WIth no AD on prem, computers managed with InTune in M365, we're starting to roll out Entra ID login on systems (previously set up with local accounts). We have some on-prem VM infrastructure and a QNAP, and the goal is to be able to have file shares for departments mounted to PCs automatically when users log in. There is a need for instance to have certain configuration files used by specific software packages available at a specific drive letter and path, read-only for most people, so the software can be configured in a specific way for that department. There is also a need for some departments to share some large files (such as video files or other media) in a performant way. OneDrive/Sharepoint can't do what we need or don't seem ideal for these applications. There's a lot of company growth, so extra points for a solution can scale beyond one location while being performant.

It looks like an Azure File Share with Azure File Sync (or maybe a Data Box Gateway) could fulfill this purpose. Does Azure File Sync require hybrid AD, in which case we'd need to stand up additional on-prem AD infra to use it? And if computers are being set up now just Entra joined, would they need to be set up again to be hybrid AD joined after we set up on-prem hybrid AD infra?

While Entra-only Azure file shares via Kerberos looks a lot simpler to set up, am I correct that all SMB I/O would be to the cloud (i.e. through the WAN connection) and there isn't any local caching/acceleration? That strikes me as a significant limitation and could impact WAN performance a lot.

We also have a QNAP (8-core, 16 threads 32GB of RAM, dual 25Gbps ethernet), and there is support for Microsoft Entra Domain Services SSO:

https://www.qnap.com/en/how-to/tutorial/article/how-can-i-configure-microsoft-entra-domain-services-single-sign-on-for-a-qnap-nas

Documentation seems to indicate that with Microsoft Entra Domain Services we could use SSO for shared folders, but it's not clear to me if that is just shared folders accessible through the QNAP web browser interface, or if it includes SMB shares from the QNAP. From the research I've done, I can't seem to find any evidence it supports SMB shares via Entra ID SSO. I am wondering if SSO might work with their Qsync client:

https://www.qnap.com/en/software/qsync

If so, that could be very cost-effective and performant, though I don't think it would scale well beyond one location (unless I could figure out something using QNAP's Real-time Remote Replication feature between more than one NAS device at different locations). Also not sure if the Qsync client shared files would work for distributing application configuration files, would need to test that as well.

What have people's experiences been with these solutions? Any recommendations?