AZ-140: Entra Kerberos for FSLogix on Azure Files (Registry Script Explained)

Entra joined session hosts are the default for new AVD deployments. They skip domain join, they work with Intune, and they remove the need for a VPN or ExpressRoute to a domain controller. The catch shows up the moment you add FSLogix. An SMB share needs Kerberos, and classic Kerberos needs a KDC. Microsoft Entra Kerberos solves that: Entra ID acts as the KDC for the storage account and hands the session host a cloud ticket during sign-in.

How the ticket flow works

Before you start: what has to be true

• Session hosts are Entra joined or Entra hybrid joined. Hosts joined only to AD DS or to Entra Domain Services are not supported for this flow.
• Supported OS. Windows 11 Enterprise single or multi-session, Windows 10 Enterprise 2004+, or Windows Server 2022/2025 with current cumulative updates. Cloud-only identities need newer builds (recent Windows 11 24H2/25H2 updates or Server 2025), so check the Learn prerequisites before you pick an image.
• Identity type. Hybrid identities (synced with Entra Connect or Cloud Sync) have been supported for years. FSLogix support for cloud-only and external identities became generally available in May 2026. Cloud-only needs an extra app manifest tag (covered below).
• One identity source per storage account. A storage account can use AD DS, Entra Domain Services, or Entra Kerberos. Not two at once.
• Services running. WinHTTP Web Proxy Auto-Discovery (WinHttpAutoProxySvc) and IP Helper (iphlpsvc) must be running. Hardened images that disable them break ticket retrieval.

Step 1: Enable Entra Kerberos on the storage account

Create a storage account and file share (this example uses fxlogics and a share called premium). Then turn on Entra Kerberos. In the portal: storage account, File shares, Identity-based access, Microsoft Entra Kerberos, Set up. Or from PowerShell:

Set-AzStorageAccount -ResourceGroupName rg-avd-lab `
  -StorageAccountName fxlogics `
  -EnableAzureActiveDirectoryKerberosForFile $true

# Hybrid identities only, optional: add your AD domain so you can set ACLs in File Explorer
# -ActiveDirectoryDomainName contoso.com -ActiveDirectoryDomainGuid <guid from Get-ADDomain>

Enabling the feature creates an app registration named [Storage Account] fxlogics.file.core.windows.net. Three follow-up tasks live on that app:

1. Grant admin consent. Entra ID, App registrations, All applications, select the storage app, API permissions, Grant admin consent for openid, profile, and User.Read.
2. Exclude it from MFA. Any Conditional Access policy that requires MFA for all cloud apps must exclude the storage app. The ticket request happens silently at logon and has no way to prompt.
3. Cloud-only users: add the kdc_enable_cloud_group_sids tag to the app manifest so cloud group SIDs appear in the ticket. Skip it and permissions based on cloud groups fail.

Step 2: Assign share-level and NTFS permissions

Permissions work in two layers, same as any SMB share.

• Share level (Azure RBAC): assign Storage File Data SMB Share Contributor to the AVD users group, and Storage File Data SMB Share Elevated Contributor to admins who set ACLs. Or set a default share-level permission for all authenticated identities.
• Directory and file level (NTFS): apply the FSLogix recommended ACLs so each user can create their own folder but cannot read anyone else's. For hybrid identities, set ACLs from a machine with line of sight to a domain controller (icacls or File Explorer). For cloud-only identities, use the Manage access option on the file share in the portal.

# Recommended FSLogix ACLs (run from a machine that can resolve the groups)
icacls \\fxlogics.file.core.windows.net\premium /inheritance:r
icacls \\fxlogics.file.core.windows.net\premium /grant "CREATOR OWNER:(OI)(CI)(IO)(M)"
icacls \\fxlogics.file.core.windows.net\premium /grant "CONTOSO\AVD-Users:(M)"
icacls \\fxlogics.file.core.windows.net\premium /grant "CONTOSO\AVD-Admins:(OI)(CI)(F)"

Note that the users group gets Modify on this folder only. CREATOR OWNER gives each user full control of the folder they create. That combination stops users from browsing other profiles.

Step 3: The session host script, line by line

Run this on every session host, elevated, or bake it into your golden image. You can also push the same values with Intune Settings Catalog or Group Policy. Replace the storage path with yours.

# --- Entra Kerberos: CRITICAL for cloud Kerberos authentication ---
reg add "HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters" /v CloudKerberosTicketRetrievalEnabled /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\AzureADAccount" /v LoadCredKeyFromProfile /t REG_DWORD /d 1 /f

# --- FSLogix profile container settings ---
$VHDLocations = "\\fxlogics.file.core.windows.net\premium"
New-Item -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Force

New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name Enabled -PropertyType dword -Value 1 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name DeleteLocalProfileWhenVHDShouldApply -PropertyType dword -Value 1 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name FlipFlopProfileDirectoryName -PropertyType dword -Value 1 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name LockedRetryCount -PropertyType dword -Value 3 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name LockedRetryInterval -PropertyType dword -Value 15 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name ProfileType -PropertyType dword -Value 0 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name ReAttachIntervalSeconds -PropertyType dword -Value 15 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name ReAttachRetryCount -PropertyType dword -Value 3 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name SizeInMBs -PropertyType dword -Value 30000 -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name VHDLocations -PropertyType string -Value $VHDLocations -Force
New-ItemProperty -Path HKLM:\SOFTWARE\FSLogix\Profiles\ -Name VolumeType -PropertyType string -Value vhdx -Force

