Verdict

“The Tailscale + Entra-synced Synology + Intune-mapped-drive architecture is a viable solution that meets the requirements of per-user identity, Entra ID SSO, and mapped drive letters.”

The proposed solution using Tailscale, Entra-synced Synology, and Intune-mapped-drive is technically feasible and addresses the requirements. Tailscale offers a convenient VPN solution with Entra SSO and no port forwarding required. Joining the Synology to Entra ID or LDAP-syncing users enables per-user authentication and audit. Intune can be used to push a mapped-drive script, ensuring users still see a familiar drive letter. However, potential gotchas include ensuring compatibility between Tailscale and Synology, configuring Entra ID join or LDAP sync correctly, and handling any Intune deployment issues. The requirement for users to see a mapped drive letter limits alternatives like S3/HTTP. Direct Entra SSO to SMB shares on Synology may not be possible without an LDAP/AD bridge.

“The real differentiator is the Tailscale - plus - Entra ID VPN layer, but Synology's lack of native Entra ID SMB support forces an LDAP bridge, limiting durability.”

The market already offers several self - hosted file - share platforms (Nextcloud, ownCloud, Seafile) that support per - user authentication via LDAP/AD and can be accessed through mapped drives, often with built - in SSO integrations to Azure AD or Google Workspace. QNAP and TrueNAS also provide AD/LDAP sync and SMB shares, so the core capability - individual NAS accounts and mapped - drive access - is not unique. What is distinctive is the proposal to replace OpenVPN with Tailscale, leveraging its free tier and native Azure AD/Entra ID SSO to eliminate port - forwarding and dynamic DNS. This reduces operational overhead and improves NAT traversal, but the free tier caps the number of users and may lack the SLA required for a production NGO. Moreover, Synology does not natively support Entra ID SSO for SMB; you must sync users to an LDAP/AD server first, which adds a bridge component and potential single point of failure. While the architecture is technically feasible and could simplify management for non - technical users, it depends on three moving parts (Tailscale, Synology LDAP sync, Intune drive scripts), each with its own upgrade path and licensing constraints. Consequently, the differentiation is real in the VPN - SSO combination but is fragile and not strongly defensible against existing alternatives that can be configured similarly with modest effort.

“Technical complexity, potential regulatory non-compliance, and user resistance threaten viability within 6-12 months.”

The proposed architecture faces significant challenges due to technical, user adoption, and regulatory hurdles. **1. Regulatory Compliance (GDPR, CCPA, etc.)**: Storing and syncing user identities (Entra ID/LDAP) with a Synology NAS may not meet stringent regulatory requirements for data protection and auditability, potentially leading to non-compliance fines. **2. Platform Risk - Synology's Enterprise Support Limitations**: Synology's support for Entra ID SSO and LDAP syncing might be limited in the free or basic plans, and their enterprise support could be costly or inadequate for a small NGO, leading to unresolved technical issues. **3. Churn - User Resistance to Change**: Despite the mapped drive script, any deviation from the current user experience (e.g., additional SSO prompts) could lead to high user frustration and churn, especially if technical support is overwhelmed.

“Non-technical users won't abandon mapped drives, but small NGOs will pay for SSO and auditability - the gap is bridged by combining Tailscale's ease-of-use with Entra ID sync via LDAP, not native SMB SSO.”

This idea targets a real, underserved niche: small NGOs and non-enterprise teams using Synology NAS who need enterprise-grade identity management (Entra ID/SSO) without disrupting non-technical users' expectations of mapped drives. The audience is small but highly motivated - these are organizations with limited IT staff, already on M365/Intune, and frustrated by shared accounts and poor auditability. The proposed Tailscale + Entra-synced local users + Intune drive mapping is technically viable and cost-effective. Tailscale eliminates port forwarding and CGNAT issues, while Entra ID sync via LDAP (Synology supports Azure AD Connect via LDAP proxy or third-party tools like Azure AD Domain Services) can create per-user NAS accounts. Intune can push drive mappings via PowerShell or Group Policy Preferences (via Intune's Win32 app deployment). The main gap: Synology doesn't natively support SAML/SMB SSO - you'll always need an LDAP/AD bridge. But that's acceptable if you're syncing users from Entra ID to local NAS accounts. Gotchas: Sync latency, password sync delays, and potential permission drift if users are deleted in Entra but not on NAS. Alternatives like Nextcloud or SharePoint Online are cleaner but violate the 'mapped drive' requirement. This solution is pragmatic, low-cost, and solves a genuine pain point for 10K - 50K small NGOs globally (based on NGO Database estimates). It's not enterprise-grade, but it's perfect for its target segment.

“The Tailscale + Entra ID + Intune combo is a strong, low-cost solution, but the LDAP/AD bridge remains a necessary compromise for SMB authentication.”

The proposed solution addresses key pain points (per-user authentication, SSO, and drive mapping) with a clear, cost-effective architecture. Tailscale's free tier and Entra ID integration reduce complexity and cost, while Intune-managed drive mapping maintains user familiarity. The Synology-Entra ID join (or LDAP sync) ensures granular access control and auditability. However, the reliance on LDAP/AD as a bridge for SMB authentication is a minor drawback, as it introduces some operational overhead. The solution is well-considered but could explore alternatives like WebDAV or cloud-based file syncing if SMB is not strictly required.