2.2AZ-104Intermediate
Est: ~15 mins•Verified: 2026-08

Azure Files, Azure File Sync & Storage Private Endpoints

Deploy serverless SMB 3.0 / NFS Azure file shares, synchronize on-premises file servers using Azure File Sync with Cloud Tiering, and secure access via Storage Private Endpoints and SAS tokens.

Tags:#Azure#Storage#Azure Files#Azure File Sync#Private Endpoints#SAS#AZ-104
01

Overview

Azure Files provides fully managed, serverless file shares accessible via the industry-standard Server Message Block (SMB 3.0) and Network File System (NFS 4.1) protocols. Key architectural capabilities include:

  1. Azure Files SMB vs NFS: SMB supports Windows, macOS, and Linux clients with active directory identity authentication. NFS 4.1 supports POSIX-compliant Linux workloads (requires Premium SSD storage).
  2. Azure File Sync (AFS): Centralizes file shares in Azure Files while keeping the flexibility, performance, and compatibility of an on-premises Windows Server file server.
  3. Cloud Tiering: Caches frequently accessed files locally while rarely accessed files are tiered to Azure Files, saving on-premises disk storage.
  4. Shared Access Signatures (SAS): Delegated, time-limited access tokens without exposing the primary Storage Account Access Keys.
  5. Private Endpoints: Eliminates public internet exposure by routing storage traffic through a dedicated private IP address in an Azure Virtual Network (privatelink.file.core.windows.net).

---

02

When to Use: SAS Token Types Comparison

SAS TypeScope & SecurityBest Used For
User Delegation SASSecured with Microsoft Entra ID credentials (OAuth 2.0).Recommended best practice; revoking Entra permissions immediately breaks token validity.
Service SASSecured with Storage Account Key; scoped to a single service (e.g., Blob, File).Delegating access to specific file/share without granting full account access.
Account SASSecured with Storage Account Key; can access service-level and container-level operations.Bulk migration tools or broad administrative scripts (less secure).

---

03

Prerequisites

Administrator Permissions:

  • Storage Account Contributor or Owner on the target resource group.
  • Storage File Data SMB Share Elevated Contributor (for assigning SMB share-level permissions).
  • On-premises Windows Server 2019/2022 with PowerShell 5.1+ and Internet access to install the Azure File Sync Agent.

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
├── Storage accounts > [Your Storage Account]
│   ├── File shares (Create SMB / NFS share, configure quotas)
│   ├── Networking
│   │   ├── Selected networks (Firewall whitelist)
│   │   └── Private endpoint connections (Add Private Endpoint)
│   └── Shared access signature (Generate SAS token)
└── Azure File Sync (Search marketplace)
    └── Storage Sync Services
        ├── Registered servers (Check on-prem agent health)
        └── Sync groups
            ├── Cloud endpoint (Linked to Azure File Share)
            └── Server endpoint (Local path e.g. D:\Shares with Cloud Tiering)

---

05

Step-by-Step Implementation

Step 1: Create an Azure File Share with Soft Delete Protection

  1. Navigate to Storage accounts > select your storage account.
  2. Under Data storage, select File shares > click + File share.
  3. Name: finance-records
  4. Tier: Transaction Optimized or Hot.
  5. Size quota: Set maximum size (up to 100 TiB when large file shares enabled).
  6. Click Create.

Step 2: Deploy Azure File Sync & Configure Cloud Tiering

  1. Deploy a Storage Sync Service in the Azure Portal.
  2. Install the Azure File Sync Agent on your on-premises Windows Server and register it to your Azure tenant.
  3. Under the Storage Sync Service, select Sync groups > + Sync group.
  4. Configure Cloud Endpoint: Link your Storage Account and the finance-records file share.
  5. Add Server Endpoint:
  • Registered server: Select your on-premises server.
  • Path: D:\FinanceShares
  • Cloud Tiering: Toggle to Enabled.
  • Volume Free Space Policy: Set to 20% (tiers files when local drive has < 20% free space).
  • Date Policy: Tier files not accessed in the last 30 days.

Step 3: Secure with a Private Endpoint

  1. In the Storage Account, go to Networking > Private endpoint connections > + Private endpoint.
  2. Target sub-resource: file.
  3. Virtual Network & Subnet: Select your internal VNet/subnet.
  4. Private DNS integration: Enable integration with privatelink.file.core.windows.net.

