SkyCore Solutions Guide: How to Migrate Your File Server to Azure Files with Azure File Sync
For small to medium-sized businesses (SMBs) in Montreal and beyond, managing on-premises file servers often involves a constant battle against hardware failures, limited scalability, and complex disaster recovery. At SkyCore Solutions, we specialize in helping organizations modernize their IT infrastructure. This comprehensive implementation guide will walk you through how to migrate file server to Azure Files, leveraging the powerful capabilities of Azure File Sync.
By the end of this guide, you will have a robust, hybrid file share solution: your existing on-premises file server will act as a high-performance cache for a fully managed, highly available Azure File Share in the cloud. This approach centralizes your data, simplifies backups, enhances security, and provides multi-site access flexibility, all while maintaining familiar user experiences and seamless Active Directory integration.
Prerequisites
- An active Azure subscription with 'Owner' or 'Contributor' role assigned.
- Azure CLI installed and configured (version 2.38.0 or later recommended).
- Azure PowerShell module (
Az) installed (version 8.0.0 or later recommended). - A stable internet connection for the on-premises file server.
- An on-premises Windows Server (2012 R2 or newer) to host the Azure File Sync agent. This server should have sufficient CPU, RAM, and disk space for the local cache.
- Your on-premises file server should be domain-joined for seamless Active Directory Domain Services (AD DS) integration and identity-based access.
- Estimated Cost: Expect costs for Azure Storage (based on capacity, transactions, and redundancy), and potentially egress fees for data transfer out of Azure. A basic 1TB Standard GRS file share might start around $50-100 CAD/month, scaling with usage. Azure File Sync service itself has a low monthly fee per registered server, separate from storage costs.
Step 1: Plan Your Azure Files and File Sync Deployment
Effective planning is the cornerstone of any successful cloud migration. Before provisioning resources, you need to make critical decisions about your storage account type, redundancy, and authentication method to ensure the solution aligns with your SMB's performance, cost, and security requirements.
For most SMBs, we recommend Standard (HDD-based) storage with Geo-redundant storage (GRS). This provides a cost-effective balance of performance and superior data durability, replicating your data to a secondary Azure region hundreds of miles away. For mission-critical applications requiring the absolute lowest latency or highest IOPS, Premium (SSD-based) could be considered, but comes at a higher cost.
Regarding protocol, SMB 3.1.1 is the standard for Windows file servers and ensures compatibility with your existing infrastructure. Identity-based authentication, leveraging your on-premises Active Directory Domain Services (AD DS), is crucial for maintaining existing NTFS permissions and a seamless user experience. This avoids managing separate credentials for cloud shares.
Step 2: Create an Azure Storage Account
The Azure Storage Account acts as the umbrella for all your Azure storage services, including file shares. For file server migrations, a General-purpose v2 storage account is essential as it supports all current Azure Storage features, including Azure Files and Azure File Sync. We'll configure it with strong security and redundancy.
az storage account create \\
--resource-group "SkyCore-FileServer-RG" \\
--name "skycorefilesyncstorage" \\
--location "eastus" \\
--sku "Standard_GRS" \\
--kind "StorageV2" \\
--allow-blob-public-access false \\
--min-tls-version "TLS1_2" \\
--routing-preference "Microsoft.Routing" \\
--default-to-oauth-authentication false
--resource-group "SkyCore-FileServer-RG": Specifies the resource group where your storage account will reside. Create one if it doesn't exist (az group create -n SkyCore-FileServer-RG -l eastus).--name "skycorefilesyncstorage": A globally unique name for your storage account.--location "eastus": The Azure region for your storage account. Choose one closest to your on-premises servers for optimal performance.--sku "Standard_GRS": Configures standard storage (HDD-based) with Geo-Redundant Storage, offering robust data durability for most SMBs.--kind "StorageV2": Specifies a General-purpose v2 storage account, required for Azure File Sync.--allow-blob-public-access false: Enhances security by preventing anonymous public access to blobs within this account.--min-tls-version "TLS1_2": Enforces a minimum TLS 1.2 for all connections, a security best practice.--routing-preference "Microsoft.Routing": Routes traffic over the Microsoft global network for optimal performance.--default-to-oauth-authentication false: Ensures existing SMB protocols work without requiring OAuth, maintaining compatibility.
Portal alternative: Navigate to the Azure Portal > Search for "Storage accounts" > Click "+ Create" > Select your Subscription and Resource group > Provide a Storage account name, choose a Region > For Performance, select "Standard" > For Redundancy, select "Geo-redundant storage (GRS)" > Under "Advanced" tab, ensure "Allow blob public access" is disabled and "Minimum TLS version" is set to "TLS 1.2" > Review and Create.
