Azure Storage Blog articles

Secure, Keyless Application Access with Managed Identities - Now GA in Azure Files SMB

Priyanka-Gangal — Mon, 20 Apr 2026 17:57:56 GMT

As enterprises modernize applications and strengthen their security posture, identity is central to how applications access shared storage. Traditional identity models relying on account keys, stored credentials, or domain‑joined infrastructure add operational overhead and introduce security risks such as credential leakage, lack of identity attribution, and excessive privilege if shared keys are compromised. Today, we are excited to announce the General Availability (GA) of Managed Identity support for Azure Files over SMB, enabling applications and virtual machines to securely access Azure Files without secrets, passwords, or key distribution.

Managed Identity support enables customers to meet modern enterprise security standards without reliance on storage account keys, streamlining how organizations securely enable file‑based application access and reducing the operational overhead of filing internal exceptions. New storage accounts can support secure, identity‑based SMB access out of the box, while existing deployments can get secure by enabling Managed Identity authentication.

From web application workloads such as WordPress, to databases on Azure Kubernetes Service (AKS), to CI/CD pipelines, applications require secure access. In a world where security is foundational, continued reliance on key-based access conflicts with Zero Trust principles and least privilege access.

What’s New In GA

AKS Workload Identity Support

AKS Workload Identity (preview) extends the traditional managed identity model for Kubernetes by shifting the identity from the node to pods. Instead of inheriting the identity of the underlying cluster, each Kubernetes pod can use its own federated identity, mapped directly to a Microsoft Entra ID principal.

This feature enables:

Pod-level identity isolation, rather than cluster-level
Least-privilege access with secure RBAC
Seamless scaling and redeployment, without identity reconfiguration
No secrets, no key rotation, no credential injection

When combined with Azure Files over SMB, Workload Identity allows AKS workloads to access shared file storage securely and natively per pod, using the same identity-driven model as cluster level managed identities. Now available with AKS 1.35, for customers specifically in the financial services industries, AKS Workload Identity enables per‑application, least‑privilege access to Azure Files without credentials, improving isolation and auditability. This allows regulated, stateful workloads to run securely on AKS while meeting strict compliance and regulatory requirements.

Co-existence of Application Identities and end-user identity access

Azure Files now enables both Managed Identity and end‑user access on the same storage account, with users and applications independently authenticated via Entra ID and authorized through a shared permissions model.
This unified access model eliminates the need for duplicate storage or credentials, enabling secure collaboration, troubleshooting, and automation on shared data without compromising governance or compliance.

This supports scenarios such as:

Developers accessing the same file share as an application for debugging
Admins managing content used by automated workflows
Hybrid environments with user-driven and app-driven access

Simplified Storage Account enablement via the Azure portal

We have now added a dedicated Managed Identity property that makes enabling identity‑based SMB access simple and transparent via the Azure portal for new as well as existing storage accounts. With a single configuration at the storage account level, customers can allow applications to authenticate to Azure Files using Managed Identities. This portal experience supports incremental adoption, making it easy to modernize authentication while maintaining compatibility with existing user access and governance models.

Get Started with Managed Identities with SMB Azure Files

Start using Managed Identities with Azure Files today at no additional cost. This feature is supported on HDD and SSD SMB shares across all billing models. Refer to our documentation for complete set-up guidance.

Whether provisioning new storage or enhancing existing deployments, this capability provides secure, enterprise‑grade access with a streamlined configuration experience.

For any questions, reach out to the team at azurefiles@microsoft.com.

Simplify On-prem File share Migration to Azure: Discover & assess suitability using Azure Migrate

bapic — Mon, 20 Apr 2026 09:49:14 GMT

Migrating on‑premises file servers to the cloud is a complex infrastructure transformation—not just a data move. Many organizations lack the visibility needed to decide whether to rehost or modernize file shares spread across Windows and Linux servers. Azure Migrate now extends its discovery and assessment capabilities to SMB and NFS file shares, enabling a data‑driven approach to modernizing on‑premises file workloads with Azure Files, or alternatively rehosting to deployment within an Azure VM.

We are pleased to introduce the public preview of Azure Migrate’s new comprehensive discovery and assessment of on-premises SMB and NFS file shares for migration to Azure Files. This enhancement simplifies the migration process by integrating discovery and evaluation tools for SMB and NFS shares across both Windows and Linux platforms. Users can efficiently identify file shares, analyze their compatibility, and compare cost benefits for transitioning to Azure Files, all within an intuitive and streamlined interface.

Why does this matter

File shares remain a foundational service for most workloads - supporting applications, analytics, user home directories, and shared content. Planning such a vast amount of data for migration can be slow, manual, and fragmented. This new Azure Migrate capability is designed to help with:

Reduce migration planning from months to weeks through automated discovery and assessment of SMB and NFS file shares.
Perform holistic migration planning of your data and storage alongside servers, applications and data bases from within Azure Migrate experience.
Modernize confidently to Azure Files with tailored SKU recommendations, readiness assessments, and comprehensive cost insights, enabling you to build a clear business case by comparing ongoing on-premises and Azure Files costs.

What’s available in public preview

Discover and view details of all on-premises SMB, NFS shares hosted on Windows and Linux servers
Group, tag, filter shares by Production, non-production, project, business group for better planning.
Create and review assessment for each share, its target Azure Files SKU based on region, redundancy, pricing options and media type.
Generate a business case for selected group of shares running on Azure Files against on-premises cost.

How do you get this feature? Install the latest Azure Migrate appliance, or enable the auto update feature for the appliance will receive this new capability. All existing SMB, NFS file shares will be reported in the Azure Migrate portal along with their Windows and Linux hosts. You do not need to perform any additional steps to discover the shares.

End-to-end experience

The experience is fully integrated into Azure Migrate and follows a familiar, guided workflow as below.

1. Discover on‑premises file servers and file shares

You can start by creating an Azure Migrate project in the Azure portal and enabling discovery using the Azure Migrate appliance. The appliance can be deployed in connected or disconnected mode and runs on VMware, Hyper‑V, or physical servers. Once deployed, the appliance automatically discovers file servers and the file shares they host, including:

Operating system (Windows or Linux)
File share protocol (SMB or NFS)
Associated volumes
Estimated capacity
Basic performance metrics such as IOPS and throughput (when performance collection is enabled)

Discovered file shares appear directly in Azure Migrate inventory views, where they are surfaced as inventory items under respective Windows or Linux systems. This makes it easy to filter, tag, and review all shares at scale.

2. Build a business case

The next step is to create a business case. This offers a clear comparison of on-premises costs versus Azure, highlights long-term savings and operational benefits, and justifies modernizing to Azure Files rather than rehosting file servers on virtual machines. This allows IT leaders to make data-driven decisions confidently.

3. Create and review an Azure Files assessment

Once you have finalised your business case and decided to move to Azure Files, you can initiate an Azure Files assessment right from the Azure Migrate platform. The assessments are adaptable, allowing you to focus solely on file shares, include their parent servers, or even expand to scenarios that cover VMs, databases, and file shares—reflecting real-world planning needs. Each assessment reviews readiness and provides recommendations based on inventory and performance metrics gathered. Furthermore, you can tailor assessment settings, including selecting a target Azure region, pricing and savings preferences, media type, redundancy options, and choosing either performance-based or as-is sizing. The assessment offers a detailed overview of migration readiness and economic factors, supporting well-informed decisions for subsequent actions.

Key insights include:

Readiness states for each file share (Ready, Ready with conditions, or Not ready)
Recommended Azure Files SKU based on performance and suitability. For example, Azure Files provisioned v2 premium SSD for a NFS 4.1 share as target.
Monthly cost estimates for the recommended SKU.
On‑premises vs Azure TCO comparison, helping customers understand long‑term cost implications

Azure Migrate also identifies potential warnings and provides necessary remediation guidance. For example, when a redundancy type is not available in an Azure region, it is flagged as ready with conditions and recommend choosing an alternative redundancy type and fallback to next available option.

Prepare for migration with appropriate tools

Once you are ready to migrate, Azure Migrate also highlights recommended migration tools as part of the assessment. Azure Storage Mover is the default recommended path for file share migrations—providing a first party, managed service to move data efficiently to Azure Files. To learn more about Microsoft’s recommendations to unstructured data migration using other tools, please visit: https://aka.ms/migratemydata.

Learn more about creation of assessment and review assessment to get started with understanding your on-premises file shares estate today. Write to us at migratemydata@microsoft.com for any questions or feedback - we look forward to hearing from you!

