The office of Nordlicht Reisen GmbH, a fictional travel agency, has a Z: drive with travel documents that so far sits on a server in the basement. Azure Files provides the same kind of share as a service:
Windows, Linux and macOS mount it over SMB or NFS, without anyone running a file server. This lesson shows how you create a share, protect it and grant
access to identities.
This lesson covers in the study guide: create and configure a file share, configure snapshots and soft delete for Azure Files, configure identity-based access for Azure Files.
Prior knowledge. Azure Files as a storage service is introduced in "AZ-900 compact", lesson 2.5. Storage account and redundancy: lesson 2.1. Keys and SAS: lesson 2.2. Roles and scopes: lesson 1.3. Copying data between machines and shares: lesson 2.5.
Create a file share
A file share lives in a storage account. In its documentation, Microsoft distinguishes classic shares (classic file shares, created through the resource provider
Microsoft.Storage) from newer ones that the provider Microsoft.FileShares creates. This course and the exam show the classic form; in the portal the entry under Data storage is called
Classic file shares (depending on the portal version and language it may differ). Some features, for example soft delete and encryption with customer-managed keys, Microsoft explicitly names only for
the classic form.
Decisions when creating
| Item | Choice |
|---|---|
| Protocol | SMB (Windows, Linux, macOS, REST) or NFS (Linux, NFSv4.1); NFS requires a Premium account |
| Account type | Standard (hard disks) with pay-as-you-go billing; Premium (SSD) as a FileStorage account (lesson 2.1) |
| Tier (access tier) for Standard | Transaction optimized (default), Hot, Cool: same hardware, cooler tiers have cheaper storage and more expensive operations |
| Size (quota) | for provisioned shares, the size reserved in advance in GiB, in Microsoft's CLI example between 100 and 102,400 |
| Redundancy | that of the account; Microsoft recommends ZRS for Azure Files; RA-GRS and RA-GZRS don't exist |
When changing tiers after a migration, Microsoft advises starting with Transaction optimized to save on operation costs, and then moving to a cooler tier.
Portal way: account → Data storage → Classic file shares → + Classic file share. Choose name and tier; on the Backup tab, Azure Backup is suggested by default (lesson 5.5), then Review + create. Command (example for a provisioned share from Microsoft's documentation):
az storage share-rm create --resource-group rg-az104-files `
--storage-account <eindeutiger-name> `
--name reiseunterlagen --quota 100 --enabled-protocols SMB
--quota is the provisioned size in GiB; whether it applies to your account type, and in which range, is stated in the command's reference. Choose the size small: With provisioned shares
you pay for the reserved size, not for the used size.
Mounting a drive is handled by the portal: select the share → Connect, copy the script for Windows, Linux or macOS. For it to work, your network must allow SMB to the storage account; corporate networks and internet providers sometimes block it. Alternatives are a VPN or a private endpoint (lesson 4.4). And the account's firewall (lesson 2.2) must allow your client.
Access without identity
With the account key, a client gets full access to all shares in the account. Microsoft recommends identity-based authentication instead of keys in "nearly all cases"; the heading after next shows it. A SAS for a share exists as a service SAS (lesson 2.2).