---

06

Azure PowerShell & Azure CLI

PowerShell: Deploy File Share and Generate User Delegation SAS

PowerShell
# Connect and set subscription
Connect-AzAccount
Set-AzContext -SubscriptionId "<YOUR-SUBSCRIPTION-ID>"

$rgName = "rg-storage-core"
$saName = "saenterprisefiles01"
$shareName = "corp-data"

# 1. Create Storage File Share
New-AzRmStorageShare `
    -ResourceGroupName $rgName `
    -StorageAccountName $saName `
    -Name $shareName `
    -QuotaGiB 5120

Write-Host "File Share '$shareName' created successfully." -ForegroundColor Green

# 2. Generate a Service SAS Token with Read/List permissions valid for 8 hours
$saContext = (Get-AzStorageAccount -ResourceGroupName $rgName -Name $saName).Context

$sasToken = New-AzStorageShareSASToken `
    -ShareName $shareName `
    -Permission "rl" `
    -StartTime (Get-Date) `
    -ExpiryTime (Get-Date).AddHours(8) `
    -Context $saContext

Write-Host "Generated SAS Token: $sasToken" -ForegroundColor Yellow

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Azure File Share is reachable from joined endpoints over SMB port 445.
On-premises Azure File Sync agent displays status: Online and green health in the portal.
Tiered files on the on-premises file server show the offline attribute (FILE_ATTRIBUTE_OFFLINE, grey icon).
Storage firewall rejects public internet requests when set to Disabled from all networks.
Name resolution for <account>.file.core.windows.net resolves to the private IP (10.x.x.x) via Azure Private DNS Zone.
08

Common Pitfalls & Troubleshooting Matrix

IssueRoot CauseResolution
Cannot mount SMB share from home/remote networkISP blocks outbound TCP port 445 to prevent SMB malware.Mount over Azure VPN Gateway, ExpressRoute, or use Private Endpoints inside VNet.
Files failing to tier in Azure File SyncAnti-virus software or backup software is scanning and recalling files.Configure antivirus to skip tiered files; ensure backup software is AFS-aware.
Sync error 0x80c80037 (File too large)Individual file exceeds the maximum 4 TiB file limit for standard shares.Split file or use Premium File share supporting larger single-file thresholds.
SAS token returns 403 ForbiddenSAS token expired or system clocks out of sync.Ensure token ExpiryTime is in UTC and allow 5-15 minute skew in StartTime.

---

09

Real-World Architecture / Flow

Interactive Topology & Workflow
On-Premises Branch Officedefault
Stage 1
Flow & Verification Handshake
Windows File Server (D:\Data)storage
Stage 2
Flow & Verification Handshake
Azure File Sync Servicecompute
Stage 3
HTTPS 443 Sync
Azure Storage Accountstorage
Stage 4
File Share (SMB 3.0) ◄───── Private Endpoint (10.10.2.15)
Bi-directional Sync
Azure Virtual Machinesdefault
Stage 5

---

10

Audit & Monitoring

  • Enable Storage Diagnostic Settings sending logs to Log Analytics:
  • Category: StorageRead, StorageWrite, StorageDelete.
  • KQL to audit SAS token usage:

```kusto

StorageFileLogs

| where AuthenticationType == "SAS"

| project TimeGenerated, OperationName, CallerIpAddress, Uri

| order by TimeGenerated desc

```

---

11

Rollback & Emergency Recovery

  • Recall All Tiered Files to Local Disk:

```powershell

Invoke-StorageSyncFileRecall -Path "D:\FinanceShares"

```

  • Revoke Compromised SAS Tokens:
  • For Account/Service SAS: Rotate the Storage Account Access Keys (Key1 or Key2) immediately.
  • For Stored Access Policies: Delete or update the Stored Access Policy on the file share.

---

12

Official Documentation Reference

---

13

Exam Blueprint & Pro Tips (AZ-104)

Exam Blueprint & High-Yield Traps

AZ-104 High-Yield Rules:

  1. Port 445 Requirement: Azure Files SMB requires outbound TCP port 445. If the ISP blocks port 445, SMB mounts fail over the public internet.
  2. Cloud Tiering vs Backup: Cloud Tiering is not a backup solution. Deleting a file on the local server endpoint deletes it in the cloud share.
  3. Stored Access Policy: To revoke a Service SAS without regenerating the primary storage account key, associate the SAS with a Stored Access Policy.
  4. User Delegation SAS: Only supported for Azure Blob Storage, not for Azure Files. Azure Files SAS relies on storage account keys or Stored Access Policies.
PREVIOUS TOPIC2.1 Storage Accounts: Blob Access Tiers & LifecycleNEXT TOPIC3.1 Virtual Machines: Availability Zones & Azure Bastion