Unlocking AI-Ready Unstructured Data at Scale with Komprise and Azure

dmalbrough — Thu, 02 Apr 2026 09:53:30 GMT

Why Move Unstructured Data to Azure

On-premises storage environments are often over-provisioned to accommodate future growth, driving costs and operational complexity. Azure’s cloud-based storage platform enables organizations to right-size their environments through elastic scaling and Microsoft’s global economies of scale. This flexibility is especially critical for regulated industries managing sensitive data at massive scale.

Azure also delivers enterprise-grade security capabilities, including immutability and object locking, which protect data against ransomware and malicious deletion. By moving unstructured data to Azure, organizations gain not only cost efficiency, but also a more resilient and secure data foundation.

A strong example of this approach is the Florida Department of Environmental Protection. With support from Komprise and funding through Microsoft’s Azure Migrate program, the department successfully migrated large volumes of data to Azure, enabling the phase-out of on-premises data centers while maintaining access to data for analysis across regions. This demonstrates how organizations can modernize data infrastructure without disrupting business operations.

Hybrid Cloud and Intelligent Tiering

Most enterprises operate in hybrid environments, balancing on-premises systems with cloud storage. Komprise and Microsoft address this reality by enabling intelligent tiering of unstructured data across environments.

Using Azure Blob Storage, organizations can transparently move cold and infrequently accessed data to lower-cost cloud tiers while keeping frequently accessed data close to applications and users. This approach reduces pressure on expensive on-premises storage infrastructure without sacrificing accessibility. For example, a major healthcare organization achieved approximately $2.5 million in storage cost savings by tiering cold data to Azure while maintaining seamless access for clinicians and applications.

AI Depends on Data Curation

AI's efficacy is reliant on data quality. The need for high-quality and curated data cannot be enough emphasized so AI can generate meaningful and accurate results. In partnership with Komprise, organizations can efficiently cleanse and enhance their data by identifying and eliminating redundancies. By curating data before AI processes, organizations have achieved impressive accuracy improvements—as demonstrated by a financial services firm that increased their AI output accuracy by 135%.

Making Data AI-Ready on Azure

Azure provides a powerful execution platform for AI and Komprise enhances this by bringing structure to unstructured data through its data classification, metadata extraction capabilities and with search, curation and intelligent ingestion via its data workflow and governance capabilities. These ensure only high-quality, relevant and compliant data feeds AI workflows.

This approach enables smoother integration with AI services and applications such as Microsoft Foundry and Copilot, while preserving flexibility. By treating data readiness as a foundational step, organizations can accelerate time to value from AI while reducing risk.

Security, Governance, and Responsible AI

As cyber threats and regulatory requirements continue to intensify, security and governance are no longer optional. Organizations must manage data flows carefully, maintain auditability, and protect sensitive information—especially when using data for AI.

Azure’s built-in security capabilities, including immutability, versioning, and backup, provide a strong foundation for protecting unstructured data. Komprise complements these capabilities by automating data governance policies, enforcing compliance, and helping organizations maintain visibility and control across hybrid environments. Together, they enable organizations to use data safely and responsibly, supporting both regulatory compliance and responsible AI practices.

Conclusion

As AI adoption accelerates, success increasingly depends on data readiness rather than algorithms alone. Clean, well-governed, and properly placed data is the foundation for meaningful AI outcomes.

By combining Azure’s scalable and secure cloud platform with Komprise’s intelligent data management, organizations can reduce costs, strengthen security, and unlock real value from unstructured data at scale.

To learn more, watch the Microsoft–Komprise fireside chat, where we discuss customer examples, architectural best practices, and proven approaches for managing unstructured data across hybrid environments. We also invite you to explore our joint Azure and Komprise solutions to see how you can move from data sprawl to AI value while maintaining control, security, and flexibility.

In a recent fireside chat now available on YouTube, Azure Storage VP Aung Oo joined Komprise COO Krishna Subramanian to explore how Azure and Komprise are empowering customers to mobilize, curate, and optimize unstructured data to make it AI-ready.

To leverage the Storage Migration Program with Komprise to migrate your data to Azure find more information at Microsoft Marketplace. To take advantage of the full Komprise suite including automated tiering and smart workflows – additional details are available here.

Enterprise Identity Meets Secure File Transfer: Entra ID Public Preview on Azure Blob Storage SFTP

JeevanManoj — Fri, 13 Mar 2026 10:37:25 GMT

We are excited to announce the public preview of Entra ID-based access for Azure Blob Storage SFTP. This new capability enables you to use Microsoft Entra ID (formerly Azure Active Directory) identities (including guest users via Entra External Identities) to securely connect to Azure Blob Storage via SFTP without needing local users. This feature eliminates the operational overhead of managing local SFTP users and passwords by introducing enterprise-grade identity management powered by Microsoft Entra ID.

For IT administrators and security teams, this means no more creating, tracking, rotating, or decommissioning local SFTP credentials. For developers and architects, it means seamless integration with your existing identity infrastructure. For business users, it means faster, more secure access to the data they need, all while maintaining compliance with enterprise security policies.

Azure Blob Storage SFTP

Azure Blob Storage SFTP natively enables secure file access and management without third-party solutions. This simplifies operations for customers and removes the need for complex, custom SFTP solutions. Until this Public Preview, Azure Blob Storage SFTP utilized a form of identity management called local users as the only authorization mechanism. Local users must use either a password or a Secure Shell (SSH) private key credential for authentication. Learn more about local users here.

The Challenge: SFTP Local User Management

Organizations currently face challenges when managing SFTP access at scale with Azure Storage SFTP Local Users. Local User based SFTP access require IT teams to:

Manually create and provision local user accounts for each SFTP user
Generate, distribute, and securely store SSH keys or passwords
Implement custom workflows for lifecycle management
Manage offboarding processes to ensure departed users lose access immediately
Audit and track access across disconnected identity silos
Handle external partner and vendor access through ad-hoc, often insecure methods

The Solution: Enterprise Identity Meets Secure File Transfer

With Entra ID-based access for Azure Blob Storage SFTP, you can now leverage your organization's centralized identity platform to authenticate and authorize SFTP users. This integration brings the full power of Microsoft Entra ID to your file transfer workflows, delivering the following benefits:

1. Eliminate Local User Management

Simplify SFTP management by assigning access with Entra ID—no separate SFTP accounts needed.

No local credential generation or distribution—users authenticate with their existing corporate credentials
No orphaned accounts when users change roles or leave the organization
Reduced attack surface by eliminating static, long-lived local credentials
Centralized user lifecycle management through your existing identity platform

2. Enterprise-Grade Identity and Security

Leverage the full security capabilities of Microsoft Entra ID for your SFTP infrastructure:

Multi-Factor Authentication (MFA): Require additional verification factors beyond passwords, significantly reducing the risk of account compromise
Conditional Access: Define policies that grant or block access based on user location, device compliance, sign-in risk, and other conditions
Identity Protection: Benefit from Microsoft threat intelligence and risk detection to identify and respond to compromised accounts
Privileged Identity Management (PIM): Provide just-in-time elevated access for administrative operations

3. Native Azure RBAC, ABAC, and ACL Integration

Your SFTP access control seamlessly integrates with Azure comprehensive authorization framework:

Role-Based Access Control (RBAC): Assign built-in or custom roles at the storage account, container, or even blob level
Attribute-Based Access Control (ABAC): Create sophisticated access policies based on resource tags, user attributes, and environmental conditions
Access Control Lists (ACLs): Apply fine-grained permissions at the directory and file level for hierarchical namespace-enabled accounts
Unified Permission Model: SFTP access respects the same permissions as REST API, Azure CLI, and other access methods—no separate permission system to manage

4. Faster SFTP Onboarding and Time-to-Value

Onboard new SFTP users or partners in minutes instead of hours or days, saving significant time and boosting business agility.

5. Secure External Collaboration with Entra External Identities

Seamlessly enable secure external SFTP access by allowing partners to authenticate with their own credentials using Entra External Identities (Azure AD B2B).

External users authenticate with credentials they already manage
Full audit trail of external user activity
Ability to apply Conditional Access policies to external users
Automatic access revocation when B2B relationships end

Real World Scenarios

Financial Services: A bank receives daily transaction files from merchants via SFTP. Merchants authenticate with their own Entra ID credentials (B2B collaboration), MFA is enforced, and access is restricted to assigned directories. Access is instantly revoked when a merchant is removed from the B2B directory.
Healthcare: A hospital exchanges patient data with insurers and labs. Entra ID authentication ensures only authorized staff access sensitive PII, with full audit logs for HIPAA compliance. Conditional Access restricts connections to approved locations and devices.
Media & Entertainment: A production company enables freelance editors and agencies to transfer large media files. Entra External Identities provide time-limited access and automatic revocation when projects end—no need for local SFTP accounts.
Manufacturing: A manufacturer receives CAD files and orders from suppliers using SFTP. With Entra ID, suppliers use unified credentials and access policies across all systems, streamlining supply chain management.

