Storage · Lesson 9 of 24

Azure Files and File Sync

A network share in the cloud, mapped like any office drive, and the agent that keeps the office server in step with it.

About 10 min · Interactive · 3 practice questions

Exam objective
Create and configure a file share in Azure Files · Configure identity-based access for Azure Files · Configure snapshots and soft delete for Azure FilesImplement and manage storage · 15–20% of the exam · typical question: "Users cannot map the share" (port 445), identity-based access setup, File Sync components
In one sentence. Azure Files gives you an SMB share exactly like one on a Windows server, so \\contosoinvoices01.file.core.windows.net\finance can be mapped as the Z: drive. The two practical problems are that home internet blocks the SMB port, and that signing in with a storage key means everyone is "the same user". Both have fixes.

You, the admin: create and map a share

  1. Storage account › File shares › + File share, name finance, tier Transaction optimized, quota 500 GiB.
  2. Open the share → Connect. The portal writes a PowerShell script that creates the mapped drive using the storage key; run it on the PC.
  3. If it fails with a timeout, outbound TCP 445 is blocked by the ISP. Options: connect over the company VPN or ExpressRoute, or use Azure File Sync so users hit the local server instead.

Letting users sign in as themselves

Instead of the key, enable identity-based access under File shares › Active Directory: join the storage account to on-prem AD DS, to Entra Domain Services, or to Entra Kerberos for cloud-joined PCs. Then two layers decide access:

  • Share level = an RBAC role on the share: Storage File Data SMB Share Reader, Contributor, or Elevated Contributor (can change NTFS permissions).
  • File and folder level = normal Windows NTFS ACLs, set with Explorer or icacls from a mounted client, exactly as on a file server.

Protecting the share

  • Snapshots (Share › Snapshots or scheduled by Azure Backup): read-only copies of the whole share, up to 200; users can restore a single file from Previous Versions in Windows.
  • Soft delete for file shares: a deleted share survives 1 to 365 days (default 7).

Azure File Sync

Office file serverFile Sync agent installedStorage Sync Servicesync groupCloud endpoint= the Azure file shareBranch serversecond server endpointcloud tiering: hot files local,cold files become pointers
Keep the servers users already know; the share in Azure becomes the master copy.

Set up: create a Storage Sync Service → install the agent on the Windows server and register it → create a sync group whose cloud endpoint is the Azure share → add the server's folder as a server endpoint, optionally ticking cloud tiering with a free-space target so a 2 TB share fits a 500 GB disk.

Key points

  • Azure Files is a network share you map as a drive over SMB (port 445) or NFS (premium only).
  • Timeout mapping from the office = port 445 blocked by the ISP; use VPN, ExpressRoute or File Sync.
  • Identity-based access lets users sign in as themselves: share-level RBAC role plus normal NTFS permissions.
  • File Sync keeps the office server as a cache of the cloud share; cloud tiering saves local disk.

Formal terms: SMB 3.x, TCP 445, NTFS ACL, Entra Kerberos, share snapshot, Storage Sync Service, sync group, server endpoint, cloud tiering.

Check your understanding

3 exam-style questions in the formats AZ-104 uses. Each is marked when you check it, with the reasoning.

0 of 3 checked

All scenarios and questions are original. None are taken from the exam, Microsoft's practice assessment or any question bank. PrepToExcel is not affiliated with Microsoft.