Run this to verify:
az storage account show --name "skycorefilesyncstorage" --resource-group "SkyCore-FileServer-RG" --query "{name:name, location:location, sku:sku.name, kind:kind}" -o table
Step 3: Create an Azure File Share
Now that your storage account is ready, we'll create the actual file share where your data will reside. For SMBs, we generally recommend using provisioned shares for consistent performance, especially when migrating an active file server. You specify a maximum quota, and Azure provisions the necessary IOPS and throughput.
$resourceGroup = "SkyCore-FileServer-RG"
$storageAccountName = "skycorefilesyncstorage"
$fileShareName = "SkyCoreSMBFiles"
$quotaGB = 2000 # Example: 2TB quota
New-AzRmStorageShare -ResourceGroupName $resourceGroup -StorageAccountName $storageAccountName -Name $fileShareName -QuotaGiB $quotaGB -EnabledProtocol SMB -AccessTier Hot
-ResourceGroupName,-StorageAccountName,-Name: Your resource group, storage account name, and desired name for the file share.-QuotaGiB $quotaGB: Sets the maximum size of the file share in GiB. Start with enough capacity for your current data, but remember you can increase this later.-EnabledProtocol SMB: Explicitly enables the Server Message Block (SMB) protocol, essential for Windows clients.-AccessTier Hot: Sets the access tier to 'Hot' for frequently accessed data, balancing performance and cost. 'Cool' or 'Transaction Optimized' are options for less frequently accessed data.
Portal alternative: Navigate to your Storage Account in Azure Portal > Under "Data storage," click "File shares" > Click "+ File share" > Enter a name (e.g., SkyCoreSMBFiles), specify the provisioned capacity (e.g., 2000 GiB) > Select "Hot" access tier > Click "Create".
Run this to verify:
Get-AzRmStorageShare -ResourceGroupName $resourceGroup -StorageAccountName $storageAccountName -Name $fileShareName | Select-Object Name, QuotaGiB, EnabledProtocol, AccessTier
Step 4: Configure Identity-Based Authentication for Azure Files
For a seamless transition and to maintain existing NTFS permissions, integrating your Azure file share with your on-premises Active Directory Domain Services (AD DS) is paramount for SMBs. This allows users to access the cloud file share using their existing AD credentials.
This process typically involves three main steps: enabling AD DS authentication on the storage account, assigning share-level permissions to AD identities, and configuring NTFS permissions on the files and directories within the share. While the full AD DS integration involves a few more steps covered in detail in Microsoft's dedicated guide, we'll start with enabling AD DS authentication on the storage account.
# First, ensure your Storage Account has an identity assigned for AD DS integration
az storage account identity assign --resource-group "SkyCore-FileServer-RG" --name "skycorefilesyncstorage"
# Next, enable AD DS authentication on the storage account
# Note: This command points to the domain join for the storage account
# You will need your domain name and a domain controller IP/FQDN
az storage account sam-properties create \\
--resource-group "SkyCore-FileServer-RG" \\
--account-name "skycorefilesyncstorage" \\
--azure-storage-sid $(az storage account show -g "SkyCore-FileServer-RG" -n "skycorefilesyncstorage" --query "identity.principalId" -o tsv) \\
--domain-name "yourdomain.local" \\
--domain-guid "<your-domain-guid>" \\
--domain-controller-ips "10.0.0.4,10.0.0.5" \\
--netbios-domain-name "YOURDOMAIN"
az storage account identity assign: Assigns a system-assigned managed identity to the storage account, necessary for AD DS integration.az storage account sam-properties create: Configures the storage account to join your on-premises AD DS.--azure-storage-sid: The SID of the storage account's managed identity. The Azure CLI command$(az storage account show -g "SkyCore-FileServer-RG" -n "skycorefilesyncstorage" --query "identity.principalId" -o tsv)dynamically fetches this.--domain-name "yourdomain.local": Your fully qualified domain name.--domain-guid "<your-domain-guid>": The GUID of your AD DS domain. You can retrieve this with(Get-ADDomain).ObjectGuidon a domain controller.--domain-controller-ips "10.0.0.4,10.0.0.5": IP addresses of your domain controllers.--netbios-domain-name "YOURDOMAIN": Your NetBIOS domain name.
Portal alternative: Navigate to your Storage Account > Under "Data management," select "File shares" > Click on your file share (e.g., SkyCoreSMBFiles) > Click "Change directory, file, or share permissions" > Follow the steps to enable Azure Active Directory Domain Services (AD DS) authentication and assign share-level permissions. For comprehensive steps, refer to the official Microsoft Learn documentation on AD DS integration for Azure Files.
