AZ-104
Deep Dive
Azure Files provides fully managed cloud file shares, accessible via SMB and NFS. Azure File Sync extends this by syncing with on-premises Windows servers, a hybrid pattern that comes up frequently on the AZ-104.
Contents
Azure Files is a fully managed cloud file share service. Unlike Blob Storage (for unstructured objects), Azure Files provides file shares with a real folder hierarchy accessible through industry-standard protocols.
Azure Blob
Flat objects (photos, backups, logs). Accessed via REST/SDK. No real folder hierarchy.
Azure Files
SMB/NFS file shares. Mountable as a network drive. Real folder hierarchy. Ideal for lift-and-shift.
Azure NetApp Files
High-performance NFS for SAP and HPC workloads. Enterprise, premium pricing.
When to use Azure Files
| Feature | SMB 3.x | NFS 4.1 |
|---|---|---|
| Supported OS | Windows, Linux, macOS | Linux only |
| Tier required | Standard and Premium | Premium only |
| Supported redundancy | LRS, ZRS, GRS, GZRS | LRS, ZRS only |
| Authentication | Entra ID (Kerberos), Storage Key, SAS | IP-based (no Kerberos) |
| Internet access | Yes (port 445) | No — VNet only |
| File Sync compatible | Yes | No |
| Max. quota per share | 100 TiB (Standard: 5 TiB by default) | 100 TiB |
Port 445 — a common problem
SMB uses port 445. Many ISPs and corporate firewalls block this port for security reasons. To mount an SMB Azure File Share from on-premises, port 445 must be open toward the storage endpoint. Alternative: use Azure VPN Gateway or ExpressRoute to route the traffic over a private network.
| Tier | Storage account type | Media | IOPS | Ideal use |
|---|---|---|---|---|
| Transaction Optimized | Standard (GPv2) | HDD | Low | General-purpose file shares with many small transactions |
| Hot | Standard (GPv2) | HDD | Low | Frequently accessed file shares |
| Cool | Standard (GPv2) | HDD | Low | Backups and rarely accessed files. Lower storage cost |
| Premium | FileStorage (specialized) | SSD | High | Low latency. Databases, ERP, mission-critical applications |
Azure Files snapshots capture the state of the file share at a point in time. They are incremental (only changes since the previous snapshot are stored) and read-only.
Snapshot characteristics
Snapshot vs Soft Delete
Snapshot
Point-in-time copy initiated by a user/process. Lets you recover earlier versions of specific files.
Soft Delete
Protects against accidental deletion of the entire share. The deleted share is retained for X days (1-365) before being permanently deleted.
Azure File Sync turns an on-premises (or VM) Windows Server into a fast cache of Azure Files. It lets you maintain a hybrid model: low-latency local access + cloud storage + multi-site synchronization.
What does Azure File Sync solve?
Problem: Slow/expensive on-premises file server
Solution: Tier less-used files to Azure, keep hot files local
Problem: Multiple sites need the same share
Solution: A Sync Group syncs the same Azure Files share across 10+ servers
Problem: File server backup
Solution: Azure Files as automatic backup with snapshots
Problem: Gradual migration to the cloud
Solution: Migrate while users keep accessing the local server
1. Storage Sync Service
Azure resource (like a hub). Manages all sync relationships. A tenant can have multiple Storage Sync Services, but the norm is 1 per region.
2. Sync Group
Defines the sync topology. Contains 1 Cloud Endpoint (Azure Files share) and 1 or more Server Endpoints (local paths on Windows servers).
3. Cloud Endpoint
The Azure Files share that acts as the source of truth. Only 1 cloud endpoint per Sync Group. A share can only be part of 1 Sync Group.
4. Server Endpoint
A specific path on a registered Windows Server (e.g., D:\Data\Shares). Maximum 30 server endpoints per registered server. A server can belong to multiple Sync Groups.
5. Azure File Sync Agent
Software installed on the Windows Server (on-premises or Azure VM). Updatable version. Registers the server in the Storage Sync Service.
// File Sync setup flow
1. Create Storage Account + Azure Files share
2. Create Storage Sync Service in Azure
3. Install the Azure File Sync agent on Windows Server
4. Register the server with the Storage Sync Service
5. Create a Sync Group in the Storage Sync Service
6. Add the Cloud Endpoint (the Azure Files share)
7. Add a Server Endpoint (local path: D:\Share)
8. Wait for the initial sync (can take hours/days)
Cloud tiering automatically moves infrequently used files from the local server to Azure Files, leaving a stub (placeholder) that takes up minimal space but lets you access the file on demand (it downloads automatically when opened).
Tiering policies
Volume Free Space Policy
Keeps X% of the local volume free. If the disk reaches the threshold, cold files are moved to the cloud. Recommended minimum setting: 20%.
Date Policy
Moves files not accessed in the last N days (1-2555 days). Complements the Volume Free Space Policy.
Stub behavior
| Scenario | Solution | Why |
|---|---|---|
| Share files across Windows VMs in Azure | Azure Files SMB | Native mount as a network drive from multiple VMs |
| Linux file server accessing a shared share | Azure Files NFS (Premium) | NFS 4.1 is Linux-only, requires the Premium tier |
| On-premises file server + remote cloud access | Azure File Sync + Azure Files | Local cache + cloud as the source of truth |
| Backup of on-premises Windows file servers | Azure File Sync (with Azure snapshots) | Syncs to Azure Files and automatic snapshots are taken |
| Application needs REST access to files | Azure Blob Storage | Files is SMB/NFS. Blob is for REST/SDK |
| SAP HANA needs high-performance NFS | Azure NetApp Files | Files NFS does not meet SAP latency requirements |
NFS only works on Premium and does not support File Sync
NFS 4.1 requires a FileStorage account (Premium tier) and only works on private networks. NFS is NOT compatible with Azure File Sync — only SMB is. If the scenario calls for hybrid sync, the answer is SMB.
Port 445 may be blocked — use VPN/ExpressRoute
SMB uses TCP port 445. ISPs and corporate firewalls frequently block it. The official solution is to use Azure VPN Gateway or ExpressRoute to tunnel the traffic, or open the port in the corporate firewall.
Cloud Tiering only applies to Server Endpoints, not Cloud Endpoints
The cloud tiering policy is configured on the Server Endpoint (local server side), not on the Cloud Endpoint (Azure Files). The Azure Files share always has all the files; the local server may only have the hot ones.
Deleting a file share with snapshots fails
You cannot delete an Azure Files share if it has snapshots. You must delete all snapshots first (or use az storage share delete --delete-snapshots include). This also applies when the share is protected by Azure Backup.
Did you get this topic?
Test what you just learned
A company has 5 offices in Europe with local Windows file servers that need access to the same set of files. They want to reduce local storage space while keeping fast access to the most-used files. Files not accessed in 30 days can be moved to the cloud. Which is the correct solution?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.