Azure Files
SMB vs NFS · SSD vs HDD · Identity auth · File Sync · Management models
Practice questions for this topic →
Protocols
| SMB | NFS 4.1 | |
|---|---|---|
| Clients | Windows, Linux, macOS | Linux |
| Media | SSD or HDD | SSD only |
| Redundancy | LRS, ZRS, GRS, GZRS | LRS, ZRS |
| Auth | Identity-based (Kerberos) or shared key | Host-based (no identity auth) |
| Semantics | Win32 ACLs, case-insensitive | POSIX, case-sensitive, hard and symbolic links |
| Internet access | Optional, SMB 3.0 or later | Not accessible |
A single share can't use both protocols, but SMB and NFS shares can exist in the same storage account.
Management models
| Model | Details |
|---|---|
| Classic file shares (Microsoft.Storage) | Inside a storage account; SMB and NFS, SSD and HDD, all redundancy types |
| File shares (Microsoft.FileShares) | Top-level resources without a storage account; per-share networking, billing and security; currently NFS only |
Identity sources (one per storage account)
| Source | Use when |
|---|---|
| On-prem AD DS | Domain-joined clients, existing AD |
| Microsoft Entra Domain Services | Cloud-managed domain in Azure |
| Microsoft Entra Kerberos | Hybrid identities on cloud or hybrid-joined clients |
Azure Files doesn't support identity-based authentication for NFS shares. You can enable only one identity source per account; disable the current one before switching.
Exam Tips
Tick each tip once you can answer it without looking.
“Replace on-prem file server; users keep AD credentials and NTFS permissions” → Azure Files SMB + AD DS identity-based auth.
“Linux apps need POSIX file share with hard links” → Azure Files NFS (SSD).
“Cache cloud file shares on branch servers; tier cold files” → Azure File Sync with cloud tiering.
“Entra-joined laptops access shares with hybrid identities” → Microsoft Entra Kerberos.
“NFS share must be geo-redundant” → Not supported (LRS/ZRS only), so use SMB or another DR approach.
“Avoid using storage account keys for file access” → Identity-based authentication.
“Low-latency file share for databases / AVD profiles” → Premium (SSD) file shares.
“Azure file share without a storage account” → File shares deployed with the Microsoft.FileShares provider (currently NFS only). Trap: Classic shares live in a storage account and support SMB and NFS.
“NFS versus SMB feature support” → NFS: POSIX, hard and symbolic links, SSD only. SMB: Win32 ACLs, Kerberos identity auth, SSD or HDD. Trap: NFS shares aren't internet accessible and support LRS and ZRS only.
“One share over both SMB and NFS” → Not supported, but SMB and NFS shares can coexist in one storage account. Trap: Only one identity source can be enabled per storage account.