Run this to verify: (After domain join, may take a few minutes to propagate)
Get-AzStorageAccount -ResourceGroupName "SkyCore-FileServer-RG" -Name "skycorefilesyncstorage" | Select-Object -ExpandProperty AzureFilesIdentityBasedAuth | Format-List
Step 5: Deploy Azure File Sync Service and Agent
Azure File Sync is the key component for a successful hybrid file server migration for SMBs. It allows you to centralize your data in Azure Files while keeping a local cache on your on-premises Windows Server, providing fast local access and simplifying disaster recovery. This is a critical step to migrate file server to Azure Files guide effectively.
$resourceGroup = "SkyCore-FileServer-RG"
$syncServiceRegion = "eastus" # Must be in the same region as the storage account
$storageSyncServiceName = "SkyCoreFileSyncService"
# Create a Storage Sync Service
New-AzStorageSyncService -ResourceGroupName $resourceGroup -Name $storageSyncServiceName -Location $syncServiceRegion
# Download the Azure File Sync agent (run this on your on-premises server)
# Download URL changes with version, always get the latest from Microsoft Learn
# Example for a hypothetical latest version (check official docs for current link)
# Start-BitsTransfer -Source "https://aka.ms/afs/agent" -Destination "C:\temp\StorageSyncAgent.msi"
# Start-Process -FilePath "msiexec.exe" -ArgumentList "/i C:\temp\StorageSyncAgent.msi /quiet /norestart" -Wait
New-AzStorageSyncService: Creates the top-level Azure File Sync service. This is where your sync groups and registered servers will reside.- Agent Download: The agent must be installed on your on-premises Windows Server. The provided
Start-BitsTransferandStart-Processcommands are examples; always verify the latest download URL from Microsoft Learn.
Portal alternative: Navigate to Azure Portal > Search for "Azure File Sync" > Click "+ Create" > Select your Subscription, Resource group > Provide a Storage Sync service name (e.g., SkyCoreFileSyncService) > Select the same region as your storage account > Click "Review + Create". Once created, open the service > Under "Registered servers," click "Download sync agent" and install it on your on-premises Windows Server.
Run this to verify:
Get-AzStorageSyncService -ResourceGroupName $resourceGroup -Name $storageSyncServiceName | Select-Object Name, Location, ProvisioningState
Step 6: Register Windows Server and Create Sync Group
With the Azure File Sync agent installed, you now need to register your on-premises Windows Server with your Storage Sync Service. Following this, you'll create a Sync Group, which defines the synchronization topology – essentially, what data syncs where.
# On the on-premises Windows Server, after agent installation:
# You'll be prompted to sign in to Azure. Ensure the user has Contributor role on the Storage Sync Service.
# Register the server (replace placeholders)
$resourceGroup = "SkyCore-FileServer-RG"
$storageSyncServiceName = "SkyCoreFileSyncService"
Connect-AzAccount
Register-AzStorageSyncServer -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName
# On your management workstation or Azure Cloud Shell (or continue on server after registration):
$syncGroupName = "SkyCoreFilesSyncGroup"
$cloudShareName = "SkyCoreSMBFiles"
$storageAccountName = "skycorefilesyncstorage"
# Create a Sync Group
New-AzStorageSyncGroup -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName -Name $syncGroupName
Register-AzStorageSyncServer: This command connects your local Windows Server to the Azure File Sync service. You will be prompted to authenticate to Azure interactively.New-AzStorageSyncGroup: Creates a logical grouping for your files. A sync group consists of one cloud endpoint (your Azure file share) and one or more server endpoints (folders on your registered Windows Servers).
Portal alternative: On your registered Storage Sync Service > Under "Registered servers," ensure your server appears > Under "Sync groups," click "+ Sync group" > Enter a Sync group name (e.g., SkyCoreFilesSyncGroup) > Select your Storage account and Azure File share > Click "Create".
Run this to verify:
Get-AzStorageSyncGroup -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName -Name $syncGroupName | Select-Object Name, ServerEndpoints, CloudEndpoint
Step 7: Configure Cloud and Server Endpoints
The final step in configuring Azure File Sync is to define the endpoints. The Cloud Endpoint points to your Azure file share, and the Server Endpoint points to the specific folder on your on-premises Windows Server that you want to synchronize. Here, we'll also enable Cloud Tiering, a key feature for SMBs to optimize local storage.
