https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable#option-one-recommended-use-azfileshybrid-powershell-module The link describes that an on-prem account sync'd to AD must be used to sign in - CloudAdmin1 is cloud-only. It also states that the on-prem AD account must have Owner or Contributer rights over the Azure storage account - there is no mention of Admin1 being granted those roles unless you count the requirement that Admin1 is to be granted permission to manage Workspaces. So neither is fully correct. On the basis that the account must be a sync'd on-prem account and not a cloud account though it must be Admin1 in my opinion.

CloudAdmin1 has the proper rights to enable AD DS authentication but not enough rights to create an object in AD. Admin 1 has the rights to create the object in AD but not enough right to enable AD DS authetication. Quote from: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable "-Install and execute the module in a device that is domain joined to on-premises AD DS with AD DS credentials that have permissions to create a service logon account or a computer account in the target AD. -Run the script using an on-premises AD DS credential that is synced to your Azure AD. The on-premises AD DS credential must have either Owner or Contributor Azure role on the storage account." So the order should be: 1. Sign in to VM1 as Admin1. 2. Install AZFilesHybrid PS module 3. Run Join-AzStorageAccount 4. Create file share and configure share permissions But in order for that to work Admin1 needs to receive the proper rights on the storage account.