In this blog post Azure Files on macOS Identity Authentication Options Beyond Intune we will explain how Mac users can securely access Azure file shares without treating Microsoft Intune as the authentication system.
The problem often appears when a business introduces more Macs. Users are asked to enter a shared storage account key, credentials are saved in Keychain, and IT has no simple way to remove one person’s access without changing the key for everyone.
That may keep files accessible, but it creates an unnecessary security and administration risk. The better goal is identity-based authentication, where each person connects using their own company identity and receives only the access their role requires.
What Azure Files authentication actually does
Azure Files provides cloud-hosted file shares that employees can open much like a traditional office file server. Macs normally connect using SMB, which is the standard protocol used to access shared folders across a network.
CPI Consulting helps organisations design, build and secure Azure AI solutions, from Azure OpenAI and Microsoft Foundry to agents, governance and production deployment.
Visit CPI ConsultingFor identity-based access, Azure Files commonly uses Kerberos. In plain English, Kerberos gives the user a short-lived digital ticket confirming who they are. The Mac presents that ticket to Azure Files instead of repeatedly sending the user’s password.
Azure then checks two separate permission layers. Share-level permissions decide whether the user can enter the file share, while directory and file permissions decide which folders and documents they can read or change.
This distinction matters because authentication alone does not provide secure access. A user may prove their identity successfully but still be blocked because the correct Azure role or folder permission has not been assigned.
Intune manages the Mac but does not authenticate the user
Microsoft Intune, which manages and secures company devices, can deploy the settings required for single sign-on. However, Intune does not issue the Kerberos ticket and does not grant access to the files.
This means businesses do not necessarily need to adopt Intune solely to access Azure Files. Another mobile device management platform can be used if it supports the required Apple and Microsoft configuration profiles.
Device management is still important. It provides a reliable way to configure dozens or hundreds of Macs, remove settings from retired devices and prevent employees from making security-sensitive changes.
For personal Macs, the ownership and privacy questions also need to be considered. Our guide to managing macOS BYOD devices with Microsoft Intune covers those decisions in more detail.
Option one Microsoft Entra Kerberos with Platform SSO
Microsoft Entra ID is the cloud identity service behind Microsoft 365. Platform Single Sign-On, or Platform SSO, connects the Mac login experience with that company identity and can make a Kerberos ticket available to macOS.
Azure Files can then use Microsoft Entra Kerberos to authenticate the user. The result is a familiar experience: the employee signs in to the Mac and opens an approved file share without being given the storage account’s master key.
As of October 2026, Microsoft Entra Kerberos access to Azure Files from macOS through Platform SSO is in public preview. Microsoft’s documented Azure Files scenario currently requires macOS Tahoe 26.5 or later, an enrolled MDM-managed device, Platform SSO and the Microsoft Company Portal application.
Microsoft documents the deployment using Intune, but the underlying configuration can be delivered by another compatible MDM. The practical question is not simply whether the alternative platform manages Macs. It is whether it supports the required Platform SSO and Kerberos configuration payloads.
This is the strongest long-term option for organisations moving towards cloud-only identities. However, preview status should matter to decision-makers. Pilot it with a small user group before relying on it for a business-critical file service.
Option two on-premises Active Directory Kerberos
If your users still have accounts in on-premises Active Directory Domain Services, Azure Files can use that directory as its identity source. Active Directory Domain Services is the traditional Microsoft system many businesses use to manage employee accounts and access permissions.
The Mac must be able to obtain a Kerberos ticket from a domain controller. This normally requires suitable DNS settings and network connectivity through the office network, a secure VPN or another private connection.
Apple’s Kerberos Single Sign-On extension can help provide a smoother user experience. Its configuration can be delivered through Intune or another MDM, so the Mac may not need to be managed using Microsoft’s device platform specifically.
This path can suit a hybrid business that still depends on Active Directory and already has mature file permissions. Its drawback is infrastructure dependency: remote users may need reliable access to domain controllers, and DNS or VPN problems can become file access problems.
Option three Microsoft Entra Domain Services
Microsoft Entra Domain Services provides managed domain services in Azure, including Kerberos, without requiring the business to operate every domain controller itself. It can act as an identity source for Azure Files when traditional domain features are still required.
This is not usually the first choice for a business that only wants Mac file access. It adds cost, networking and another identity layer that must be maintained.
It may make sense where several older applications already require domain-based authentication. Mac compatibility, DNS, private connectivity and permission behaviour should still be tested with your actual applications and devices before rollout.
Why storage account keys are not a good user access model
A storage account key can mount Azure Files from macOS, but it effectively acts like a master password. Anyone with the key can potentially receive broad access, and the activity is not cleanly tied to an individual employee identity.
Keys are also difficult to manage during offboarding. If a departing employee knows the key, rotating it may interrupt every user, script or system that depends on it.
Keys can remain useful for controlled administration, migration or emergency recovery. They should not be the normal sign-in method for employees.
Managed identities are not a direct replacement for this scenario either. They are designed mainly for Azure applications and computing workloads rather than a person opening Finder on a Mac. We explain that distinction further in our guide to using managed identity securely in production.
A practical deployment plan
- Confirm your identity source. Decide whether users are cloud-only, hybrid or still dependent on on-premises Active Directory. Only one primary directory identity source can be enabled for a storage account at a time.
- Review the Mac fleet. Record macOS versions, ownership, current MDM coverage and whether users work remotely. Older devices may not support the newest Platform SSO route.
- Choose the management platform. Confirm that your MDM can deploy the necessary Platform SSO or Kerberos profiles. Do not assume general Mac management automatically means full support.
- Design permissions before migration. Use groups based on business roles rather than assigning access separately to every employee. This makes onboarding, job changes and offboarding easier.
- Secure the network path. SMB commonly uses TCP port 445, which some internet providers and networks block. A private endpoint and VPN may provide a safer and more reliable connection.
- Run a controlled pilot. Test office, home and mobile connections with normal users, not just administrators. Include password changes, device replacement and employee offboarding.
Useful validation commands
Your technical team can check whether the Mac has received a Kerberos ticket before testing the share:
klistThey can then open the Azure file share without placing a storage key in the command:
open smb://storageaccount.file.core.windows.net/sharenameIf this fails, the cause may be the identity ticket, Azure role assignment, folder permissions, DNS or network access. Testing each layer separately is faster than repeatedly changing passwords.
What this looks like in a real business
Consider a 180-person professional services firm with 45 Macs. Its Windows users access Azure Files with individual identities, while Mac users share a storage key saved in Keychain.
Moving the Macs to identity-based authentication means access can be removed by disabling one account or changing one group membership. The business avoids rotating a shared key across 45 devices and gains a clearer record of who should have access.
This also supports the intent of the Essential Eight, the Australian Government’s cybersecurity baseline, particularly around restricting access and protecting administrative credentials. It does not achieve Essential Eight maturity by itself, but it removes one common weak point.
Choose based on risk rather than product loyalty
Intune is often a sensible choice for Microsoft-focused businesses, but it is not the authentication engine for Azure Files. The key components are your identity source, Kerberos ticket delivery, file permissions, network path and a capable device management platform.
Cloud-only organisations should investigate Microsoft Entra Kerberos and Platform SSO, while hybrid businesses may find that on-premises Active Directory remains the more predictable short-term option. Shared storage keys should be treated as an exception, not the standard employee experience.
CloudProInc combines more than 20 years of enterprise IT experience with practical Microsoft Partner and security integration expertise. If you are unsure which macOS authentication path fits your Azure environment, we are happy to review the current setup and explain the trade-offs without pushing you into a platform you do not need.