It should be A,
I just created a storage account,
then created a file share,
went to IAM,
and it says : To give individual accounts access to the file share (Kerberos), enable identity-based authentication for the storage account.
Still in 2024, is A correct
3. In the File share settings section, select Identity-based access: Not configured.
4. Under Microsoft Entra Domain Services select Set up, then enable the feature by ticking the checkbox.
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal#enable-microsoft-entra-domain-services-authentication-for-your-account
A is correct I am getting the same message when I go to IAM on File Share.
'To give individual accounts access to the file share (Kerberos), enable identity-based authentication for the storage account'
but its not asking how to give access, its asking what to do first. So dont you need to configure the access control before enabling identity-based data access for the file shares in storage1?
I also thought it was A. Then I freaked and started doubting when I saw the Vote Distribution being 50-50 between A & D. Thanks for testing and confirming for us. Correct answer should be A then!
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview
How it works
Azure file shares use the Kerberos protocol to authenticate with an AD source.
You can enable identity-based authentication on your new and existing storage accounts using one of three AD sources: AD DS, Azure AD DS, or Azure AD Kerberos (hybrid identities only). Only one AD source can be used for file access authentication on the storage account, which applies to all file shares in the account. Before you can enable identity-based authentication on your storage account, you must first set up your domain environment.
After arguing with ChatGPT here is the answer:
The correct steps to assign User1 the Storage File Data SMB Share Contributor role for share1 are:
1. Enable identity-based data access for the file shares in storage1.
2. Configure Access control (IAM) for share1 and add User1 as a role assignment with the Storage File Data SMB Share Contributor role.
So the correct answer is A.
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-assign-share-level-permissions?tabs=azure-portal
To assign an Azure role to a Microsoft Entra identity, using the Azure portal, follow these steps:
1. In the Azure portal, go to your file share, or create an SMB file share.
2. Select Access Control (IAM).
3. Select Add a role assignment
4. In the Add role assignment blade, select the appropriate built-in role from the Role list.
5. Leave Assign access to at the default setting: Microsoft Entra user, group, or service principal. Select the target Microsoft Entra identity by name or email address. The selected Microsoft Entra identity must be a hybrid identity and cannot be a cloud only identity. This means that the same identity is also represented in AD DS.
6. Select Save to complete the role assignment operation.
The correct answer is A. Enable identity-based data access for the file shares in Storage1
Enable identity-based data access for the file shares in Storage1:
This step is necessary to allow Azure AD identities to access the file shares. Without enabling identity-based data access, you cannot assign Azure AD roles like the Storage File Data SMB Share Contributor role to users for accessing file shares.
Modify the security profile for the file shares in Storage1:
This option is not relevant to the task. Modifying the security profile does not enable identity-based access or allow role assignments. Security profiles typically involve settings related to encryption, access protocols, and other security configurations.
Select Default to Azure Active Directory authorization in the Azure portal for Storage1:
While this option is related to enabling Azure AD authorization, it is not the first step. You need to enable identity-based data access first before you can configure Azure AD authorization settings.
Go to Azure Portal
Create a new storage account
Create a new File Share
Go to the File Share > IAM > Add Role Assignment > Storage File Data SMB Share Contributor
Today, Feb 2025, you i could add Storage File Data SMB Share Contributor role for a user without enable identity-based data access for the file shares in storage1.
D is correct
C. Select Default to Azure Active Directory authorization in the Azure portal for storage1: While this step is necessary, it comes after enabling identity-based data access. Without enabling identity-based access first, this setting alone won't work.
By the way - If I need wait for moderator approval my comment. Why comments with wrong answers are visible? I see a lot of new comments (1-6 months ago) "YEA I HAD A CHAT WITH CHAT GPT THE ANSWER IS 100% A" - Hollllyyy and the price is higher and higher....
Correct answer is D
I tried the same way like macrawat however in my case that works - inside created file share "share1" I was able to grant access from IAM to user. State of identity-based access is "not configured" as on screenshot from microsoft doc
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal
Just repro in a lab with a new storage account.
Identity-based access can be enabled in two steps for a particular share in this storage account. This allows individual users to use their Active Directory or Microsoft Entra account to gain access to a specific file share.
Step 1: Enable an identity source
This section is not available anymore. Please use the main Exam Page.AZ-104 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
macrawat
Highly Voted 2 years, 1 month agoc75e123
4 months agoyettie79
2 years agoriquesg
1 year, 12 months agogarmatey
1 year, 11 months agoIndy429
1 year, 4 months agoSlimus
2 years agomfalkjunk
Highly Voted 2 years agoAndreLima
1 year, 11 months agomaxsteele
1 year, 7 months ago4f45fce
Most Recent 4 days, 23 hours agormacjj
2 weeks, 2 days agokriChe27
4 weeks agokriChe27
4 weeks agoAndrewChedid
1 month agoPonpon3185
1 month, 1 week agonetloony
1 month, 2 weeks agoPonpon3185
1 month, 2 weeks agovrm1358
2 months, 2 weeks agoBravo_Dravel
2 months, 4 weeks agoyoungjanpawel
3 months, 3 weeks agoyoungjanpawel
3 months, 3 weeks agoMaDota
3 months, 2 weeks agodanlo
4 months, 1 week agoMark74
4 months, 3 weeks agoJPA210
5 months, 3 weeks agoYoooom
6 months, 1 week ago