Applicable Products
- QTS 5.2.8 (Special Build, Oct. 27, 2025) and later
- QuTS hero h5.2.8 (Special Build, Oct. 27, 2025) and later
Root Cause
Starting with QTS and QuTS hero 5.2.8, NAS devices require authentication tokens issued by Microsoft Entra ID to include the User Principal Name (UPN) claim during login.
If the UPN claim is not enabled for an external user account, the NAS device cannot identify the user, and the login attempt is rejected.
Solution
To allow external users to log in, enable the UPN claim in the Microsoft Entra ID (Azure AD) portal.
- Sign in to Microsoft Azure.
- Click All Services.
- Navigate to Hybrid + multicloud.
- Click Microsoft Entra ID.
- On the side menu, go to Manage > App registrations > All applications.
- Click your registered application.
- On the side menu, go to Manage > Token configuration.
- Click + Add optional claim
The Add optional claim window appears. - Select the token type as ID.
The Claim setting appear. - Locate and select upn.
- Click Add.
Note
Microsoft Entra ID may display a notification stating that some claims (such as family_name, given_name, and upn) require OpenID Connect scopes or Microsoft Graph permissions to be included in the authentication token.
This notification appears because Microsoft Entra ID must grant the application permission to access user profile information before these claims can be issued in tokens. When this notification appears, enable Select Turn on the Microsoft Graph profile permission, and click Add.
- In the Optional claims page, locate the upn claim.
- Click
and then click Edit.
The Edit UPN (ID token) window appears. 
- Under Externally authenticated, enable the switch to Yes.
- Click Save.
Allow up to one minute for synchronization to complete. After the synchronization process finishes, Microsoft Entra ID users should be able to authenticate successfully to the NAS using SSO.
Further Reading
适用产品
- QTS 5.2.8 (Special Build, Oct. 27, 2025) and later
- QuTS hero h5.2.8 (Special Build, Oct. 27, 2025) and later
根本原因
从 QTS 和 QuTS hero 5.2.8 开始，NAS 设备在登录时需要 Microsoft Entra ID 颁发的身份验证令牌包含用户主体名称（UPN）声明。
如果外部用户账户未启用 UPN 声明，NAS 设备将无法识别用户，登录尝试将被拒绝。
解决方案
要允许外部用户登录，请在 Microsoft Entra ID（Azure AD）门户中启用 UPN 声明。
- 登录到Microsoft Azure。
- 点击所有服务。
- 导航到混合 + 多云。
- 点击Microsoft Entra ID。
- 在侧边菜单中，转到管理 > 应用注册 > 所有应用。
- 点击您注册的应用程序。
- 在侧边菜单中，前往管理 > 令牌配置。
- 点击+ 添加可选声明
出现添加可选声明窗口。 - 选择令牌类型为ID。
显示声明设置。 - 找到并选择upn。
- 点击添加。
注意
Microsoft Entra ID 可能会显示通知，指出某些声明（如 family_name、given_name 和 upn）需要 OpenID Connect 范围或 Microsoft Graph 权限才能包含在身份验证令牌中。
此通知出现是因为 Microsoft Entra ID 必须授予应用程序访问用户个人信息的权限，才能在令牌中发布这些声明。当此通知出现时，启用选择打开 Microsoft Graph 个人资料权限，然后点击添加。
- 在可选声明页面中，找到 upn 声明。
- 点击，然后点击编辑。
出现编辑 UPN（ID 令牌）窗口。 - 在外部认证下，启用开关至是。
- 点击保存。
允许较多一分钟的时间完成同步。同步过程完成后，Microsoft Entra ID 用户应该能够使用 SSO 成功认证到 NAS。
进一步阅读
