I'm on a Win10 workstation that's joined to AzureAD like this. How can I grant file permissions to an AzureAD user? When I try to use the File Properties > Security > Edit > Add dialog I can't find/select any users on the AzureAD domain, including the currently logged in user. Entering AzureAD\FirstLast and clicking Check Names gives this:

error message

In general this sort of thing seems to be a problem with AzureAD-joined accounts: windows appears to not know about them, e.g. when adding them to SQL Server. Or perhaps I just don't know the right way to refer to these users?


Thanks to Arni on this thread for the answer:

You can try the following command line. After adding an ACL entry, the Security dialog will display the user and you can change the permissions there.

CACLS "C:\YourPath" /T /E /G AzureAD\FirstLast:C
  • Being Administrator on my account the output on the console says Access is denied to: CACLS "C:" /T /E /G AzureAD\UserName:F – David Diez Feb 28 '17 at 15:31
  • With ICACLS "C:" /grant :r AzureAD\UserName:F also fails... – David Diez Feb 28 '17 at 15:44
  • @DavidDiez are you running the console window with elevated rights (as Administrator)? – Rory Mar 3 '17 at 20:25
  • @@Rory Yes, I am running the console with elevated rights – David Diez Mar 6 '17 at 12:28

My cheating way: Add the Azure user to a unique local group "net localgroup groupname domain\user /add" Then give local group permissions

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.