How It Works

Entra ID simplifies SFTP access to Azure Blob Storage by authenticating users with their corporate credentials. After authentication, users receive a short-lived Open SSH certificate to connect. The service verifies certificate validity and user permissions, enabling secure file operations and automatic access revocation in line with current identity policies. Learn more here.

Getting started with the Public Preview

We encourage you to try Entra ID-based access for Azure Blob Storage SFTP in your non-production environments today. Learn more about how to register for the preview and get started with the detailed ms docs learn guide here. This preview gives you an opportunity to shape the feature development by providing feedback on what works well and what could be improved.

Note: Local user accounts for SFTP access are still supported, but we strongly recommend switching to Entra ID-based access for greater security, simpler management, and automatic access control.

Questions or feedback? We would love to hear from you! Reach out to our team at blobsftp@microsoft.com

We are excited to bring enterprise-grade identity management to Azure Blob Storage SFTP, and we cannot wait to see how you use this capability to simplify operations, enhance security, and enable new collaboration scenarios.

Happy transferring!

Understanding the Standard HDD I/O unit size update and what it means for your workloads

austin-ma — Wed, 22 Apr 2026 15:18:03 GMT

As Azure continues to evolve to support modern workload patterns, we are refining how transactions are measured for Standard HDD Managed Disks. This update helps align billing more closely with actual I/O behavior while maintaining predictable cost controls for customers.

In this post, we’ll walk through what’s changing, how transaction billing is calculated, and what this may mean for your workloads.

With this update, the number of billable transactions for select Standard HDD disk sizes (S4, S6) will be measured using 16 KiB I/O units.

I/O operations ≤ 16 KiB count as one billable transaction
I/O operations > 16 KiB are counted as multiple billable transactions

Example

A 64 KiB read/write on an S4 disk = 4 billable transactions
A 4 KiB read/write on an S4 disk = 1 billable transaction

This update provides more consistent alignment between workload behavior and transaction billing. For latest information on regional availability, please refer to the Standard HDD Managed Disks documentation.

Built-in transaction caps to help manage costs

To maintain predictable cost boundaries, Azure will implement hourly caps on billable transactions for the Standard HDD disk sizes with an I/O unit size.

If a disk exceeds its hourly cap, additional transactions in that hour are not billed. The transaction caps are listed below and on the Azure Disks Pricing Page.

Disk Size	Disk GiB	Hourly Billable Transaction Cap
S4	32 GiB	450,000
S6	64 GiB	858,000

These caps help provide cost predictability, particularly for bursty workloads.

Understanding potential cost impact

Workloads with larger I/O sizes and sustained IOPS may see changes in the number of billed transactions on their invoice. Workloads with small or infrequent I/O operations may see little to no impact.

Determining your workload’s cost

The following table lists three different examples to illustrate how transaction billing* compares for different IO load intensities on an S4 Standard HDD disk vs. an E4 Standard SSD disk. Assume the disks are in Central US region.

Workload Average

Billable Transactions / hour on Standard HDD

Billable Transactions / hour on Standard SSD

Total Cost on Standard HDD

Total Cost on Standard SSD

Low

4 KiB workload, 10 IOPS

36,000

(10 billable transactions * 60 seconds * 60 minutes)

36,000

(10 billable transactions * 60 seconds * 60 minutes)

$2.85/mo

(36,000 * 730 hours * $0.0005 / 10,000 transactions) = $1.31 Transaction cost

$1.31 + $1.54 capacity/mo cost = $2.85/mo

$7.66/mo

(36,000 * 730 hours * $0.002 / 10,000 transactions) = $5.26 Transaction cost

$5.26 + $2.40 capacity/mo cost = $7.66/mo

Medium

32 KiB workload, 20 IOPS

144,000

(40 billable transactions with the IO Unit Size * 60 * 60)

43,400

(after Standard SSD transaction cap)

$6.80/mo

$8.73/mo

High

64 KiB workload, 40 IOPS

450,000

(after Standard HDD transaction cap)

43,400

(after Standard SSD transaction cap)

$17.97/mo

$8.73/mo

*Any operation against the storage is counted as a transaction, including reads, writes, and deletes. Host caching being enabled might affect the number of transactions against the storage that are counted.

Choosing the right disk for your workload

Running workloads on SSD-based disk types may also unlock higher availability, higher reliability, more consistent performance, and lower latency.

For OS disks running on Standard HDD, consider migrating to Standard SSD or Premium SSD Managed Disks. Standard HDD OS disks will be retired in September 2028.
For non-OS disk workloads, consider high performance and flexible provisioning benefits of Premium SSD v2 Managed Disks, or benefits of Standard SSD or Premium SSD Managed Disks. Learn more here about the different disk types and their benefits.
To learn more about switching your disk types, view our documentation page.

To learn more about the billing changes, view the Pricing Page and documentation for Standard HDD Managed Disks.

Public Preview: Restrict usage of user delegation SAS to an Entra ID identity

ellievail — Tue, 03 Mar 2026 22:43:07 GMT

Shared access signatures (SAS) grant time-bound, scoped access to Azure Storage resources without sharing account keys. Over time, Azure Storage has continued to strengthen SAS security, moving from account keys to user delegation (UD) SAS secured by Microsoft Entra ID.

Today, we’re taking the next step forward by announcing public preview for user-bound user delegation SAS, an extension of UD SAS that ensures a SAS token can only be used by a specific Entra ID identity. This new capability helps customers significantly reduce the risk of unintended access while preserving the flexibility of SAS.

UD SAS is an existing feature which utilizes Entra ID and Azure role-based access control (RBAC). Users retrieve a user delegation key tied to their Entra ID account and then use it to create SAS tokens granting a subset of their own access rights. The resulting token can be traced to the delegator and can only be valid for up to 7 days. User-bound UD SAS is an extension of user delegation (UD) SAS which allows users to create a more secure SAS token by restricting the usage of the SAS token to an end user identity. The delegator specifies the Entra identity (security principal) of the end user in the SAS token and the end user needs to authenticate to Entra ID to use the token. The end user can either be in the same tenant or a different tenant as the delegator.

Pricing and availability

There is no additional cost for user-bound user delegation SAS. Pricing is based on the standard read/write transaction costs for your storage account type. To learn more, please see Azure Storage Pricing.

User-bound user delegation SAS is in preview in all public regions. This preview will be available via REST APIs, SDKs, PowerShell, and CLI experiences.

Getting started

Getting started is simple:

User-bound user delegation SAS is available on all GPv2 storage accounts in public regions.

If the end user of the SAS token is in a different tenant, the allowCrossTenantDelegationSas setting must be enabled on the storage account. If you are not planning on using this feature cross-tenant, the account setting can remain disabled.

Perform the following steps in the create a user delegation SAS documentation to generate and use a user-bound UD SAS token:

Ensure you have the correct RBAC roles assigned to the delegator to create a user delegation key. These roles will include the Storage <Service> Data Contributor and Storage <Service> Delegator (replace Service with the respective service you are using). Here are all of the applicable roles for each service:

Azure Blob	Azure Table	Azure Files	Azure Queue
Storage Blob Data Contributor	Storage Table Data Contributor	Storage Files Data Contributor	Storage Queue Data Contributor
Storage Blob Delegator	Storage Table Delegator	Storage Files Delegator	Storage Queue Delegator

Get a user delegation key (instructions here)
Get the OAuth object ID and tenant ID from your end user. They will have to get these IDs (instructions here) and provide them to you.
Create the user-bound user delegation SAS token (instructions here. Note that the steps are the same as for a normal UD SAS token; you will just have to specify the end user and tenant if applicable).
Share the SAS token to the application/user intended to access Azure Storage.
Tokens should be passed within applications automatically or shared via key vault for best practice.

Feedback

If you have questions or feedback, please fill out this feedback form. If you need help, create a support request.

Azure Migrate: Now Supporting Premium SSD V2, Ultra and ZRS Disks as Targets

Lakshya_Jalan — Wed, 18 Feb 2026 17:22:53 GMT

We are excited to announce that we have added assessment and migration support for Premium SSD v2,Ultra Disk and ZRS Disks as storage options in Azure Migrate, with Premium SSD v2 and ZRS Disks now Generally Available and Ultra Disk in Public Preview. This further enhances the assessment and migration experience Azure Migrate offers and allows you to bring your mission critical workloads to these key Azure Storage offerings seamlessly.

What’s New

Additional Assessment targets: Premium SSD v2 and Ultra Disks

As part of the migration journey to the cloud, Azure Migrate makes recommendations on what cloud resources to move your workloads to. Post successful discovery of on-prem workloads, Azure Migrate utilizes multiple parameters like size, IOPS, and throughput to make target recommendations in Azure. Instead of just static sizing, assessments can map actual performance demand to Azure VM and disk SKUs, optimizing performance, resiliency, and total cost of ownership to give you a tailored recommendation that fits your cloud migration journey.

