By David,
To use FSLogix profile containers on Microsoft Entra ID-joined AVD session hosts, store them on Azure Files with Microsoft Entra Kerberos as the storage account's identity source. Entra ID issues the Kerberos ticket for the file share, so the session hosts don't need line of sight to a domain controller. The setup has three parts: enable Entra Kerberos on the storage account and consent to its app, grant share-level and NTFS permissions, and turn on Cloud Kerberos ticket retrieval on every session host before pointing FSLogix at the share.
The short version: Enable Entra Kerberos on the storage account, grant admin consent to its "[Storage Account]" app registration and exclude that app from MFA Conditional Access policies. Give users Storage File Data SMB Share Contributor, set the NTFS permissions FSLogix needs, and set CloudKerberosTicketRetrievalEnabled and LoadCredKeyFromProfile to 1 on the hosts. Then set VHDLocations. If it fails,
klist get cifs/<account>.file.core.windows.neton the host tells you whether Kerberos is the problem.
This guide expands section 4 of our FSLogix troubleshooting guide. Everything below is from Microsoft Learn as of November 2026, with each source linked. Microsoft changes this area often, so check the linked pages before you start.
Before you start
Identities. Entra Kerberos works with two kinds of user (Azure Files with Entra Kerberos):
- Hybrid identities, synced from AD DS with Entra Connect Sync or Cloud Sync. Supported in Azure public, Azure Government and Azure operated by 21Vianet.
- Cloud-only identities, created in Entra ID. Supported in Azure public only. Microsoft's Azure Files pages describe this without a preview label, but the Entra Kerberos overview lists cloud-only identity support as preview (Entra Kerberos), so check its status before you rely on it in production.
Session host operating systems. Hybrid identities work on Windows 11 and Windows 10 2004 or later and Windows Server 2022 or later with the listed updates; cloud-only identities need recent Windows 11 builds (24H2 and later, with the updates Microsoft lists) or Windows Server 2025. The hosts must be Entra ID-joined or hybrid-joined.
Other constraints.
- A storage account uses one identity source at a time: AD DS, Entra Domain Services or Entra Kerberos.
- The storage account's SMB security settings must allow Kerberos. If you use a custom SMB security profile, check that Kerberos is selected under authentication methods.
- If an Entra application management policy blocks password addition on service principals, or limits their password lifetime to under a year, grant an exception for the Storage Resource Provider app (app ID
a6aa9161-5291-40bb-8c5c-923b567bee3b). Otherwise enabling Entra Kerberos fails. - Cross-tenant access isn't supported.
- The WinHTTP Web Proxy Auto-Discovery (WinHttpAutoProxySvc) and IP Helper (iphlpsvc) services must be running on the hosts.
- Entra Kerberos tickets use AES-256.
Step 1: Enable Entra Kerberos on the storage account
In the Azure portal, open the storage account, then Classic file shares → Identity-based access → Microsoft Entra Kerberos → Set up. With hybrid identities you can optionally enter your AD domain name and GUID, which lets you set NTFS permissions from File Explorer later. With PowerShell:
Set-AzStorageAccount -ResourceGroupName "rg-avd-storage" -StorageAccountName "stavdprofiles" `
-EnableAzureActiveDirectoryKerberosForFile $true
Step 2: Consent to the app and exclude it from MFA
Enabling Entra Kerberos creates an app registration named [Storage Account] stavdprofiles.file.core.windows.net. In Entra ID → App registrations, open it, go to API permissions, and Grant admin consent for openid, profile and User.Read. If the share is reached through a private endpoint, also add the private link FQDN (stavdprofiles.privatelink.file.core.windows.net) to the app's identifier URIs in its manifest (Azure Files with Entra Kerberos).
For cloud-only identities, also add the kdc_enable_cloud_group_sids tag to the app's manifest, so group membership reaches the ticket.
Exclude the app from Conditional Access policies that require MFA. There's no way to prompt for MFA while a profile mounts at sign-in. If you don't, mounts fail with "System error 1327: Account restrictions are preventing this user from signing in."
Step 3: Grant share-level permissions
Users need Storage File Data SMB Share Contributor on the share. You can assign it to a group (for hybrid identities, a group synced from AD) or set it as the storage account's default share-level permission for all authenticated identities. If both apply, the higher permission wins. Admins who set NTFS permissions need Storage File Data SMB Share Elevated Contributor, or Microsoft's recommended Storage File Data SMB Admin role (share-level permissions).
Step 4: Set NTFS permissions on the share
FSLogix needs these directory permissions on the share root (storage permissions):
| Principal | Permission | Applies to |
|---|---|---|
| CREATOR OWNER | Modify | Subfolders and files only |
| Your AVD users group | Modify | This folder only |
| Your admins group | Full Control | This folder, subfolders and files |
How to set them. For both hybrid and cloud-only identities, use Manage access on the share in the Azure portal, or the RestSetAcls PowerShell module; neither needs a domain controller. Microsoft notes that "Windows File Explorer and icacls aren't currently supported for cloud-only identities", and for hybrid identities they need line of sight to a domain controller (file-level permissions).
