{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/", "slug": "dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup", "url": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/" }, "title": "Apply the root-domain step before Azure Files cloud-trust child-domain setup", "summary": "Review the documented multi-domain sequence before retrying a Trusted Domain Object creation error.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:54+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 213, "potentially_affected": "Multi-domain AD forests configuring the documented Azure Files cloud trust with Microsoft Entra ID.", "dse_recommendation": "Identify the forest root and child domains, then verify the documented SetupCloudTrust sequence before retrying the operation.", "primary_source": { "name": "Configure Cloud Trust between AD DS and Entra ID | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-cloud-trust", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For a multi-domain forest, Microsoft’s Azure Files cloud-trust guidance says to run the root-domain operation with SetupCloudTrust, then run the child-domain operation without that parameter. It identifies this sequence as a way to avoid LsaCreateTrustedDomainEx error 0x549 on a child domain.

\n

The guidance supports forest trusts for Azure Files, not external trusts. Its hybrid-user scenario uses on-premises AD identities synchronized into Entra ID. Microsoft Learn.

\n

Applicability

\n

Use this narrow sequencing check within an otherwise approved cloud-trust deployment. Review the full source’s client, synchronization, permission, storage, and authentication prerequisites separately; this article is not a complete trust-creation procedure.

\n

DSE recommendation

\n

DSE recommends recording the forest-root domain, each intended child domain, and the current Kerberos/trust configuration before retrying a failed command. Have the directory owner verify which operation already succeeded. Keep privileged credentials out of command transcripts and use the established identity-change approval process.

\n

Verification

\n

In a representative authorized test, inspect the resulting cloud-trust configuration after the root and child steps. Test the intended user’s Azure Files authentication and access, and preserve sanitized error codes and domain scope. Do not use disappearance of the creation error as the only evidence that the complete file-access path works.

\n

Official references

\n

Microsoft Learn: Configure Cloud Trust between AD DS and Entra ID. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor a multi-domain forest, Microsoft’s Azure Files cloud-trust guidance says to run the root-domain operation with SetupCloudTrust, then run the child-domain operation without that parameter. It identifies this sequence as a way to avoid LsaCreateTrustedDomainEx error 0x549 on a child domain.\nThe guidance supports forest trusts for Azure Files, not external trusts. Its hybrid-user scenario uses on-premises AD identities synchronized into Entra ID. Microsoft Learn.\nApplicability\nUse this narrow sequencing check within an otherwise approved cloud-trust deployment. Review the full source’s client, synchronization, permission, storage, and authentication prerequisites separately; this article is not a complete trust-creation procedure.\nDSE recommendation\nDSE recommends recording the forest-root domain, each intended child domain, and the current Kerberos/trust configuration before retrying a failed command. Have the directory owner verify which operation already succeeded. Keep privileged credentials out of command transcripts and use the established identity-change approval process.\nVerification\nIn a representative authorized test, inspect the resulting cloud-trust configuration after the root and child steps. Test the intended user’s Azure Files authentication and access, and preserve sanitized error codes and domain scope. Do not use disappearance of the creation error as the only evidence that the complete file-access path works.\nOfficial references\nMicrosoft Learn: Configure Cloud Trust between AD DS and Entra ID. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor a multi-domain forest, Microsoft’s Azure Files cloud-trust guidance says to run the root-domain operation with SetupCloudTrust, then run the child-domain operation without that parameter. It identifies this sequence as a way to avoid LsaCreateTrustedDomainEx error 0x549 on a child domain.\n\nThe guidance supports forest trusts for Azure Files, not external trusts. Its hybrid-user scenario uses on-premises AD identities synchronized into Entra ID. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-cloud-trust).\n\n## Applicability\n\nUse this narrow sequencing check within an otherwise approved cloud-trust deployment. Review the full source’s client, synchronization, permission, storage, and authentication prerequisites separately; this article is not a complete trust-creation procedure.\n\n## DSE recommendation\n\nDSE recommends recording the forest-root domain, each intended child domain, and the current Kerberos/trust configuration before retrying a failed command. Have the directory owner verify which operation already succeeded. Keep privileged credentials out of command transcripts and use the established identity-change approval process.\n\n## Verification\n\nIn a representative authorized test, inspect the resulting cloud-trust configuration after the root and child steps. Test the intended user’s Azure Files authentication and access, and preserve sanitized error codes and domain scope. Do not use disappearance of the creation error as the only evidence that the complete file-access path works.\n\n## Official references\n\n[Microsoft Learn: Configure Cloud Trust between AD DS and Entra ID](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-cloud-trust). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/", "url": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Apply the root-domain step before Azure Files cloud-trust child-domain setup", "item": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/", "url": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/", "headline": "Apply the root-domain step before Azure Files cloud-trust child-domain setup", "description": "Review the documented multi-domain sequence before retrying a Trusted Domain Object creation error.", "abstract": "Review the documented multi-domain sequence before retrying a Trusted Domain Object creation error.", "articleBody": "Source facts\nFor a multi-domain forest, Microsoft’s Azure Files cloud-trust guidance says to run the root-domain operation with SetupCloudTrust, then run the child-domain operation without that parameter. It identifies this sequence as a way to avoid LsaCreateTrustedDomainEx error 0x549 on a child domain.\nThe guidance supports forest trusts for Azure Files, not external trusts. Its hybrid-user scenario uses on-premises AD identities synchronized into Entra ID. Microsoft Learn.\nApplicability\nUse this narrow sequencing check within an otherwise approved cloud-trust deployment. Review the full source’s client, synchronization, permission, storage, and authentication prerequisites separately; this article is not a complete trust-creation procedure.\nDSE recommendation\nDSE recommends recording the forest-root domain, each intended child domain, and the current Kerberos/trust configuration before retrying a failed command. Have the directory owner verify which operation already succeeded. Keep privileged credentials out of command transcripts and use the established identity-change approval process.\nVerification\nIn a representative authorized test, inspect the resulting cloud-trust configuration after the root and child steps. Test the intended user’s Azure Files authentication and access, and preserve sanitized error codes and domain scope. Do not use disappearance of the creation error as the only evidence that the complete file-access path works.\nOfficial references\nMicrosoft Learn: Configure Cloud Trust between AD DS and Entra ID. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:54+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-182-apply-the-root-domain-step-before-azure-files-cloud-trust-child-domain-setup/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Apply the root-domain step before Azure Files cloud-trust child-domain setup" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 213, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Cloud Trust between AD DS and Entra ID | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-hybrid-cloud-trust" } } ] } }