
This means your end users can access Azure file shares over the internet without requiring line-of-sight to domain controllers from hybrid Azure AD-joined and Azure AD-joined clients. This configuration allows hybrid users to access Azure file shares using Kerberos authentication, using Azure AD to issue the necessary Kerberos tickets to access the file share with the SMB protocol. Cloud-only identities aren't currently supported.


This article focuses on enabling and configuring Azure Active Directory (Azure AD) for authenticating hybrid user identities, which are on-premises AD DS identities that are synced to Azure AD.
