Unable to assign permissions to hybrid groups using icacls with a system not joined to the domain

[Bigmouse1976]

Hello there,

I have setup a test environment to try to have an Azure Files storage account + Azure Virtual Desktop Azure AD Joined Session Hosts environment. I am aware this is currently in preview, and I have gone through the steps of this document here to setup and test this feature: (https://docs.microsoft.com/en-us/azure/virtual-desktop/create-profile-container-azure-ad)

However I ran into a strange behavior once it was time to assign directory level permissions. In the documentation I noticed the following:

Here I can see that I can use a device that is Azure AD joined but NOT domain joined to the same DC that is used for Kerberos authentication, if I wanted to assign permissions using icacls.

My understanding of this is that I can assign permissions to users and groups using icacls without having the system domain joined. With this in mind, I have tried to setup permissions from the Azure AD Joined Session Host itself, and I managed to get hybrid users to work as expected as shown here(Z: is the mapped storage account from Azure Files):

However this does not work when using Hybrid Groups:

I have also tried with ObjectID instead of group name, and group SID from the AD, but it doesn't work.

Is it possible to assign directory level permissions using icacls to hybrid groups from a system that is Azure AD joined but not domain joined? If so, please clarify if I'm missing some extra steps to do so, as this is not clear enough in the documentation.

To clarify, both user and group have been synchronized from the same DC that is used for authentication using AD Connect.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 25ccb59e-98fc-0382-030a-c3805494afd2
• Version Independent ID: ed04168c-41ba-e6c6-fe83-f6e5c760ba5a
• Content: Create an Azure file share with Azure Active Directory (preview)
• Content Source: articles/virtual-desktop/create-profile-container-azure-ad.md
• Service: virtual-desktop
• GitHub Login: @Heidilohr
• Microsoft Alias: helohr

[SreejaBhattacharya-MSFT]

Thanks for reaching out. We are looking into this.

[SreejaBhattacharya-MSFT]

Hi @Heidilohr , could you please take a look at this?

[dknappettmsft]

Sorry for the late response, but this article has changed a lot since it was written and the prerequisites are now covered by the Azure Files documentation, as it's for that feature: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-azure-active-directory-enable#prerequisites

#please-close