With today’s announcement, we are adding more supported disks to Azure Migrate, providing you with improved guidance to ensure that you land on the resources in Azure that align with your goals.

If you are looking to migrate your demanding on-premises applications and workloads to Azure, you will benefit from these advanced disk options, which come with greater flexibility and enhanced performance. For example, Premium SSD v2 disks decouple capacity from performance, allowing you to dial IOPS and throughput precisely to your workload’s needs. For high-end scenarios, Ultra Disks offer the highest performance among Azure managed disks, while ZRS disks provide zonally redundant storage to further protect your data. With these included in Azure Migrate’s assessment engine, you end up with a right‑sized, data‑driven target configuration that aligns Azure storage choices with how workloads actually run.

Below is a snippet of how the assessment recommendations appear in Azure Migrate for Premium V2 SSD disks. Customers can get details on the disk type, provisioned IOPS, throughput, cost, and seamlessly migrate using the assessment to the recommended target.

Detailed view of Azure Managed disk recommendations for source on-prem disks in an assessment.

Migrating to Premium SSD v2 and Ultra Disks in Azure Migrate

When Premium SSD v2 or Ultra disks are identified as the optimal targets based on workload characteristics during the assessment phase, they can be auto-populated seamlessly into the migration process. This workflow accelerates the lift-and-shift of on-prem disks to Azure’s high performance managed disks. Below is a snippet from the replication step during migration:

Assessing and Migrating to ZRS Disks in Azure Migrate

Azure Migrate also has enhanced resiliency by supporting migration to ZRS Disks during Migration. Zone-Redundant Storage (ZRS) for Azure Disks synchronously replicates data across three physically separate availability zones within a region - each with independent power, cooling, and networking - enhancing Disk availability and resiliency.

While creating Assessments in Azure Migrate, you can configure a range of target preferences, including the newly introduced option to enable zone-redundant storage (ZRS). You can opt-in to enable ZRS Disk recommendations by editing the Server (Machine) default settings in the Advanced settings blade.

Since the preview announcement for these capabilities, recommendations for Ultra, Premium v2 and ZRS Disks have led to petabytes of data being successfully migrated into Azure. Below is a quote from our Premium v2 (Pv2) customer that was provided during the preview:

"Through this preview, we have Pv2 disks recommendations in place of Pv1, which is beneficial for our estate during migration in terms of both cost and performance. We are now awaiting General Availability "

– Yogesh Patil, Cloud Enterprise Architect, Tata Consultancy Services (TCS)

With these added capabilities, Azure Migrate and Azure disk storage are more ready than ever for migrating your most demanding and mission-critical workloads. Learn more about Azure Migrate and for expert migration help, please try Azure Accelerate. You can also contact your preferred partner or Microsoft field for next steps. Get started in Azure today!

Azure File Sync: Azure Arc Integration, Additional Regions, and Secure Syncing

grace_kim — Fri, 16 Jan 2026 18:02:58 GMT

As organizations accelerate their cloud journeys, the ability to modernize file data without disrupting daily operations is critical for enterprises. Azure Files and Azure File Sync empower IT and devops teams to seamlessly bridge on-premises Windows File Servers with the flexibility and scale of the cloud. With the latest updates, Azure File Sync is now available in four new regions—bringing data closer to users for regional residency. This release also introduces a modern, identity-driven approach to authentication, providing end to end secure access with managed identities. Azure File Sync now provides simplified onboarding via Azure Arc integrating with the Azure hybrid management experience. With simplified onboarding, secure access and expanding list of regions, Azure File Sync enables organizations to seamlessly expand their hybrid file services, ensuring predictable cost, and scale.

Simplified deployment with Azure Arc extension

Customers using Azure Arc managed servers can now easily deploy Azure File Sync using the Azure Arc extensions. With Azure Arc, customers can simply add the File Sync agent to their servers using a few clicks on portal, or by using an automated workflow with PowerShell, or CLI. The Azure Arc extension model provides a trusted and predictable installation and upgrade experience, with built-in security. Once installed, the Arc extension simplifies Azure File Sync deployments for ARC managed servers.

Beginning January 2026, File Sync will be available at no per‑server cost for customers using Windows Server Software Assurance with Azure Arc and File Sync agent v22 or later. As your environment grows, this reduces the incremental cost of adding servers and reinforces Azure File Sync as a scalable foundation to move your data to Azure.

Azure File Sync available in 4 new regions

Azure File Sync is now generally available in Italy North, New Zealand North, Poland Central, and Spain Central, adding top requested new geographies to the service. With these additions, customers have even more flexibility to keep data close to users, align with regional mandates and regulatory requirements, and improve performance for regional workloads. This matters especially for customers modernizing branch offices, factories, retail locations, or government sites, where the ability to select a region that is physically close to the workload can be a key part of the storage strategy. As Azure continues to grow, File Sync is growing with it, ensuring that customers can bring hybrid file services wherever their business expands.

Secure by default with Managed Identities

Managed Identities support for Azure File Sync was introduced with v20, to ensure secure end-to-end access by default between the File Sync Server, Storage Sync Service and Azure Files, using Microsoft Entra ID. This reduces security risk of using passwords and operational effort to rotate keys. This means that customers don’t need to configure storage account keys or worry about resetting server certificates when using Azure Files or Azure File Sync. We have now further extended this support to Managed Identities for Azure Files SMB.

Get Started

Whether you are provisioning new storage, expanding to new regions, or modernizing existing deployments, these capabilities provide secure, enterprise-grade access with a streamlined configuration experience.

Refer to the documentation below to get started:

For any questions, please reach out to the team at azurefiles@microsoft.com

User delegation SAS for Azure Tables, Azure Files, and Azure Queues is now Generally Available

ellievail — Wed, 01 Apr 2026 20:27:47 GMT

We’re excited to announce that user delegation (UD) SAS is now generally available for Azure Tables, Azure Files, and Azure Queues in all regions.

User delegation SAS is already available for Azure Blobs, and we are now extending support to Azure Tables, Azure Files, and Azure Queues. This will allow users to create a more secure SAS token than account or service SAS by tying the SAS token to the creator’s identity.

UD SAS extends Entra ID and Azure role-based access control (RBAC) for Azure Storage, meaning lower-privileged users and services can now delegate subsets of their access to clients, using a pre-authorized URL. Clients retrieve a user delegation key tied to their Entra ID account and then use it to create SAS tokens granting a subset of their own access rights.

This extension of User Delegation Key based SAS enables delegated access at multiple granularities—including table, table entity, queue, queue message, file share, and individual file.

Pricing and availability

There is no additional cost for user delegation SAS. Pricing is based on the standard read/write transaction costs for your storage account type. To learn more, please see Azure Storage Pricing.

UD SAS for Azure Tables, Azure Files, and Azure Queues is generally available in all regions. This capability is available via REST APIs, SDKs, PowerShell, and CLI experiences. Note: this feature is only available in SDKs, PowerShell, and CLI for Azure Files and Azure Queues, but available in all three services for REST APIs.

Getting Started

Getting started is simple:

All general-purpose v2 storage accounts are eligible to use UD SAS. There is no account setting that must be enabled to use this feature.

Perform the following steps in the create a user delegation SAS documentation to generate and use a UD SAS token:

Ensure you have the correct RBAC roles assigned to create a user delegation key. These roles will include the Storage <Service> Data Contributor and Storage <Service> Delegator (replace Service with the respective service you are using)

Get a user delegation key (instructions here)

Create the user delegation SAS token (instructions here. Note the steps are similar for each service, but permissions vary slightly from service to service)

Share the SAS token to the application/user intended to access storage data

Tokens should be passed within applications automatically or shared via key vault for best practice

Feedback

If you have questions or feedback, please fill out this feedback form. If you need help, create a support request.

Secure, Seamless Access using Managed Identities with Azure Files SMB

Priyanka-Gangal — Mon, 15 Dec 2025 17:46:43 GMT

As organizations evolve their application and storage environments, whether on‑premises, hybrid, or cloud, secure access is top of mind. Organizations are vigilant about protecting sensitive data while enabling agile application access across distributed environments. SMB shares are commonly used for persistent storage in applications like AKS for container workloads, web applications, and App Services. Traditional models that rely on credentials like storage account keys do not meet the demands of a Zero Trust architecture, where every access request must be verified explicitly, granted with least privilege, and designed to assume malicious access from bad actors.

