Azure Files resolves to its private IP and TCP 445 succeeds. Eligible Entra Kerberos clients nevertheless receive error 1326 after the private endpoint was introduced. The private-link name is absent from the storage application's identifierUris. What should be corrected?

✓ Correct answer

• Add corresponding private-link FQDN identifierUris while retaining the existing public entries

Working DNS and SMB transport are necessary but insufficient here. Register the private-link FQDN forms so Kerberos can request the proper storage ticket. Option explanations: A. Change all profile ACLs to Full Control for Everyone: The identified failure is ticket acquisition; broad ACLs neither register the name nor preserve isolation. B. Remove the cloud Kerberos ticket policy from the hosts: Removing a required policy does not correct the missing application registration. C. Enable NTLM for domain credentials on Azure Files: Azure Files does not support that NTLM fallback for domain credentials. D. Add corresponding private-link FQDN identifierUris while retaining the existing public entries: The documented ticket flow needs private-link name registration in the Entra application. Sources: Enable Microsoft Entra Kerberos authentication for hybrid and cloud-only identities on Azure Files — https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable; Azure Files SMB authentication troubleshooting — https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files-troubleshoot-smb-authentication

Read the source reference