Home / Azure

AzureRunbookIntermediate

Transformation: Windows file servers to Azure Files with Azure File Sync

Move Windows file shares to Azure Files while keeping fast local access with Azure File Sync and cloud tiering. Plan shares and permissions, seed data, cut over users and shrink or retire the on-premises servers.

Deepak Bhardwaj3 min read

Applies toAzure Files (SMB), Azure File Sync agent on Windows Server 2016+, Active Directory DS or Entra Kerberos

Two target patterns

Pattern Users access Best for
Hybrid: Azure File Sync with cloud tiering Local Windows Server cache, cloud is the master copy Branch offices, large shares, latency-sensitive users
Direct: SMB to Azure Files Mapped drives to \\account.file.core.windows.net over VPN/ER Small sites, cloud-first users, no server wanted

Many estates use both: sync servers in big offices, direct access elsewhere.

1. Plan

  • Map each on-premises share to an Azure file share. Sync groups have one cloud endpoint; check current scale limits on items per share and shares per sync service.
  • Use premium file shares for heavy small-file workloads, standard for general file shares.
  • Identity: enable AD DS authentication (or Entra Kerberos for hybrid identities) on the storage account so NTFS ACLs keep working.
# AzFilesHybrid module: join the storage account to AD DS
Join-AzStorageAccount -ResourceGroupName rg-files -StorageAccountName stfilesprod `
  -DomainAccountType ComputerAccount -OrganizationalUnitDistinguishedName "OU=Storage,DC=contoso,DC=com"

2. Build the sync side

az storage share-rm create -g rg-files --storage-account stfilesprod -n finance --quota 2048
az storagesync create -g rg-files -n sss-prod -l westeurope
az storagesync sync-group create -g rg-files --storage-sync-service sss-prod -n finance
az storagesync sync-group cloud-endpoint create -g rg-files --storage-sync-service sss-prod \
  --sync-group-name finance -n finance-cloud --storage-account stfilesprod --azure-file-share-name finance

(az storagesync is an extension: az extension add -n storagesync.)

3. Seed the data

Option A — install the File Sync agent on the existing file server and add the share path as a server endpoint. Sync uploads everything; users keep working.

Option B — for a hardware refresh, copy to a new server with Robocopy first, then add it as a server endpoint:

robocopy \\oldfs\finance D:\finance /MIR /COPY:DATSO /DCOPY:DAT /MT:16 /R:2 /W:5 /B /LOG:C:\logs\finance.log

Warning

Never run Robocopy into a server endpoint path while it is also syncing from the cloud for the first time — that creates conflicts. Finish the copy, then add the server endpoint.

4. Turn on cloud tiering

Set volume free space (for example 20%) and an optional date policy. Cold files become tiered stubs; they recall on access.

5. Cut over

  1. Final Robocopy delta (Option B), then share the new path.
  2. Update DFS-N targets or GPO drive maps — DFS Namespaces make this a back-end change users don't see.
  3. Set the old share read-only for the rollback window.

6. Backup and DR

  • Azure Backup for Azure Files snapshots the cloud share; the server is a cache and needs no file-level backup.
  • A failed server is replaced by installing the agent on a new server and adding it to the sync group; namespace downloads quickly, content recalls on demand.

Checklist

  • Share-to-share mapping and limits checked
  • AD DS / Entra Kerberos authentication and NTFS ACLs tested
  • Initial sync complete, no persistent sync errors
  • DFS-N or drive maps switched
  • Azure Backup policy on every share; old servers retired

Related fixes