# Specify the NFS Kerberos protection mode in an Azure NetApp Files mount review

> DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:36+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.

## Potentially affected

This guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.

## DSE recommendation

DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.

## Article

## Source facts

Microsoft distinguishes Kerberos authentication with krb5, integrity checking with krb5i, and encryption of the complete NFS conversation with krb5p. For NFS, the security mode is specified in the volume export-policy rule and in the client’s sec mount option. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos)

## Applicability

This guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.

## DSE recommendation

DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved. Record the selected mode beside the export-policy rule and client mount configuration. Ask the application owner to include representative workload behavior in the test plan, especially when selecting the mode with the additional encryption work. Keep protocol and mode choices explicit in the handoff to the Linux and storage teams.

## Verification

Inspect the active client mount and corresponding export policy, then compare both with the agreed mode. Perform the authorized file-access test and record the workload observations. Investigate a mismatch or performance concern before changing the policy, and preserve the chosen protection requirement as the acceptance criterion throughout the review.

## Official references

- [Microsoft: Understand Kerberos in Azure NetApp Files | Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos)

## Primary reference

- Name: Understand Kerberos in Azure NetApp Files | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Specify the NFS Kerberos protection mode in an Azure NetApp Files mount review,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.