How to give file permissions to AzureAD user on windows 10?

Question

I'm on a Win10 workstation that's joined to AzureAD like this. How can I grant file permissions to an AzureAD user? When I try to use the File Properties > Security > Edit > Add dialog I can't find/select any users on the AzureAD domain, including the currently logged in user. Entering AzureAD\FirstLast and clicking Check Names gives this:

In general this sort of thing seems to be a problem with AzureAD-joined accounts: windows appears to not know about them, e.g. when adding them to SQL Server. Or perhaps I just don't know the right way to refer to these users?

Solution 1

Thanks to Arni on this thread for the answer:

You can try the following command line. After adding an ACL entry, the Security dialog will display the user and you can change the permissions there.

CACLS "C:\YourPath" /T /E /G AzureAD\FirstLast:C

Solution 2

My cheating way: Add the Azure user to a unique local group "net localgroup groupname domain\user /add" Then give local group permissions

Comments

[David Diez]

Being Administrator on my account the output on the console says Access is denied to: CACLS "C:" /T /E /G AzureAD\UserName:F

[David Diez]

With ICACLS "C:" /grant :r AzureAD\UserName:F also fails...

[Rory]

@DavidDiez are you running the console window with elevated rights (as Administrator)?

[David Diez]

@@Rory Yes, I am running the console with elevated rights

[mpowrie]

cacls is now deprecated. The equivalent icacls command is: icacls "C:\yourpath" /t /grant azuread\FirstLast:M

[Christian Davén]

... but first, create the local group with: net localgroup GroupName /add

[Gerneio]

+1 Just had to say this worked perfectly, when other options failed. Just used the icacls variant instead though