How to Assign Share Permissions to an Entra ID Group

So I have a client with a Windows Server in Azure and it is Entra ID joined only. I needed to grant permissions to a share on the server using Entra ID accounts. There doesn’t seem to be a way to do this through the GUI, but this powershell command works fine to assign individual user accounts:

Grant-SmbShareAccess -Name MyShare -AccountName “AzureAD\myaccount@mydomain.com” -AccessRight Full

And you can use this to check the assignment: Get-SmbShareAccess  -Name MyShare

To take this a step further I needed to assign the share permissions to an Entra ID group. Even though there are examples showing the above command used to assign a group, I just got this error:

Microsoft’s stance in the past has been to assign a local group that contains a domain group and in this case that strategy does work, but I had to use the Entra ID SID:

Add-LocalGroupMember “LocalGroupName” -Member S-1-12-1-3660688888-1123426609-847069585-X1234567

I tried using the SID in the Grant-SmbShareAccess command but it was a no go.

I’d be really interested in knowing if anyone has found a way to assign share permissions directly to an Entra ID group.

EDIT: 10/11/24 – I ran into a snag with this setup. I could not get write permissions to a share using an Azure AD Group like this. In the end I had to use the Grant-SmbShareAccess with an Azure AD User account to get Write permissions.