Azure Files Entra Kerberos Failing: Missing CIFS SPN Causes Repeated SMB Login Prompts

We’re trying to use Azure Files with Microsoft Entra Kerberos for cloud-only Entra identities. The storage account reports DirectoryServiceOptions: AADKERB, and the Entra-joined Windows client has AzureAdPrt = YES, CloudTgt = YES, Cloud Kerberos enabled, a Cloud Referral TGT, working DNS, and TCP 445 connectivity. However, users are still being prompted to sign in repeatedly when accessing the SMB share, often getting “wrong password,” “having trouble connecting to the SMB share,” and similar authentication errors. With Entra Kerberos working correctly, users should not be repeatedly prompted for separate SMB credentials.

The problem is that klist get cifs/.file.core.windows.net still fails with 0x35 / 0x80090303 - The specified target is unknown or unreachable. The autogenerated storage-account service principal exists, but its ServicePrincipalNames property is empty. We already disabled/re-enabled Entra Kerberos, recreated the generated app, granted admin consent, and added the cloud-only group tag. Is there a supported way to force Azure Storage to reprovision the missing CIFS SPN, or does this require Microsoft backend repair?