$resourceGroup = "SkyCore-FileServer-RG"
$storageAccountName = "skycorefilesyncstorage"
$fileShareName = "SkyCoreSMBFiles"
$storageSyncServiceName = "SkyCoreFileSyncService"
$syncGroupName = "SkyCoreFilesSyncGroup"
$serverName = (Get-AzStorageSyncServer -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName).Name # Get actual registered server name
$serverLocalPath = "D:\\SharedFiles" # The local folder on your Windows Server to sync
# Add Cloud Endpoint
New-AzStorageSyncCloudEndpoint -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName -SyncGroupName $syncGroupName -Name $cloudShareName -StorageAccountResourceId (Get-AzStorageAccount -ResourceGroupName $resourceGroup -Name $storageAccountName).Id -AzureFileShareName $fileShareName
# Add Server Endpoint with Cloud Tiering enabled
# Local disk free space percentage threshold: 20% means 20% of disk space will be kept free
New-AzStorageSyncServerEndpoint -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName -SyncGroupName $syncGroupName -Name $serverName -ServerId (Get-AzStorageSyncServer -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName).ServerId -ServerLocalPath $serverLocalPath -CloudTiering `
-VolumeFreeSpacePercent 20 -TierFilesOlderThanDays 30
New-AzStorageSyncCloudEndpoint: Connects your Azure file share to the sync group.New-AzStorageSyncServerEndpoint: Connects your local server path to the sync group.-ServerLocalPath "D:\\SharedFiles": This is the local folder on your Windows Server that contains the data you want to synchronize. Ensure this path exists and has adequate permissions.-CloudTiering: Enables intelligent tiering.-VolumeFreeSpacePercent 20: Instructs Azure File Sync to ensure that at least 20% of the volume's free space is maintained by tiering less frequently accessed files to Azure.-TierFilesOlderThanDays 30: Files not accessed for 30 days or more will be eligible for tiering to the cloud, leaving only a reparse point (metadata) locally.
Portal alternative: Navigate to your Storage Sync Service > Click on your Sync group (e.g., SkyCoreFilesSyncGroup) > Click "+ Add server endpoint" > Select your Registered server, specify the Path to the local folder, and configure Cloud Tiering (e.g., "Enable cloud tiering," set volume free space policy to 20%, and date policy to 30 days) > Click "Create".
Run this to verify:
Get-AzStorageSyncServerEndpoint -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName -SyncGroupName $syncGroupName -Name $serverName | Select-Object Path, CloudTiering, VolumeFreeSpacePercent, TierFilesOlderThanDays
Step 8: Data Migration and Cutover
Once the server endpoint is added, Azure File Sync will immediately begin the initial synchronization, uploading data from your specified local folder to the Azure file share. This process can take significant time depending on your data volume and available bandwidth. During this initial sync, users can continue to access files on the on-premises server.
For large initial migrations, especially if you have an existing DFS-R (Distributed File System Replication) setup, it's often more efficient to pre-seed the Azure file share using a tool like Robocopy. However, for most SMBs, simply letting Azure File Sync handle the initial upload is sufficient and simpler.
# Monitor sync status (run this periodically on the server or in Azure Cloud Shell)
Get-AzStorageSyncServerEndpoint -ResourceGroupName $resourceGroup -StorageSyncServiceName $storageSyncServiceName -SyncGroupName $syncGroupName -Name $serverName | Select-Object Health, SyncActivity, TotalItemCount, UploadedItemCount, DownloadedItemCount
Once the initial synchronization is complete and you've verified data integrity:
- Verify Permissions: Ensure all AD users and groups have appropriate access to the synced files and folders.
- Update DNS/DFS Namespaces: If you use a DFS Namespace, update the folder target to point to the new server endpoint's share, or directly map drive letters to the new server path. If not using DFS-N, simply update user drive mappings to point to the local Azure File Sync cached folder (e.g.,
\\YourFileServer\SharedFiles). - Decommission Old Server (Optional): After a suitable monitoring period, you can decommission the original file server, retaining the new Azure File Sync enabled server as your primary file access point.
When to bring in a consultant
While this guide provides a clear path, certain scenarios can benefit significantly from expert assistance. If your SMB has complex Active Directory structures, requires intricate Group Policy configurations, needs a zero-downtime migration strategy, or integrates with specialized line-of-business applications, SkyCore Solutions is here to help. We can ensure optimal performance tuning, advanced security hardening, and a smooth transition with minimal disruption to your business operations. Navigating licensing, advanced networking (e.g., ExpressRoute), or implementing robust backup and disaster recovery plans often benefits from a seasoned perspective.
Book a free consultation