The file share refuses to die: departmental shares, application config directories, the FSLogix profiles from yesterday, lift and shift apps with UNC paths in their veins. Azure Files is the managed SMB and NFS answer, File Sync is the hybrid bridge, and the difference between a smooth deployment and a support ticket generator is three decisions made up front.

Tier, Redundancy, and the Provisioned Model

Decision one is the billing model and tier. The provisioned v2 model prices capacity, IOPS, and throughput as dials you set, replacing the old guesswork where performance came bundled with size; provisioned SSD is the floor for anything interactive (profiles, application shares), provisioned HDD covers the archival and departmental long tail. NFS shares (SSD only) serve the Linux estate and require the private networking you were building anyway. Redundancy follows the storage post’s honesty: ZRS for shares that matter, and note that geo redundancy has real constraints with large file shares and NFS, so cross region protection for files is often Backup’s job or a sync topology rather than GRS reflex. Size against the measured IOPS and churn of the source server, which the File Sync assessment or a week of perfmon tells you, because undersized share performance manifests as mysterious application slowness two layers away from the actual throttle.

Identity: The Part Everyone Fights

SMB access control has two layers, share level RBAC roles and NTFS ACLs within, and the authentication source is the fork in the road. Entra Kerberos works for Entra joined and hybrid joined clients (the AVD case from yesterday and the modern laptop fleet) with no domain controller in the data path; classic AD DS integration remains for estates whose machines and ACL tooling live in Active Directory; storage account keys are the break glass, disabled by default per the invariants, never the plan. Migrate ACLs with the data, robocopy with the security flags or File Sync preserves them, and test with a pilot group before the cutover weekend, because the failure mode is everyone authenticating but the ACLs meaning nothing. Networking is the boring settled pattern by this point in the series: private endpoints, the DNS zones from the resolver post, public access off, and on premises clients reaching shares over ExpressRoute or VPN through that same private path, port 445 to the internet never entering the conversation.

File Sync: The Branch Office Answer

Azure File Sync turns Windows Servers into caching endpoints of a cloud share: the authoritative copy lives in Azure Files, servers hold what is hot, and cloud tiering evicts cold files to stubs recalled on open, so the branch file server with a full disk becomes a small cache in front of elastic capacity. The topology generalizes, multiple servers syncing one share gives branch offices local speed with central data, which quietly retires a generation of DFSR pain. Operational notes that matter: the server needs local capacity for the working set plus churn headroom (tiering thresholds by free space percentage), initial sync of terabytes deserves offline seeding or patience with bandwidth shaping, and antivirus exclusions for the sync paths prevent the classic recall storm where a full scan pulls every stub back from the cloud. Protection lands where the backup post put it: Azure Backup snapshots the cloud share (the single source), restore drills include both file level and full share scenarios, and the on premises servers stop being backup targets at all, which was half the point. The file server is dead; long live the file share, managed, private, and finally someone else’s hardware problem.

Cheers
Osama