# Primary source map

Read-only documentation review: **7 November 2026**. The workshop's architecture and exercise choices are its own teaching design. Current Microsoft documentation supports the service behavior below; live rehearsal must still establish the actual image, rates, negotiated connection values and emitted diagnostics. Links are not claims that the lab has passed.

| Source | What it supports | Workshop use |
|---|---|---|
| [AD DS overview](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-overview) | AD DS identities and Azure Files identity model | Disposable AD DS domain; distinguish other identity sources |
| [Enable AD DS authentication](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable) | Storage-representing AD object, domain properties, manual alternative and domain-joined Windows PowerShell workflow | Two reviewed Terraform phases, manual guest AD registration, exact CIFS principal |
| [Share-level permissions](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-assign-share-level-permissions) | Default permission without synchronization; default scope; Reader/Contributor/Elevated Contributor capabilities | Account-wide ShareGate exercise; separate control storage account |
| [Directory/file permissions](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-configure-file-level-permissions) | Share and Windows ACL intersection, AD DS Explorer/icacls support, broad root defaults | LabAdmin-owned protected namespace; per-folder fault; explicit scope boundaries |
| [SMB Azure Files](https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol) | SMB versions, authentication and independent ticket/channel encryption controls | Kerberos-only, AES256, SMB3.1.1 and AES-256-GCM baseline |
| [AES256 troubleshooting](https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files/security/files-troubleshoot-encryption) | AD encryption/key material must agree with storage settings; Windows RC4 transition | Fresh ticket proof rather than configuration-only claims |
| [Private endpoints](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-endpoints) | File subresource private endpoint and private DNS integration for classic Microsoft.Storage shares | Disabled public network path and normal storage hostnames |
| [Azure Files DNS forwarding](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-dns) | Normal hostname resolution through a private zone and DNS forwarding | AD DNS forwarding and client-side resolution checks |
| [StorageFileLogs schema](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/storagefilelogs) | Actual SMB-specific session, identity and status columns | Preserve StatusCode and SmbStatusCode separately; observed SMB StatusCode may be a signed NTSTATUS, so do not assume it is HTTP |
| [Logs API authentication](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/access-api), [query request format](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/request-format) | Official .azure.com query endpoint, .io token audience, JSON query/timespan body and tabular response | Core az rest avoids the installed log-analytics extension; normalize the sole returned table without inventing empty results |
| [NTSTATUS values](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) | 0xC0000022 means STATUS_ACCESS_DENIED | The observed signed SMB StatusCode -1073741790 maps to this value; retain an empty SmbStatusCode exactly as emitted |
| [SMB connectivity troubleshooting](https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files/connectivity/files-troubleshoot-smb-connectivity) | Separate connectivity/authentication diagnostics | Avoid counting management/network errors as intended faults |
| [Bastion deployment and Developer SKU](https://learn.microsoft.com/en-us/azure/bastion/quickstart-host-portal) | Private browser guest connection prerequisites and SKU behavior | Genuine Windows captures; regional/tenant availability checked before deployment |
| [Azure Files monitoring](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-monitoring) | File-service diagnostic collection and monitoring concepts | Dedicated workspace; real event evidence after bounded ingestion wait |
| [Az.Accounts 5.5.3](https://www.powershellgallery.com/packages/Az.Accounts/5.5.3), [Az.Storage 9.7.2](https://www.powershellgallery.com/packages/Az.Storage/9.7.2) | Both support Windows PowerShell 5.1; Storage requires Accounts at least 5.5.2 | Exact module versions, package hashes and Microsoft entry-point signature checks |
| [Get-AzStorageAccountKey](https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstorageaccountkey) | ListKerbKey returns the storage identity setup keys | Selected scoped managed identity verifies the two fresh Kerb1 values before AD registration |
| [Azure CLI 2.88 storage-account implementation](https://github.com/Azure/azure-cli/blob/azure-cli-2.88.0/src/azure-cli/azure/cli/command_modules/storage/operations/account.py) | SAM/type are applied inside the enable-files-adds branch, which requires the complete domain tuple | Guarded helper preserves reviewed modeled values and default share permission, then checks actual readback |
| [Task security contexts](https://learn.microsoft.com/en-us/windows/win32/taskschd/security-contexts-for-running-tasks), [Log on as a batch job](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job) | Password tasks require the batch-logon right; registration alone is not execution evidence | Client-only additive grants to the three owned actors, actual principal readback, fresh LUID and current-run exit-zero checks |
| [Security event 4769](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4769) | SPN-unknown auditing requires the KdcExtraLogLevel 0x01 flag; the event's Status is a DC observation | Preserve existing registry bits when enabling the flag; collect actual failure events after a new request, without relabeling local klist status as DC 0x7 |

## Implementation distinctions

- The helper uses pinned Azure PowerShell modules for managed-identity authentication and fresh key verification, then Microsoft's supported manual AD-cmdlet registration route. It does not depend on AzFilesHybrid.
- Manual registration needs protected key handling. The setup key is not an SMB credential for Reader, Writer or Outsider, and no public artifact may contain it.
- A configurable protocol/encryption value is distinct from a fresh negotiated connection. AD account/key state, the exact CIFS ticket and the channel cipher are separate observations.
- Storage logs only show requests that reach the service. Do not invent a denial row for a ticket request that failed at the KDC.
- A screenshot and a successful local unit test do not substitute for the observed actor/operation, fault and cleanup acceptance checks.

The current rate lookup and six-hour forecast belong in private preflight evidence and an allowlisted public summary. A future run must refresh rates; a rate in this article is not a lasting price guarantee.