Network drives (SMB file shares)

For IT administrators. How to give Notate users access to your on-premises Windows file shares (SMB), deliver the configuration through your MDM, and provide the secure network path the app needs, including the extra requirements for Kerberos.

Notate's file manager can show on-premises Windows file shares alongside SharePoint, OneDrive, Teams and email attachments. You provision shares centrally through MDM policy; users do not add servers themselves. Each user enters their own domain credentials the first time they open a share, and Notate authenticates with NTLM (the default) or Kerberos.

Prerequisites

Secure tunnel requirements

SMB (TCP 445) is never exposed directly to the internet, and mobile devices are usually off the corporate network, so the device needs a secure tunnel before it can reach any file server.

On iPhone and iPad, associate the per-app VPN payload with the Notate app's bundle identifier in your MDM, and set it to connect on demand, so opening a share starts the tunnel without the user starting the VPN by hand.

What the tunnel must reach

The tunnel must give the device a route to your internal file servers and DNS and, for Kerberos, to your domain controllers. Split-tunnel configurations must explicitly include those subnets.

* Needed only if your environment requires in-app password changes or LDAP referrals. Most deployments do not.

Why Kerberos needs more than NTLM: with NTLM, the device authenticates over the SMB session on port 445 and the file server checks the response with a domain controller, so the device only needs to reach the file server. With Kerberos, the device first obtains a ticket directly from the KDC on port 88, so the tunnel must also reach the domain controllers and the DNS that locates them.

Policy keys

Deliver these application policies through your MDM. Key names are case-sensitive.

smbConnectionList

Each entry is a path to a share followed by an optional friendly name, separated by a vertical bar: server/share/optional/subpath|Friendly Name. The first segment is the server, as a host name or IP address. The friendly name is what the user sees; without it, Notate shows the path. Separate shares with commas.

fileserver01.example.com/Corporate|Corporate Drive,192.168.4.20/Engineering/Specs|Eng Specs

Configuring Kerberos

Use Kerberos when your file servers require it or NTLM is disabled in your environment. NTLM is the simpler choice and needs none of the steps below.

Step 1: Build your krb5.conf

Create a standard MIT krb5.conf for your realm and KDCs. A minimal file, with example names to replace:

[libdefaults]
    default_realm = EXAMPLE.COM
    dns_lookup_kdc = false
    dns_lookup_realm = false
    rdns = false
    dns_canonicalize_hostname = false
    forwardable = true
    noaddresses = true

[realms]
    EXAMPLE.COM = {
        kdc = dc1.example.com
        admin_server = dc1.example.com
    }

[domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM

Step 2: Encode krb5.conf as Base64

MDM policy values are single-line strings, so the multi-line file must be converted to one Base64 line. On a Mac, run base64 -i krb5.conf in Terminal. On Windows, run [Convert]::ToBase64String([IO.File]::ReadAllBytes("krb5.conf")) in PowerShell. You can also use an online encoder such as base64encode.org with the UTF-8 character set.

Paste the whole result as the value of kerberosConfig, as one line with no breaks or spaces. Re-encode and update the policy whenever krb5.conf changes.

Step 3: Turn Kerberos on

Set useSMBKerberos to true and confirm kerberosConfig is filled in. Check that the tunnel reaches the KDCs on port 88 and DNS on port 53. Once the policy reaches the device, connections use Kerberos.

Delivering the configuration through your MDM

The keys are the same on every MDM; only the format differs.

Microsoft Intune

In an app configuration policy for the managed Notate app, add the keys as name and value pairs. The Intune template already includes allowSMB, smbConnectionList and useSMBKerberos; add kerberosConfig as a string.

<key>allowSMB</key><true />
<key>useSMBKerberos</key><true />
<key>smbConnectionList</key>
<string>fileserver01.example.com/Corporate|Corporate Drive</string>
<key>kerberosConfig</key>
<string>(your Base64-encoded krb5.conf)</string>

Ivanti and other AppConfig MDMs

Deliver the keys in the standard managed app configuration format, or enter them in your MDM's app configuration screen:

<managedAppConfiguration>
  <bundleId>com.shafersystems.notate</bundleId>
  <dict>
    <boolean keyName="allowSMB"><defaultValue><value>true</value></defaultValue></boolean>
    <boolean keyName="useSMBKerberos"><defaultValue><value>false</value></defaultValue></boolean>
    <string keyName="smbConnectionList"><defaultValue><value></value></defaultValue></string>
    <string keyName="kerberosConfig"><defaultValue><value></value></defaultValue></string>
  </dict>
</managedAppConfiguration>

BlackBerry UEM and Citrix

These consoles show Notate's configuration as a form. Fill in the fields:

What users see

Once the policy reaches the device, provisioned shares appear in the file manager under Network Drives. The first time a user opens a share, Notate asks for a domain user name and password. The user name can be a plain user name, such as jsmith, or domain-qualified, such as EXAMPLE\jsmith or jsmith@example.com. Credentials are saved for each server. Users can disconnect a share under Settings, then Accounts, then Disconnect SMB.

Troubleshooting

Start with Test Connection

Notate has a Test Connection wizard that checks each part of the connection in turn and says which step failed and why. To open it, long-press the server under Network Drives and choose Test Connection, or tap Diagnose… on any network drive error message.

Each step passes, warns or fails, and a failed step shows the likely cause. Copy Report puts a plain-text summary of the results on the clipboard, ready to paste into an email or a support request. On managed devices it follows your copy-and-paste data protection policy.

Common fixes

• Sign-in fails. The user taps Sign In… on the error and enters their password again. If their network password was changed recently, this replaces the old saved password.

• The VPN dropped. Reconnect it. Notate picks the share up again on its own; there is no need to restart the app.

• Server names do not resolve. Notate looks up server names through the device's own DNS, so names work whenever the tunnel provides your internal DNS. Connecting by IP address also works.

• The first connection is slow. The first connection after the app opens can take a few extra seconds while Notate starts its network drive support. Later access is fast.

Raising a support request

If the problem continues, raise a support request and include the Copy Report output from Test Connection. It already says which step failed, how sign-in was attempted and what kind of error occurred. If you can, also collect the Notate logs as described in How do I enable logging in Notate?, and add the device, operating system version and Notate version.

Last updated: September 30, 2026