Cascade's crew-scheduling office wants each crew member's Azure Files SMB share access to be controlled by that individual's own domain credentials, with per-user, NTFS-style permissions on specific folders — not one shared secret handed to the whole team. What should IT enable on the storage account?
Select an answer to reveal the explanation.
Short Explanation
Identity-based authentication turns the share into something that recognizes each crew member by their own login, the same way a badge reader knows which employee just walked in. Pair that with NTFS-style folder permissions and access finally maps to a person, not a shared password everyone knows. That's what per-user control actually requires.
Full Explanation
Enabling identity-based authentication on the storage account lets it validate each crew member against Microsoft Entra Domain Services or on-premises AD DS, so the SMB share honors standard NTFS-style permissions applied per user or group on specific folders — exactly the per-person control the scheduling office wants. Distributing the storage account key defeats the purpose entirely: the key is one shared secret with full account-wide access, offering no way to distinguish one crew member from another or restrict folders individually. Issuing a SAS per file is the right idea aimed at the wrong resource type — SAS tokens are built for scoped, time-limited access to specific blobs or containers, not for ongoing, identity-aware folder permissions on an SMB file share, and managing one SAS per file for an entire team would be unworkable at scale. Enabling anonymous public access removes authentication altogether, which is the opposite of the stated goal and would let anyone reach the share without credentials at all. A caveat: identity-based auth requires the client machines to be domain-joined (or hybrid-joined for Microsoft Entra Domain Services) to authenticate transparently. To confirm it's working, have two crew members with different folder permissions attempt to open the same restricted folder and verify only the authorized one succeeds.