Home / Azure

AzureTroubleshootingIntermediate

Sev1: Azure Files share unreachable — port 445, private endpoint DNS, identity auth and storage key rotation

File servers, apps or AVD profiles lost their Azure Files share. Check network path on 445, DNS to the private endpoint, Kerberos/identity auth and rotated keys, then remount.

Deepak Bhardwaj3 min read

Applies toAzure Files (SMB, standard and premium), Windows Server 2019+, Linux cifs-utils, Azure CLI 2.50+

Symptoms

  • System error 53 (path not found), System error 5 (access denied) or mount error(13) / mount error(115) on Linux.
  • Azure Virtual Desktop users get temporary profiles because FSLogix can't attach.
  • Apps writing to a mapped drive start failing all at once.

1. Test the network path

From an affected Windows machine:

Test-NetConnection -ComputerName stfilesprod.file.core.windows.net -Port 445
Resolve-DnsName stfilesprod.file.core.windows.net

From Linux:

nc -zvw3 stfilesprod.file.core.windows.net 445
nslookup stfilesprod.file.core.windows.net
Result Cause Fix
Port 445 fails from on-premises ISP or corporate firewall blocks 445 Use VPN/ExpressRoute + private endpoint
Resolves to a public IP but account has public access disabled Private DNS zone not linked or record missing Step 2
Port open, mount denied Authentication issue Step 3

2. Fix private endpoint DNS

az network private-dns record-set a list -g rg-dns -z privatelink.file.core.windows.net -o table
az network private-dns link vnet list -g rg-dns -z privatelink.file.core.windows.net -o table

The A record for stfilesprod must point to the private endpoint IP, and the zone must be linked to the VNet the clients (or their DNS servers) use. On-premises clients need a conditional forwarder for file.core.windows.net to the Azure DNS resolver.

3. Fix authentication

Storage key auth (common for apps and Linux mounts): if someone rotated the key, every mount using the old key fails.

az storage account keys list -g rg-files -n stfilesprod -o table

Update the stored credential and remount:

cmdkey /add:stfilesprod.file.core.windows.net /user:localhost\stfilesprod /pass:<new-key>
net use Z: \\stfilesprod.file.core.windows.net\share /persistent:yes

sudo mount -t cifs //stfilesprod.file.core.windows.net/share /mnt/share \
  -o credentials=/etc/smbcredentials/stfilesprod.cred,serverino,nosharesock,actimeo=30,mfsymlinks

Identity-based auth (AD DS or Entra Kerberos): access denied usually means one of:

  • Share-level RBAC role missing (Storage File Data SMB Share Contributor or Elevated Contributor).
  • AD computer account password for the storage account expired (AD DS). Check and rotate with the AzFilesHybrid module: Update-AzStorageAccountADObjectPassword.
  • Client has a stale Kerberos ticket: klist purge and retry.
# Diagnostic from the AzFilesHybrid module
Debug-AzStorageAccountAuth -StorageAccountName stfilesprod -ResourceGroupName rg-files -Verbose

4. Check the share itself

az storage share-rm show -g rg-files --storage-account stfilesprod -n share \
  --query "{quota:shareQuota, deleted:deleted}"
az storage share-rm list -g rg-files --storage-account stfilesprod --include-deleted -o table
  • Share quota reached → writes fail. Increase the quota.
  • Share deleted → restore from soft delete:
az storage share-rm restore -g rg-files --storage-account stfilesprod -n share --deleted-version <version>

Caution

If soft delete for file shares is disabled and the share was deleted, data is gone unless Azure Backup has a snapshot. Turn soft delete on for every account holding shares.

5. Throttling

Premium and standard shares have IOPS and throughput limits. If the share is reachable but very slow, check the Transactions metric with ResponseType split for SuccessWithThrottling-style responses and scale the provisioned size.

Prevent it next time

  • Use identity-based auth instead of storage keys for users; rotate keys with a documented process.
  • Keep soft delete and Azure Backup on for production shares.
  • Alert on share capacity and throttled transactions.
  • Document DNS for private endpoints, including on-premises forwarders.

Related fixes