Step 5: Configure the session hosts
Every session host needs two registry values. Set them with Intune, Group Policy or your image (FSLogix with Entra Kerberos):
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1
reg add HKLM\Software\Policies\Microsoft\AzureADAccount /v LoadCredKeyFromProfile /t REG_DWORD /d 1
In Intune, use the Settings catalog setting Kerberos → Cloud Kerberos Ticket Retrieval Enabled; Microsoft notes that a custom OMA-URI setting doesn't work on AVD multi-session. In Group Policy, it's Allow retrieving the Azure AD Kerberos Ticket Granting Ticket during logon. Reboot the host or refresh policy afterwards.
If the same hosts also reach storage accounts that use AD DS, add host-to-realm mappings for those accounts (ksetup /addhosttorealmmap), as Microsoft describes.
Step 6: Point FSLogix at the share
Set FSLogix's Enabled to 1 and VHDLocations to \\stavdprofiles.file.core.windows.net\profiles under HKLM\SOFTWARE\FSLogix\Profiles, along with the rest of your profile settings. Sign in as a test user and check the share: a folder named <user SID>_<username> with the container inside means it worked.
Step 7: Check the RDP properties
For single sign-on to Entra ID-joined hosts, set the host pool RDP property enablerdsaadauth:i:1, which Microsoft says replaces the older targetisaadjoined property. targetisaadjoined:i:1 is still used for clients that aren't Entra-joined and connect with a username and password (RDP properties).
Troubleshooting Entra Kerberos and FSLogix
Test the ticket first. On a session host, signed in as an affected user:
klist get cifs/stavdprofiles.file.core.windows.net
If Windows can't get a ticket, the problem is Kerberos, not FSLogix. Microsoft's Debug-AzStorageAccountAuth cmdlet (AzFilesHybrid module 0.3.0 or later) checks the usual causes in one go, including Entra connectivity, the registry setting, realm mappings, admin consent and the two Windows services (SMB authentication troubleshooting).
Common failures (SMB authentication troubleshooting):
| Symptom | Likely cause |
|---|---|
No ticket from klist | Missing admin consent, the registry values not applied, or "Assignment required" set on the storage account's enterprise app |
| System error 1327 | The app isn't excluded from an MFA Conditional Access policy |
| Error 1326 through a private endpoint | The private link FQDN isn't registered on the app, so Windows falls back to NTLM |
| Mount fails and the service ticket can't be decrypted | A SupportedEncryptionTypes policy on the host leaves out AES. Entra Kerberos tickets are always AES-256, so allow AES256_HMAC_SHA1 |
| Error 5, access denied | Share-level role or NTFS permissions |
| "The request to Microsoft Graph failed with code BadRequest" when enabling Entra Kerberos | An application management policy is blocking the Storage Resource Provider (see Before you start) |
In the FSLogix profile log, these show up as access denied (5) or 1326 errors before the attach fails. Our troubleshooting guide covers reading that log.
Long sessions. A Cloud Kerberos ticket lasts 10 hours. FSLogix 26.08 (August 2026) refreshes it in the background during the session and when a container reconnects, without changing the ticket lifetime (release notes). Keep FSLogix current.
How Atlas AVD helps
Atlas AVD configures FSLogix for each host pool from Workspace → FSLogix → Settings, shows each session host's live FSLogix state on Host Coverage so a host that missed the configuration stands out, and checks on Health that each pool has a file server, share and profile type set. Its Azure Virtual Desktop security guidance covers locking the storage account down once it works.
FAQ
Can FSLogix work on Entra ID-joined session hosts without a domain controller?
Yes, with Azure Files and Microsoft Entra Kerberos. Entra ID issues the Kerberos ticket for the share, so the hosts don't need to reach a domain controller.
Does FSLogix support cloud-only identities?
Azure Files with Entra Kerberos supports cloud-only identities in Azure public cloud on recent Windows builds. Microsoft's Entra Kerberos overview lists cloud-only support as preview, so check its status first.
Why do I need to exclude the storage app from MFA?
The profile mounts during sign-in, where there's no way to prompt for MFA. If a Conditional Access policy requires MFA for the storage account's app, mounts fail with system error 1327.
Which registry settings do Entra ID-joined hosts need for FSLogix?
CloudKerberosTicketRetrievalEnabled set to 1 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, and LoadCredKeyFromProfile set to 1 under HKLM\Software\Policies\Microsoft\AzureADAccount, plus the usual FSLogix Enabled and VHDLocations.
Does Azure NetApp Files support Entra Kerberos for FSLogix?
It's in preview as of September 2026. See FSLogix storage: Cloud Cache vs Azure Files vs Azure NetApp Files.
Setup steps and requirements are from Microsoft Learn as of November 2026: Azure Files with Entra Kerberos, FSLogix with Entra Kerberos, share-level permissions, file-level permissions, FSLogix storage permissions, RDP properties, SMB authentication troubleshooting, Entra Kerberos and the FSLogix release notes.