Azure Files, File Sync and Tools

Azure Basics · Azure Storage – Accounts, Replication, Blobs, Security and Files · Lesson 5 of 5

Azure Files provides SMB/NFS file shares with quotas and snapshots; File Sync syncs shares with on-prem Windows Server; AzCopy, Storage Explorer and Import/Export move data.

	Azure Files	Blob
Access	SMB (port 445), NFS (premium), REST	REST/HTTPS, flat namespace
Fits	Lift-and-shift, shares for many VMs, shared tool folders	Large-scale app data, streaming, random access

A file share has a quota (GiB). Windows mounts over port 445 (many ISPs block it from on-prem); Linux/macOS mount with SMB 3.x. Secure transfer required means encryption is mandatory (SMB 3.x / HTTPS).
Share snapshots: incremental, read-only, taken for the whole share, restored per file — protection against accidental deletes and app errors.

flowchart LR
  WS["Windows Server on-prem<br/>(File Sync agent, server endpoint D:\\data)"] <--> SG["Sync group"]
  SG <--> CE["Cloud endpoint: share1"]
  SSS["Storage Sync Service"] --- SG

File Sync

Storage Sync Service (the top-level resource) → registered server (trust relationship) running the File Sync agent → a sync group with one cloud endpoint (Azure file share) and server endpoints (folders on servers). It caches a share on several servers and supports cloud tiering.

Tools

Tool	Used for
AzCopy v10	Command line `azcopy copy <source> <destination> [flags]`, authenticated with Entra (`azcopy login`) or SAS; Blob and Files (no Table any more)
Storage Explorer	Desktop app for Windows/macOS/Linux, many accounts, creates SAS
Import/Export	Ship physical disks; import into Blob/Files, export only from Blob

Command	Meaning
`az storage share-rm create -g rg-devops-lab --storage-account stdevopslab01 -n share1 --quota 100`	Create a 100 GiB share
`azcopy copy ./site "https://stdevopslab01.blob.core.windows.net/web" --recursive`	Upload a folder

Share tiers and identity

Standard file shares come in transaction optimized, hot, and cool tiers, trading storage price against transaction price. Premium shares run on SSD with provisioned capacity and throughput, suit databases and heavy workloads, and are the only option for NFS.

Users can open SMB shares with their own identity instead of the account key. Azure Files supports on-premises AD DS, Microsoft Entra Domain Services, and Microsoft Entra Kerberos for hybrid identities. Share-level access uses roles such as Storage File Data SMB Share Contributor, and NTFS permissions still apply to folders and files.

Mounting on Linux

sudo mkdir -p /mnt/share1
sudo mount -t cifs //stdevopslab01.file.core.windows.net/share1 /mnt/share1 \
  -o credentials=/etc/smbcredentials/stdevopslab01.cred,serverino,nosharesock,actimeo=30

The credentials file holds the account name and key with mode 600. Add the line to /etc/fstab to mount at boot. The portal's Connect button generates ready scripts for Windows, Linux, and macOS.

Protecting shares

Soft delete keeps a deleted share recoverable for a set number of days.
Azure Backup schedules share snapshots and keeps them by policy, without agents.
Snapshots appear in Windows as Previous Versions, so users can restore their own files.

More on File Sync

Cloud tiering keeps frequently used files on the local server and replaces older ones with pointers; opening a tiered file downloads it transparently. This lets a small server front a large share. Sync is near-real-time for changes on servers and runs change detection on the cloud side periodically.

Moving big data

azcopy sync copies only differences between two locations, which suits repeated migrations. For tens of terabytes over slow links, Azure Data Box ships an encrypted appliance that you fill locally and send back to Microsoft.