Azure Files SMB Access with Windows AD allows you to access file shares in Azure with NTFS access control.  By default, that access won’t extend to an on-prem network over VPN or Express Route.  This video shows how to extend access to an Azure Files share with Windows AD to an on-premises network using Private Endpoints.