We are excited to announce the Public Preview of Managed Identities support with Azure Files SMB. This capability provides a secure, identity-driven approach for customer applications that eliminates credentials-based access and integrates seamlessly with MS Entra ID. Azure virtual machines, containers, and applications running in Azure can now authenticate to Azure Files using their own managed identity, and mount shares using short lived OAuth tokens over Kerberos. This unlocks secure file share access for both first party and customer applications, including Azure Kubernetes Service (AKS), Azure Functions, App Services, and other cloud native services

By leveraging Managed Identities, customers gain:

Zero Trust Alignment–Identity tied to a specific resource, token refreshes every hour, and no passwords or keys to manage or rotate with Azure handling end-to-end identity management
Role Based Access Control – Built-in RBAC for least-privilege enforcement
Compliance Mandate Resolution – Compliant with FIPS, removing need for NTLMv2
Multi-Client Support – Works with Windows and Linux clients over SMB

This capability brings a secure, simple, and scalable access model that helps organizations meet industry standard security requirements while inheriting Microsoft Entra ID’s enterprise grade identity, governance, and security capabilities for file shares.

Securing Real World Applications

To illustrate how Managed Identities strengthen security, the following example workloads highlight where customers will benefit from this capability.

Eliminate Secret Sprawl for Continuous Integration, Continuous Deployment (CI/CD) workloads

Azure Files SMB provides a centralized location for storing software development artifacts generated during CI/CD pipelines. CI/CD workloads span far beyond application code, covering infrastructure updates, data engineering workflows, ML pipelines, and compliance automation, making them foundational to modern DevOps practices.

Build agents in Azure DevOps or other CI/CD systems often run on both Linux and Windows, requiring a common storage backend for binaries and configuration files. Historically, these agents authenticated to Azure Files using storage account keys. With Managed Identities, build agents can now authenticate using their own identity from Microsoft Entra ID, with authorization governed through Azure RBAC. This enhances security, removes static credentials, and simplifies compliance.

“Managed Identities support with SMB shares will enable us to remove dependencies on storage account keys to run our CI/CD pipelines, enabling stronger security and alignment with Zero-Trust principles." Alex Garcia, Staff Dev Ops Engineer, Unity Technologies.

Secure Persistent Files Storage with Azure Kubernetes Service (AKS)

Stateful AKS workloads rely on persistent volumes for configuration, logs, and application data. Previously, mounting Azure Files required storing account keys or secrets in Kubernetes. Organizations requested exceptions from their security organizations to continue using shared keys until a secure managed identities-based solution was available. With this feature, AKS clusters can authenticate directly to Azure Files SMB without storage account keys.

This enables secure, token‑based access for persistent volume mounts, improving security posture and eliminating the need for exceptions to use access tied to storage account keys. Learn more in the Azure Files AKS CSI documentation.

Get Started with Managed Identities with SMB Azure Files

Whether provisioning new storage or enhancing existing deployments, this capability provides secure, enterprise‑grade access with a streamlined configuration experience.

Secure your workloads today!

For any questions, reach out to the team at azurefiles@microsoft.com

Transforming Data migration using Azure Copilot

madhurinrao — Thu, 11 Dec 2025 18:57:02 GMT

Introduction

Data migration is critical, yet it is one of the most complex tasks in any cloud adoption journey. Whether you’re moving workloads from on-premises environments, consolidating hybrid deployments, or transitioning from other cloud providers, the migration process involves multiple tools, intricate planning, and risk management.

What’s New in Azure Copilot

With the new “Storage Migration Solutions Advisor” capability in Azure Copilot, Microsoft is transforming this experience into a conversational, AI-driven workflow that accelerates decision-making and reduces operational friction.

Why This Matters

Traditionally, customers faced challenges such as:

Weeks of advisory time spent choosing the right migration tool amongst the many (Azure Storage Mover, AzCopy, Data Box, File Sync etc., and various Partner solutions).
High support overhead due to missteps during migration if a sub-optimal tool or service is used.

The Storage Migration Solutions Advisor feature introduces:

Conversational Guidance: Share your migration needs with Copilot, like talking with an Azure advisor.
Scenario-Based Recommendations: Tailored suggestions based on transfer data size, protocol, and bandwidth.
Expanded Coverage: Supports on-premises to Azure, cloud-to-cloud (AWS/GCP to Azure), and hybrid scenarios.
Native and Partner solutions: Copilot can recommend Microsoft-native (1P) solutions and third-party (3P) tools for specialized scenarios —ensuring flexibility for enterprise needs.

User Workflow: Step-by-Step

Initiate Migration: Start with a prompt like “How can I migrate my data into Azure?” or “What’s the best tool for moving 1 PB from AWS S3 to Azure Blob?”
Provide Details: Copilot will guide you by asking for details about your requirement, such as source type (e.g., NAS, SAN, AWS S3, GCS), protocol (e.g., NFS, SMB, S3 API), target (e.g., Azure Blob, Files, Elastic SAN), data size, and bandwidth.
Azure and Partner Solutions: Based on your requirements, Copilot recommends the best-fit Azure solution. If a partner solution is better suited to your requirement, Copilot will also select and recommend the appropriate solution with links to its documentation and/or its Azure marketplace page.

Examples

Copilot generates recommendations for migrating an on-premises file share to Azure Files.

Figure 1 Prompt from user invokes Copilot Migration recommendation workflow

Figure 2 Copilot understanding protocols that customer environment has access to

Figure 3 Copilot asking user's target Storage type

Figure 4 Copilot gathering inputs on data size, network bandwidth availability and transfer direction

Figure 5 Copilot recommendation for user scenario

Copilot recommends Partner solutions for specialized migration scenarios

Figure 1 Prompt from user invokes Copilot Migration recommendation workflow

Figure 2 Copilot understanding protocols that customer environment has access to

Figure 3 Copilot asking user's target Storage type

Figure 4 Copilot gathering inputs on data size, network bandwidth availability and transfer direction

Figure 5 Copilot recommendation for user scenario

Pro Tips

Run a small proof-of-concept migration to estimate throughput and timing, especially for large datasets or small file sizes.
Combine Copilot’s recommendations with Azure Storage Discovery for visibility into your storage estate after migration.

Getting Started

Navigate to Azure Portal → Copilot.
Try prompts like:

o “Help me migrate an NFS share to Azure Files.”

o “What’s the best tool for moving 1 PB from AWS S3 to Azure Blob?”

Explore Manage and migrate storage accounts using Azure Copilot | Microsoft Learn for detailed guidance.

Ready to simplify your migration journey? Start using Azure Copilot’s Storage Migration Solutions Advisor today and experience AI-driven efficiency for your cloud transformation.

Pure Storage Cloud, Azure Native evolves at Microsoft Ignite!

Aung_Oo — Wed, 19 Nov 2025 17:45:00 GMT

The Azure Storage team has heavily invested in our partner ecosystem to meet all customer data storage needs and make it easier to migrate any application workload to Azure. You will find our complete list in the validated partner catalog (link below) and find partner solutions conveniently located in Storage Center on the Azure Portal.

Azure Native Pure Storage Cloud is the latest example of our deep investment in partners. Pure Storage has been recognized as a leader in Enterprise Storage Systems by Gartner for 12 consecutive years thanks to their commitment to robust features, performance, resilience, and customer support. We quickly reached General Availability of the service in September and are now announcing additional Azure Service integration – provisioning volumes to Azure Virtual Machines.

Pure Storage Cloud brings the Purity OS features and value to Azure with the Portal, CLI, and Azure Resource Manager experience that simplifies deployment and ongoing management. Pure Storage Cloud is built on a solid foundation of the latest generation of Azure Virtual Machines utilizing Azure Boost accelerated networking and Azure Premium Managed Disks v2. You can learn more about Azure Native Integrations on this blog, read more about the technical details or Pure Storage Cloud here and find a series of step-by-step demos here.

“We are thrilled to make this giant leap in our partnership with Microsoft — building off of the incredible cost savings and enterprise capabilities Pure Storage has delivered to customers in Azure,” said Dan Kogan, vice president enterprise business management, Pure Storage. "This jointly developed solution extends the benefits of the Pure Storage Cloud with industry leading data reduction, advanced data management capabilities and resilience into a fully managed service with a truly Azure native experience, offering a simpler and more secure enterprise-grade storage experience for Microsoft customers.”

Figure 1 - Azure Portal Integration

Our work with Pure initially offered a tightly integrated experience with Azure VMware Solution, and today we are announcing the first expansion of Pure Storage Cloud into other Azure Services with support for volumes provisioned to Azure VMs! Pure Storage Cloud now provides a tremendous value proposition for Linux or Windows-based applications on Azure with their efficiency, protection and cloning, and performance-at-scale capabilities.

