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . :
   Subnet Mask . . . . . . . . . . . :
   Default Gateway . . . . . . . . . :
PS C:\Users\test2> ping
Pinging with 32 bytes of data:
Reply from bytes=32 time=28ms TTL=127
Reply from bytes=32 time=27ms TTL=127
Reply from bytes=32 time=29ms TTL=127
Reply from bytes=32 time=30ms TTL=127
Ping statistics for
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 27ms, Maximum = 30ms, Average = 28ms
PS C:\Users\test2>

Now you should be able to mount your share folders on Azure VM. 

By netsec

Leave a Reply