Microsoft Entra Kerberos is enabled for an Azure Files share, yet everyone who can mount it still sees every lock plan. What authorization layers should the security engineer configure?
Select an answer to reveal the explanation.
Short Explanation
Mounting the share is the front gate; NTFS is the file cabinets inside. Set share-level SMB RBAC first, then lock down folders—Elevated Contributor is who can change those NTFS ACLs.
Full Explanation
Identity-based Azure Files authorization is two-layered: Azure RBAC at share scope (Storage File Data SMB Share Reader, Contributor, or Elevated Contributor) gates who may access the share over SMB, and Windows ACLs on directories and files refine permissions inside the share. Elevated Contributor is the share role that can change NTFS permissions. Kerberos authentication does not remove the need for both layers. Account-key access bypasses this identity model.