The benefits for Azure VMs will mirror those that AVS customers have come to rely on, like a US-based financial services firm with over 300 VMware VMs who moved their VMware environment to Azure discovered. Their workloads are primarily SQL, business applications, and virtual desktops. They found Pure Storage to be extremely cost effective (20 to 40% lower than the out-of-the-box AVS deployment) while providing the enterprise class Storage features they relied on on-premises.

Figure 2 - Simplified Provisioning and Management

Customer Story

Over the past seven years, Pure Storage has partnered with Microsoft to bring industry-leading storage and data management services to the public cloud and make cloud migrations easier. Together, we’ve helped organizations like Perdoceo Education build a modern, flexible, and cost-effective storage solution in Azure—reducing database restores from eight hours to just five minutes, achieving 12:1 data reduction, and lowering total cost of ownership by 40%. We’ve enabled a major manufacturer to cut cloud storage costs by 50% and redirect those savings into AI and innovation. And we’ve supported a financial services organization in migrating VMware to the cloud—improving both ROI and security along the way.

Summary

Azure Native Pure Storage Cloud is ready to support your virtual machine storage needs and we encourage you to review the assets below and give the service a try. It is available as a 30-day free trial and offers a cost-effective and performant solution as an external storage solution for AVS and now for Azure Virtual Machines as well!

Learn more:

Pure Storage Cloud Documentation

Pure Storage Cloud in the Azure Marketplace

Azure Storage Validated Partners

Unlocking Storage Optimizations: Smart Tiering for Blobs and ADLS in Azure Storage

BenedictBerger — Tue, 18 Nov 2025 18:53:55 GMT

We are excited to introduce the public preview of smart tier for Azure Blob and Azure Data Lake Storage. Smart tier is a fully managed, automated data tiering solution that takes the guesswork and manual effort out of optimizing your storage costs.

Smart tier continuously analyzes your data’s access patterns and automatically moves objects between the hot, cool, and cold tiers. Smart tier will keep regularly accessed objects on the hot capacity tier to optimize transaction costs and moves inactive objects after 30 days to the cool tier capacity tier and after an additional 60 days of inactivity to the cold capacity tier. If you access an object in cool or cold tiers again, it’s instantly promoted back to the hot tier, restarting the cycle. This ensures your data is always in the most cost-effective tier with zero manual intervention, making it the ideal online tier for datasets with mixed or unknown access patterns.

Getting started

Using smart tier is quick and easy:

Enabling smart tier is simple: Just select smart tier as the default access tier through the storage account configuration for any storage account with zonal redundancy. Smart tier is available in all zonal public cloud regions, supporting both flat and hierarchical namespaces.
Billing is straightforward: You will pay the regular hot, cool, and cold capacity rates, with no extra charges for tier transitions, early deletion, or data retrieval. Even moving existing objects into smart tier does not incur tier change fees. There’s just a small monitoring fee for the orchestration.

Smart tier is configured at the account level. It can be configured via API or the Azure portal as the default access tier setting for new and existing storage accounts. Existing objects following the default access tier setting from the account will be moved to smart tier automatically. Objects that are explicitly tiered, i.e. to the hot tier, will remain in the same account and will not be moved to other capacity tiers. Smart tier will always keep small objects that are below 128 KiB in size in the hot capacity tier for efficiency and those objects will not incur a monitoring charge. If objects below 128 KiB increase in size, the smart tiering patterns apply for those objects as well.

The automatic down tiering of inactive data, paired with the billing model simplifications of Smart tier can lead to large cost savings over time. In the metrics view of the storage account you can see the distribution across the capacity tiers for smart tiered objects by both object count and capacity.

This account shows smart tier in action, moving inactive objects to the cool and cold capacity tier, thereby drastically reducing the capacity charges without any manual intervention.

"2 years ago, Qumulo partnered with Microsoft to deliver the first truly elastic, unlimited capacity, fully managed file system, Azure Native Qumulo, which was built on Azure Blob," said Brandon Whitelaw SVP of Product at Qumulo. "Qumulo shared feedback with Microsoft on our ideal solution for data tiering and Microsoft clearly delivered, meeting all expectations. With today's smart tier announcement, Qumulo will immediately enhance our offerings with these new capabilities, delivering greater functionality and control over data lifecycle management. We are thrilled with the feature set Azure is delivering at launch”

Note that smart tier is not supported with append and page blobs. Smart tier is the ideal tier to choose when you are looking to store your data on standard online tiers but are not fully aware of the data access patterns or do not want to manage data transitions across online tiers. Objects managed by smart tier are not subject to lifecycle management policies, ensuring that automated tiering decisions are based solely on access patterns.

Smart tier for block blobs is now available in public preview for both Azure Blob Storage and Azure Data Lake Storage for storage accounts with zonal redundancies, including ZRS, GZRS and RA-GZRS.

Unlock cost savings by adding smart tier to your blob storage accounts in one easy step: https://aka.ms/BlobSmarttier.

Please reach out to us for any feedback or questions, we would love to hear from you: smartblob@microsoft.com

Reduce latency and enhance resilience with Azure Files zonal placement

hanagpal — Tue, 18 Nov 2025 18:18:59 GMT

We are pleased to announce the General Availability of zonal placement for Azure Files Premium LRS in select regions. Zonal placement enables you to pin Azure Files storage accounts to a specific Availability Zone within a region — giving you better control over data locality, resilience, and lower latency for your workloads.

Benefits of zonal placement

Azure Files provides both local-redundant storage (LRS) and zone-redundant storage (ZRS) options today. ZRS is leveraged for workloads that require storage-level replication across zones. For applications using Azure Files Premium LRS with application-level replication, customers can now pin storage resources to a specific Availability Zone to co-locate storage with compute resources like Virtual Machines (VMs). Zonal placement can be leveraged with both SMB and NFS shares, making it ideal for latency sensitive Windows and Linux workloads including databases, enterprise platforms, DevOps tools, and line-of-business applications.

Fig1. Zonal placement allows users to choose the zone for a storage account

Leveraging zonal placement

With zonal placement, you can

Reduce latency: Choose the same availability zone for storage and compute resources, optimizing latency-sensitive workloads and reducing cross-zone network latency by 10-40%.
Isolate failure domains: Limit exposure to potential zonal outages, by aligning the compute and storage resources of your application in a single zone.
Design for zone-aware high availability: Build resiliency with application-level replication across compute and storage resources in each zone.

To configure zonal placement for your workload:

Select a specific Availability Zone when creating a new Azure Files Premium LRS storage account or update an existing Azure Files Premium LRS storage account to be Availability Zone aware.

Allocate your compute resources in the same zone as your premium storage account zone.

Get started today

Start leveraging zonal placement for Azure Files Premium LRS today. Zonal placement is available in select Azure regions that support Premium LRS and Availability Zones; for the latest list of supported regions, please refer to the zonal placement for Azure File Shares | Microsoft Learn. Whether you’re provisioning new storage or enhancing existing deployments, Zonal placement empowers you to align your compute and storage resources within the same Availability Zone to minimize latency and control availability.

Build more efficient, reliable, and zone-aware solutions with Azure Files—your data is ready for what’s next. For any questions, please reach out to the team at azurefiles@microsoft.com.

Cloud Native Identity with Azure Files: Entra-only Secure Access for the Modern Enterprise

Priyanka-Gangal — Tue, 18 Nov 2025 17:41:59 GMT

As organizations accelerate their cloud-first journeys, the ability to deliver secure, seamless identity and access management for storage in the cloud is now a game-changer. We are excited to announce the Public Preview of Entra-only identities support with Azure Files SMB. With native Entra ID (identities are created and managed entirely in the cloud, with no reliance on on-premises Active Directory or hybrid setups) authentication for Azure Files SMB, customers can move beyond the limitations of on-premises Active Directory and hybrid sync tools—enabling cloud-created identities to access file shares securely, from anywhere. This unlocks a new era of agility: organizations can modernize their storage, compute, and identity infrastructure entirely in Azure, reducing operational complexity, strengthening security with Zero Trust alignment, and cutting costs tied to legacy infrastructure. The result? Faster onboarding, simplified management, and a future-ready foundation for workloads.

Key benefits include:

Enhancing Secure Access with Admin Roles: Until now, admin scenarios for SMB shares required mounting with storage account keys. Azure Files now supports new Role-Based access (RBAC) permissions specifically addressing scenarios for admin-level access in a simple and secure fashion. More information here.
Modern Identity Management Experience: Centralized identity management in Azure empowers organizations to set granular file/directory permissions directly through the Azure portal, which previously required a share mount, now delivering a unified and streamlined configuration experience.
Reduced Operational Overhead: No need for VPN dependencies or complex hybrid identity setups. IT teams save time and resources previously spent on managing Group Policy Objects (GPOs), replication issues, and Active Directory health checks.
No Dependency on On-Premises infrastructure: Organizations ready to retire their domain controllers can now seamlessly access Azure Files using cloud-based identities, eliminating the need for on-premises identity infrastructure.
Remote Login support with thin clients: Remote workers using thin clients only need internet connectivity—no network connectivity to Active Directory servers

Modernizing real world architectures

Virtual Desktop Workloads (VDI) Work Best with Azure Files and Entra-Only Identities

Azure Files is the foundational storage layer for VDI solutions including AVD, enabling scalable, secure, and fully managed file shares that power user profile persistence, application delivery, and session state continuity. Through native integration with FSLogix, Azure Files supports roaming profiles across multi-session Windows 10/11 desktops, ensuring a consistent user experience regardless of host pool or region.

