Make sure Azure Active Directory Domain Services (Azure AD) is enabled for your Active Tenant

glenbow 

Have a read of the following article to get a basic understanding of the moving parts.

From what you've said about not having or wanting domain controllers, I have to assume your tenant is cloud-native meaning of the three identity-based authentication models, you can only use one: Azure AD DS (since the other two involve the on-premise variety of AD DS.)

Note: Azure AD DS is note the same thing as Azure AD. It is an option paid extra that amongst other things provides Kerberos support.

• Overview - Azure Files identity-based authorization | Microsoft Learn

If you already have Azure AD DS then there will be no additional cost. Of course, if you don't currently have it then it does cost extra.

Also note point 2 as this may represent significant effort if you have hundreds or even thousands of clients already Azure AD joined (or registered, but I'm wagering this isn't relevant to your configuration.)

In short, until you have configured Azure AD DS, you cannot assign users.

If you are completely unfamiliar with Azure AD DS, have a read of the following, being sure to note how Azure AD DS produces as copy of your actual Azure AD environment which is then used for the various (including Kerberos) purposes.

• Overview of Azure Active Directory Domain Services | Microsoft Learn

Cheers,

Lain