I'm on a Win10 workstation that's joined to AzureAD like this. How can I grant file permissions to an AzureAD user? When I try to use the File Properties > Security > Edit > Add dialog I can't find/select any users on the AzureAD domain, including the currently logged in user. Entering AzureAD\FirstLast and clicking Check Names gives this:

error message

In general this sort of thing seems to be a problem with AzureAD-joined accounts: windows appears to not know about them, e.g. when adding them to SQL Server. Or perhaps I just don't know the right way to refer to these users?


Thanks to Arni on this thread for the answer:

You can try the following command line. After adding an ACL entry, the Security dialog will display the user and you can change the permissions there.

CACLS "C:\YourPath" /T /E /G AzureAD\FirstLast:C
  • Being Administrator on my account the output on the console says Access is denied to: CACLS "C:" /T /E /G AzureAD\UserName:F – David Diez Feb 28 '17 at 15:31
  • With ICACLS "C:" /grant :r AzureAD\UserName:F also fails... – David Diez Feb 28 '17 at 15:44
  • 1
    @DavidDiez are you running the console window with elevated rights (as Administrator)? – Rory Mar 3 '17 at 20:25
  • @@Rory Yes, I am running the console with elevated rights – David Diez Mar 6 '17 at 12:28
  • 3
    cacls is now deprecated. The equivalent icacls command is: icacls "C:\yourpath" /t /grant azuread\FirstLast:M – mpowrie Aug 11 '19 at 3:42

My cheating way: Add the Azure user to a unique local group "net localgroup groupname domain\user /add" Then give local group permissions

  • ... but first, create the local group with: net localgroup GroupName /add – Christian Davén Dec 12 '19 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.