Support for Microsoft Entra ID, specifically Entra Kerberos with a cloud only identity is tailor-made for VDI and AVD workloads as it enables Entra-joined session hosts to authenticate and access file shares, eliminating traditional Active Directory infrastructure. This is especially critical for organizations pursuing a cloud-only strategy, as it eliminates the need for domain controllers while maintaining enterprise-grade access control and encryption.

“Entra-only identities access with Azure Files will transform how we deliver virtual desktop solutions. By removing the need for on-premises domain controllers, we’ve simplified deployments and strengthened security for our customers. This cloud-native approach aligns perfectly with Zero Trust principles, enabling us to provide a seamless, secure VDI experience while reducing operational complexity.” — Jacques Theron, Cloud Solutions Architect, Netsurit

Entra Only identities allow access over thin clients for remote-site collaboration

Workloads such as Oil & Gas use file shares for reservoir characterization and visualization, which generate high-scale datasets. These activities are usually operated globally in remote fields, offshore rigs, and exploration sites. Traditionally, this means requiring thick clients with uninterrupted network connectivity to a domain controller to access storage resources in the cloud. This results in adding on-premises domain controller infrastructure at every physical site. With Azure Files supporting authentication for native Entra users, clients no longer require domain-joining or network connectivity to domain controllers, avoiding complex infrastructure setups, VPN or thick-client access. This shift supports real-time collaboration, decentralized control, and mobility—allowing engineers and analysts to use Entra-joined thin clients with basic internet connectivity for remote file-sharing collaboration and analysis. The result is improved agility, lower IT costs, and a future-ready identity architecture that aligns with the industry's digital transformation goals.

“Entra-only identities support with Azure Files transforms SLB’s Petrel workflows by removing dependencies on on-premises domain controllers, simplifying identity management and storage infrastructure for globally distributed teams working on complex exploration and reservoir characterization. This cloud-native architecture allows customers to access SMB shares in an easy and secure manner without complex VPN or hybrid infrastructure setups.” – Swapnil Daga, Storage Architect for Tenant Infrastructure, SLB.

Entra-Only Identities transforms Information Worker productivity

For organizations with large, distributed workforce, Entra only identities with Azure Files removes the heavy lift of on-premises domain controllers while giving employees seamless, secure access to shared content over SMB. With Entra handling authentication end-to-end, users sign in once and get consistent access to project folders and departmental shares regardless of in-office or remote work. This cloud native model reduces helpdesk friction from password resets and domain join issues and accelerates onboarding—new hires and contractors get the right file access the moment they are added to Entra groups. For IW workloads like document collaboration, reporting, and app-assisted tasks means faster time to productivity, fewer access breaks, and policy driven governance that travels with the user, not the network.

Get Started with MS Entra Kerberos with Entra Only identities

Start leveraging the Entra only Identities identity experience with Azure Files today at no added cost! Explore our documentation for step-by-step guidance. Whether you are provisioning new storage or enhancing existing deployments, this feature empowers you to modernize your storage and identity infrastructure, with a simple and efficient configuration experience. Make your workload ready for the future!

For any questions, please reach out to the team at azurefiles@microsoft.com.

Public Preview of Azure Native Dell PowerScale

Aung_Oo — Tue, 18 Nov 2025 18:54:49 GMT

Dell and Microsoft are extending their partnership by bringing Dell's flagship unstructured data product, OneFS, to Azure as a new fully managed offering – now in Public Preview. Dell PowerScale for Microsoft Azure packs all the well-known benefits from OneFS in an Azure Native ISV service. This is a result of a co-development effort to create an easy-to-deploy and easy-to-manage filesystem-as-a-service.

Power of choice

Microsoft customers can now choose between two flavors of Dell PowerScale. One is the existing customer managed version, and the other is the newly released Dell managed PowerScale for Microsoft Azure. Both solutions allow customers to run OneFS in Azure, an enterprise-grade software-defined solution that integrates scale-out PowerScale and Microsoft's public cloud platform. PowerScale offers an end-to-end data solution for many AI, HPC and enterprise use cases with keeping simplicity top of mind.

Both solutions offer efficiency, performance, resiliency, multi-petabyte scalability and feature set expected from an enterprise storage solution like PowerScale to Azure. You can replicate your data estate between on-premises and Azure-based deployments and optimize your hybrid data estate with data reduction through compression, deduplication and file tiering to scalable, cost-effective Azure Blob Storage with Cloud Pools. Rich Azure ecosystems for AI and Analytics services, cloud-based disaster recovery, or application bursting are now easily accessible for existing and new PowerScale customers. The only difference is the way you deploy and manage your storage solution. In a customer managed Dell PowerScale for Azure solution, customers deploy and manage the entire software and infrastructure stack. All the compute, networking and storage resources are in a customer’s tenant. If this is the preferred option, you can start with the deployment guide and provision a standalone PowerScale cluster now. However, if you are looking for a fully managed solution, Dell PowerScale for Microsoft Azure is the right choice. As a managed service, Dell implements and manages the underlying infrastructure stack, and is responsible for support activities, including platform upgrades and maintenance tasks.

What is Dell PowerScale for Microsoft Azure, An Azure Native ISV Service

Dell PowerScale for Microsoft Azure is a fully managed service, implemented as an Azure Native ISV service (LINK). It is deployed and managed through the Azure Portal and transactable through Azure Marketplace. This allows all Microsoft customers to use their existing Azure commitments and contracts to easily pay for and use this new offering. Unlike existing customer managed Dell PowerScale for Azure, this implementation runs in a Dell managed environment. The responsibility for service deployment and maintenance belongs to Dell while the customers consume the service in a cloud-native manner. The same ease-of-use typically tied to SaaS services, now applies to a traditional, enterprise grade storage system, like PowerScale. Customers can simply deploy the resource with the familiar Azure portal experience and start consuming a new petabyte scale OneFS cluster.

Dell PowerScale Azure Native Architecture Diagram

As an Azure Native ISV service, Dell PowerScale for Microsoft Azure allows customers to manage their solution with a well-known Azure user interface. Customers can choose between Azure Portal, Azure CLI, or PowerShell.

Dell PowerScale for Microsoft Azure user interface in the Azure Portal

“Two industry leaders, one powerful solution raising the bar for enterprise cloud storage. Dell PowerScale for Microsoft Azure offers seamless scalability up to 8.4PB in a single namespace, versatile multi-protocol support, robust security, and is fully managed by Dell. This integration simplifies hybrid cloud operations while maintaining consistent high performance for data-intensive workloads like AI/ML, and EDA, helping you stay ahead to unlock your next breakthrough." Travis Vigil, SVP, Infrastructure Storage Group, Product Management at Dell Technologies.

Dell PowerScale for Microsoft Azure provides up to 8.4PB in a single namespace and is available in 9 Azure regions.

Supported regions:

US East
US South Central
US West 2
West Europe
North Europe
UK South
Germany West Central
Australia East
Southeast Asia

How to take the next step

Azure Marketplace Listing

Request a Dell Reference Number for Public Preview

Dell Documentation

Priority Replication for Geo Redundant Storage and Object Replication is Generally Available

imanihall — Mon, 10 Nov 2025 20:21:17 GMT

We are excited to announce the General Availability of priority replication for Geo Redundant Storage (GRS) and Object Replication (OR). Priority replication enhances the replication process of GRS/GZRS and OR, ensuring guaranteed 15 minute synchronization between regions and improved replication times. Enabling priority replication will also provide an official Service Level Agreement (SLA) for all user workloads that meet the SLA criteria.

What is Geo Priority Replication?

Azure Storage has offered users the choice of geo-redundant (GRS) or geo-zone-redundant (GZRS) replication for their storage accounts for several years. As displayed in the diagram below, with GRS/GZRS, data in the storage account is asynchronously replicated from the primary region to the secondary region:

Diagram showing the asynchronously replication of storage account data from the primary to the secondary region of a GRS account.

