What you need to know
DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.
Potentially affected
This guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.
DSE recommendation
DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.
Source facts
Microsoft distinguishes Kerberos authentication with krb5, integrity checking with krb5i, and encryption of the complete NFS conversation with krb5p. For NFS, the security mode is specified in the volume export-policy rule and in the client’s sec mount option. Microsoft Learn
Applicability
This guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.
DSE recommendation
DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved. Record the selected mode beside the export-policy rule and client mount configuration. Ask the application owner to include representative workload behavior in the test plan, especially when selecting the mode with the additional encryption work. Keep protocol and mode choices explicit in the handoff to the Linux and storage teams.
Verification
Inspect the active client mount and corresponding export policy, then compare both with the agreed mode. Perform the authorized file-access test and record the workload observations. Investigate a mismatch or performance concern before changing the policy, and preserve the chosen protection requirement as the acceptance criterion throughout the review.
Official references
Review the official source
Understand Kerberos in Azure NetApp Files | Microsoft Learn · Verified September 17, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE