'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Can Azure AD-Joined PCs Access On-Premises File Servers?
Question details
The organization needs to maintain access to legacy on-premises file servers from PCs that are joined directly to a cloud-only Azure AD environment.
- Product
- Azure Active Directory
- Device & OS
- not provided
- Scenario
- Migrating from a hybrid Active Directory to a cloud-only environment while still relying on local on-premises file servers.
- Observed behavior
- Users are looking for the correct authentication methods and configurations required to seamlessly access local shares from cloud-joined devices.
Ensure that your organization's Azure AD Connect is actively synchronizing identities between your on-premises Active Directory and Azure Entra ID (Azure AD), as seamless access relies on these synchronized identities.
Utilize Identity Synchronization and Network Line-of-Sight
Configure identity synchronization so cloud-joined PCs can obtain the necessary Kerberos tickets for on-premises file server access.
Even if a Windows PC is strictly joined to Azure AD, it can still authenticate against on-premises resources that use traditional Active Directory authentication. This works seamlessly if the user signing into the PC has a hybrid identity (synchronized from the local AD).
The primary requirement for this to function is that the Azure AD-joined device must have a network line-of-sight to your on-premises Domain Controllers.
Confirm with your IT administrator that Azure AD Connect is running and successfully syncing your local Active Directory user accounts to the cloud.
Ensure the Azure AD-joined PC is connected to the corporate network either via direct internal Ethernet/Wi-Fi or a secure VPN connection.
Open File Explorer and type the UNC path of your on-premises file server (e.g., \\ServerName\ShareName). Windows will automatically request a Kerberos ticket in the background and grant access without additional prompts.
Consult Microsoft Q&A for Complex Decommissioning Scenarios
If your organization plans to completely shut down the on-premises Active Directory, you will need specialized architectural guidance.
Manage Your Documents Seamlessly Across Cloud and Local Storage
While your IT team configures advanced network and server access for your cloud migration, ensure your employees have a fast, reliable, and cost-effective office suite. WPS Office is a highly compatible alternative that works beautifully on Azure AD-joined devices, allowing users to open, edit, and save files directly to on-premises servers or cloud storage.
- 1. Download the Installer: Visit the official WPS Office website and download the installer package to your Azure AD-joined PC.
- 2. Install WPS Office: Run the installer. The lightweight design ensures it installs in seconds, ready for immediate use.
- 3. Access Network Documents: Open WPS Office and navigate to your mapped on-premises network drives or UNC paths to open and edit legacy documents natively.
Frequently Asked Questions
Do I need a VPN for an Azure AD-joined PC to access on-premises file servers?
Yes, if the device is operating remotely. An Azure AD-joined PC requires network line-of-sight to the on-premises Domain Controller to authenticate. If the device is not physically on the corporate network, a VPN connection is mandatory.
Will file server access work if we completely turn off our on-premises Active Directory?
No. If the on-premises Active Directory is fully decommissioned, legacy file servers that rely on Kerberos or NTLM will not function properly for user authentication. You would need to migrate the file server data to cloud solutions like Azure Files or SharePoint.
Can cloud-only Azure AD users access the on-premises local servers?
No. Only users whose identities are actively synchronized from the on-premises Active Directory (hybrid identities) can seamlessly access legacy on-premises file servers. Cloud-only users lack the required on-premises Security Identifiers (SIDs).