# Reboot (or gpupdate) so the Kerberos change takes effect
Restart-Computer

The two lines that matter most

Setting	What it does	What breaks without it
CloudKerberosTicketRetrievalEnabled = 1	Tells Windows to request a cloud Kerberos TGT from Entra ID during logon.	No ticket for the storage account. FSLogix cannot reach the share, the user gets a local or temporary profile, and the FSLogix log shows access denied.
LoadCredKeyFromProfile = 1	Loads the Entra credential key from the roaming profile being attached instead of the local machine.	Profiles work on the first host, then fail or misbehave when the user lands on a different host in a pooled pool.

The FSLogix values

Value	Setting in script	Why
Enabled	1	Turns profile containers on. Nothing else matters if this is 0.
VHDLocations	UNC path	Where VHDX files live. Use the FQDN, not an IP, or Kerberos cannot match the service principal.
VolumeType	vhdx	Default is vhd. VHDX supports larger sizes and is more resilient. Always set it.
SizeInMBs	30000	Max container size (about 30 GB). Disks are dynamic, so you pay for used space on standard, provisioned space on premium. You can grow it later, never shrink it.
DeleteLocalProfileWhenVHDShouldApply	1	Deletes an existing local profile so the container wins. Without it, a user who signed in before FSLogix was configured keeps the local profile.
FlipFlopProfileDirectoryName	1	Names folders username_SID instead of SID_username. Easier for admins to find a user's profile.
ProfileType	0	Normal read-write behavior. One active session per profile.
LockedRetryCount / Interval	3 / 15	Defaults are 12 retries every 5 seconds. This fails a locked-profile logon in about 45 seconds instead of 60.
ReAttachRetryCount / IntervalSeconds	3 / 15	Defaults are 60 retries every 10 seconds. Fewer retries mean a faster, clearer failure if storage drops mid-session.

Step 4: Validate

Sign in as a test user who has never logged on to the pool. Then check from inside the session:

# Should list a ticket for cifs/fxlogics.file.core.windows.net
klist get cifs/fxlogics.file.core.windows.net

# Should show the cloud TGT
klist cloud_debug

# FSLogix status and logs
& "C:\Program Files\FSLogix\Apps\frx.exe" list-redirects
Get-Content "C:\ProgramData\FSLogix\Logs\Profile\Profile-$(Get-Date -f yyyyMMdd).log" -Tail 40

In the storage account, you should see a folder named like jdoe_S-1-12-1-.... Cloud-only SIDs start with S-1-12-1, synced hybrid users carry their on-premises SID.

Common failure points

Symptom	Likely cause	Fix
Error 1327 mapping the share	MFA Conditional Access applies to the storage app	Exclude [Storage Account] name.file.core.windows.net
Error 1326 over a private endpoint	Private link FQDN not on the storage app	Add the privatelink FQDN to the app registration per the troubleshooting guide
Temporary profile, no ticket in klist	Registry value missing or host not rebooted	Set CloudKerberosTicketRetrievalEnabled, restart
Works on host 1, fails on host 2	LoadCredKeyFromProfile missing	Add it to every host or the image
Access denied with valid ticket	No share-level RBAC role or wrong NTFS ACLs	Assign SMB Share Contributor, reapply ACLs
Cloud group permissions ignored	Manifest tag missing	Add kdc_enable_cloud_group_sids
Hosts also can't reach an AD DS storage account	Cloud Kerberos takes precedence	Add host-to-realm mappings with ksetup /addhosttorealmmap

Intune instead of a script

For Entra joined hosts, Intune is the natural management plane. Use the Settings Catalog for Kerberos/CloudKerberosTicketRetrievalEnabled. Microsoft notes that the OMA-URI method doesn't work on AVD multi-session devices. FSLogix settings are also in the Settings Catalog under FSLogix. The registry script is still useful for images and labs, and it shows you exactly what the policy writes.

What AZ-140 asks about this

The exam treats this as part of the user environment and identity domains. Know which storage identity source fits which host join type: AD DS for domain-joined hosts, Entra Kerberos for Entra joined hosts, and that one storage account takes only one. Know the client-side requirement (cloud Kerberos ticket retrieval), the MFA exclusion on the storage app, the two-layer permission model, and that hybrid identities still need a DC-connected machine to set NTFS ACLs while sign-in itself does not.

Resources

• Store FSLogix profile containers on Azure Files using Microsoft Entra ID – Microsoft Learn
• Enable Microsoft Entra Kerberos authentication on Azure Files
• FSLogix configuration setting reference
• Configure SMB storage permissions for FSLogix
• AZ-140 study guide – skills measured

---

Checked against Microsoft Learn documentation as of October 2026. Prerequisite OS builds for cloud-only identities change often, so confirm them before building an image.