Deploy SMB over QUIC only after identity, port, and fallback testing

Source facts: encryption, transport selection, and identity are separate

Microsoft’s SMB over QUIC documentation describes a TLS 1.3-protected tunnel that carries SMB over UDP 443 instead of TCP 445. Supported servers include Windows Server 2025 and Windows Server 2022 Datacenter: Azure Edition, with Windows 11 clients. The file-server administrator must opt in; a client cannot force a server that has not enabled the feature.

Transport selection can hide a testing error. Windows SMB clients use TCP by default and try QUIC after TCP fails unless the connection explicitly requires QUIC with NET USE /TRANSPORT:QUIC or New-SmbMapping -TransportType QUIC. Microsoft says to permit inbound UDP 443 for the QUIC service and not expose inbound TCP 445 on the internet-facing file server.

The server certificate needs Server Authentication, an appropriate key and signature, a private key, and a DNS subject alternative name for each fully qualified name clients use. Microsoft warns against IP-address SANs: they can force NTLM and do not work as the server name through Azure IaaS NAT in the described scenario. The published name must resolve correctly. Certificate renewal produces a new thumbprint and requires the SMB server certificate mapping to be updated.

An external client normally lacks direct domain-controller access. Microsoft therefore describes NTLMv2 fallback inside the encrypted tunnel, while recommending Kerberos and the supported KDC Proxy design. SMB over QUIC itself uses UDP 443, while the KDC Proxy service is reached over HTTPS/TCP 443; the firewall and publishing design must account for both when KDC Proxy is used. The file server still needs access to a domain controller. The page also cautions that current DFS namespace behavior can return internal names that external clients cannot reach.

DSE recommendation: prove the exact path before calling it remote file access

1. Draw both paths. Document the public FQDN, public and translated addresses, UDP 443 rules for SMB over QUIC, HTTPS/TCP 443 rules for KDC Proxy when used, server interface, share name, internal DNS, domain-controller path, certificate issuer, and management route. Show what must remain unreachable from the internet, especially TCP 445.
2. Validate names and certificates. Confirm that every approved client name is in the certificate SAN and resolves to the intended endpoint from internal and external networks. Record issuer trust, private-key protection, mapping thumbprint, expiration, renewal owner, and monitoring thresholds.
3. Force the pilot transport. Test with a command that requires QUIC, then confirm client connectivity event evidence rather than inferring the transport from a successful file open. Test again with the ordinary UNC behavior so the team understands when TCP is preferred and when QUIC is attempted.
4. Prove identity. Verify the expected user, group authorization, Kerberos ticket behavior when KDC Proxy is designed, and any NTLM event that remains. Test expired password, locked account, removed group membership, and a client that should be denied.
5. Exercise file semantics. Test create, read, modify, rename, delete, locks, large files, interrupted transfers, reconnect, roaming between networks, latency, and any line-of-business application that opens files directly. Confirm audit, malware protection, backup, quota, and recovery behavior at the server.
6. Rehearse renewal and failure. Replace a pilot certificate, update the thumbprint mapping, and verify continuity. Simulate blocked UDP, unavailable KDC Proxy, DNS error, and revoked access; monitoring should distinguish transport, certificate, identity, and storage failures.

Use a named pilot population and restrict access to the smallest justified user and device set. Track forced-QUIC success, authentication method, certificate days remaining, blocked access, transfer failure, latency, NTLM exceptions, and help-desk contacts. Keep a tested disable procedure for the server and clients. SMB over QUIC can remove a broad VPN dependency for a defined file-service use case, but it does not remove the need for endpoint security, file authorization, backup, or an explicit identity design.

Approve production only when operations can answer four questions from evidence: which transport carried the session, which identity protocol authenticated it, which certificate and name protected it, and which access rule authorized the share. Add those checks to incident intake so a remote-file complaint reaches the right owner without guesswork.

Official references

• Microsoft Learn, SMB over QUIC, July 24, 2025; reviewed August 11, 2026.