Azure-Samples / Azure-Samples/azure-files-samples
AzFilesHybrid fails when SMB OAuth / Managed Identity for SMB is enabled (no pre-check or auto-disable)
- Dominant language
- PowerShell
- Stars
- 261
- Forks
- 202
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 4
Description
Summary
AzFilesHybrid fails with a generic `409 Conflict` when **Managed Identity for SMB (SMB OAuth)** is enabled on an Azure Files storage account.
The failure occurs because **SMB OAuth and Native AD DS authentication are mutually exclusive**, but the script does not:
- Detect this condition
- Warn the user
- Offer to disable SMB OAuth automatically
This leads to a difficult troubleshooting experience.
Background
Managed Identity support for SMB Azure file shares was released to public preview in **November 2025**.
The feature enables Windows and Linux VMs to access SMB shares using **Microsoft Entra ID (OAuth)** without credentials.
When this feature is enabled:
- `SmbOAuth = True`
- `Set-AzStorageAccount -EnableActiveDirectoryDomainServicesForFile $true` fails with:
```json
{
"code": "ConflictFeatureEnabled",
"message": "This operation is not allowed on a storage account with SmbOAuth set to 'True'."
}
solution
improve script with either:
1) check if Managed identity support for SMB Azure file shares is enabled and throw error
$acct = Get-AzStorageAccount -ResourceGroupName $ResourceGroupName -Name $StorageAccountName
$acct.AzureFilesIdentityBasedAuth
2) disable automatically during script run
Set-AzStorageAccount `
-ResourceGroupName $ResourceGroupName `
-Name $StorageAccountName `
-EnableSmbOAuth $false
Contributor guide
Assessment
This issue has not been assessed yet.