Azure-Samples / Azure-Samples/azure-files-samples

AzFilesHybrid fails when SMB OAuth / Managed Identity for SMB is enabled (no pre-check or auto-disable)

Open
#300 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
261
Forks
202
Avg merge
1d 5h
Merged PRs (30d)
4

Description

Summary
AzFilesHybrid fails with a generic `409 Conflict` when **Managed Identity for SMB (SMB OAuth)** is enabled on an Azure Files storage account.

The failure occurs because **SMB OAuth and Native AD DS authentication are mutually exclusive**, but the script does not:
- Detect this condition
- Warn the user
- Offer to disable SMB OAuth automatically

This leads to a difficult troubleshooting experience.

Background
Managed Identity support for SMB Azure file shares was released to public preview in **November 2025**.
The feature enables Windows and Linux VMs to access SMB shares using **Microsoft Entra ID (OAuth)** without credentials.

When this feature is enabled:
- `SmbOAuth = True`
- `Set-AzStorageAccount -EnableActiveDirectoryDomainServicesForFile $true` fails with:

```json
{
"code": "ConflictFeatureEnabled",
"message": "This operation is not allowed on a storage account with SmbOAuth set to 'True'."
}

solution
improve script with either:

1) check if Managed identity support for SMB Azure file shares is enabled and throw error
$acct = Get-AzStorageAccount -ResourceGroupName $ResourceGroupName -Name $StorageAccountName
$acct.AzureFilesIdentityBasedAuth

2) disable automatically during script run
Set-AzStorageAccount `
-ResourceGroupName $ResourceGroupName `
-Name $StorageAccountName `
-EnableSmbOAuth $false

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.