Since the data is asynchronously replicated, in the event there is a disaster in the primary region, and an unplanned failover is initiated, there is a possibility of some data loss. The Last Sync Time (LST) property of a GRS/GZRS account is currently used to provide users with the recovery point objective (RPO) of their account. The LST of the account indicates the most recent time that data from the primary region is guaranteed to have been written to the secondary region. All data and metadata written prior to the LST is guaranteed to be available on the secondary. However, any data or metadata written after the LST may not have been replicated to the secondary and could be lost in the event of a disaster impacting the primary region or an unplanned failover.

Azure Blob Storage is now introducing Geo priority replication which will provide an SLA guarantee for the LST/RPO of Block Blob data in GRS/GZRS accounts. Geo priority replication enhances the replication process of GRS/GZRS storage accounts allowing for accelerated replication between the primary and secondary regions. The SLA guarantees the Last Sync Time of Block Blob data will be 15 minutes or less 99.0% of the billing month. With this guaranteed sync time, users can feel more confident about their data’s durability and availability, especially if there is an unexpected outage and failover in the primary region. Please refer to the official SLA Terms for a comprehensive list of eligibility requirements.

Geo Priority Replication supports the following SKUs: GRS, RA-GRS, GZRS and RA-GZRS for Block Blob data.

What is Object Replication Priority Replication?

Without priority replication, object replication asynchronously copies all operations from a source storage account to one or more destination accounts, but completion time is not guaranteed. Object replication priority replication will allow users to obtain prioritized replication from the source storage account to the destination storage account of their replication policy. When you enable priority replication, you can benefit from the associated Service Level Agreement if your source and destination account are located within the same continent. The SLA will guarantee that 99.0% of operations are replicated from the source container to the destination container of their OR policy within 15 minutes for the billing month. Please refer to the official SLA Terms for a comprehensive list of eligibility requirements.

How to monitor SLA compliance for Geo and OR Priority Replication?

Geo Priority Replication:

Geo priority replication introduces a new metric, Geo Blob Lag. This metric allows users to monitor their Blob Replication lag, the number of seconds since the last full data synchronization between the primary and secondary region. This will allow users to track the SLA compliance of their GRS/GZRS account. If an account’s Geo Blob Lag remains within 900 seconds (15 minutes), they can confirm the data replication is within SLA. To learn more about the Geo Blob Lag metric view, Geo Blob Lag Metric.

Azure Portal user experience, showing how to view Geo Blob Lag metrics.

Object Replication Priority Replication:

Replication Metrics for Object Replication is now Generally Available. These metrics empower users to troubleshoot replication delays and will help users with priority replication enabled monitor their SLA compliance. Metrics now supported are:

Pending Operations: Tracks the total number of operations pending replication from the source to the destination storage account of your OR policy
Pending Bytes: Tracks the total volume of data pending replication from the source to the destination storage account of your OR policy

These metrics are grouped into various time buckets including 0-5 minutes, 10-15 minutes and > 24 hours.

Users with OR priority replication that would like to ensure all their operations are replicating within 15 minutes; can monitor the larger time buckets (ex: 30 mins – 2hours or 8-24 hours) and ensure they are at zero or near zero.

Azure Portal experience for OR Metrics.

Users also have other options such as checking the replication status of their source blob. Users can check the replication status of a source blob to determine whether replication to the destination has been completed. Once the replication status is marked as “Completed,” the user can guarantee the blob is available in the destination account.

Azure Portal user experience for OR Replication Status.

How to get started?

Getting started is simple, to learn more about the step-by-step process to opt-in to Geo priority replication: Azure Storage Geo Priority Replication - Azure Storage | Microsoft Learn.

Azure Portal user experience for enabling Geo Priority Replication.

Or if you would like to learn about the step-by-step process to enable OR Priority Replication, view: Object Replication Priority Replication - Azure Storage | Microsoft Learn.

Azure Portal user experience for enabling OR Priority Replication.

Feedback

If you have questions or feedback, reach out at priorityreplication@microsoft.com.

Take Data Management to the next level with Silk Software-Defined Azure Storage

dukicn — Tue, 04 Nov 2025 13:16:37 GMT

Note: This article is co-authored by our partner Silk.

In today’s data-driven world, every enterprise is under pressure to make smarter decisions faster. Whether you're running production databases, training machine learning models, running advanced analytics, or building customer-facing applications, your data needs to be more agile, secure, and readily accessible than ever before.

That’s where Silk’s software-defined cloud storage platform on Microsoft Azure comes into play — bringing performance, resiliency, and intelligence to data management across the cloud. With the recent addition of Silk Echo, you can now supercharge your Copy Data Management (CDM) strategy to ensure your data isn’t just protected, it’s available instantly for any purpose — a true strategic asset.

Transforming Azure IaaS with Silk's Platform

Microsoft Azure offers a rich ecosystem of services to support every stage of your cloud journey, and when paired with Silk, customers gain a game-changing storage and data-services layer purpose-built for performance-intensive workloads.

Silk’s software-defined storage platform runs on Azure infrastructure as a high-performance data layer between Azure compute and native storage. It works by orchestrating redundant sets of resources, as close to the DB compute as possible. Aggregating and accelerating the native capabilities of Azure, enabling databases to reach the maximum physical limits of the underlying hardware. Silk makes use of the excellent L-series of storage optimized VMs and NVME media, ensuring the data is always quickly available and able to withstand multiple failures using erasure coding.

Silk is designed to address common challenges customers face when migrating relational databases — such as SQL Server, Oracle, and DB2 — to the cloud:

Performance Bottlenecks: On-prem workloads often rely on ultra-low latency, high-throughput storage systems with features that are difficult to replicate in the cloud.
Data Copy Sprawl: Multiple non-production environments (dev, test, QA, analytics) mean many redundant data copies, leading to storage inefficiencies.
Operational Overhead: Managing snapshots, backups, and refreshes across environments consumes time and resources.

Silk changes the game with:

Extreme performance in the Azure cloud. Up to 34GB/s of throughput from a single VM.
The combination of Silk and Azure provide a unique cost/performance balance, through the combination of a very low latency software defined cloud storage platform and sharing of Azure resources.
Inline data deduplication and compression for optimized resource utilization.
Autonomous, fully integrated, non-disruptive, zero cost snapshots and clones for effortless environment refreshes.
Multi-zone resilience and no single point of failure.

This makes it easier than ever to lift and shift critical applications to Azure, with the confidence of consistent performance, uptime, and flexibility.

Elevating CDM with Silk Echo for AI

While Silk’s core platform solves performance and efficiency challenges, Silk Echo for AI introduces an intelligent, AI-powered layer that revolutionizes how organizations manage and leverage their data across the enterprise.

At its core, Silk Echo for AI offers next generation Copy Data Management capabilities that empower IT teams to accelerate digital initiatives, reduce costs, and maximize the value of every data copy.

Key Benefits of Silk Echo for AI

Smarter Data Copying and Cloning
Silk Echo leverages AI to understand data access patterns and recommends the optimal strategy for creating and managing data copies. Instead of manually managing snapshots, you can automate the entire workflow — ensuring the right data is in the right place at the right time.
Instant, Space-Efficient Clones
Using Silk’s advanced snapshot and cloning engine, Echo creates fully functional clones in seconds, consuming minimal additional storage resources. Teams can spin up dev/test environments instantly, accelerating release cycles and experimentation.
Cross-Environment Data Consistency
Echo ensures consistency across copies — whether you're cloning for testing, backup, or analytics — and with AI-driven monitoring, it can detect drift between environments and recommend synchronizations.
Policy-Based Lifecycle Management
Define policies for how long data copies should live, when to refresh them, and who has access. Echo automates the enforcement of these policies, reducing human error and ensuring compliance.
Optimized Resource Consumption
Silk Echo minimizes redundant data storage through smart deduplication, compression, and AI-driven provisioning — resulting in cost savings of 50% or more across large-scale environments.
Enablement for AI/ML Workflows
For data science teams, Silk Echo provides curated, up-to-date data clones without impacting production environments — essential for model training, experimentation, and validation.

Real-World Use Case: Streamlining Dev/Test and AI Pipelines

Consider Sentara Health, a healthcare provider migrating their EHR and SQL Server workloads to Azure. Before Silk, environment refreshes were time-consuming, often taking days or even weeks. With Silk Echo for AI, the same tasks will be completed in minutes.
Now, development teams have self-service access to fresh clones of production data — enabling faster iteration and better testing outcomes. Meanwhile, their data science team leverages Echo’s snapshot automation to feed AI models with real-time, production-grade data clones without risking downtime or data corruption.
All of this runs seamlessly on Azure, with Silk ensuring high performance and resilience at every step.

Joint Value of Silk and Microsoft

Together, Silk and Microsoft are unlocking a new level of agility and intelligence for enterprise data management:

Data-as-a-Service: Give every team — DevOps, DataOps, AI/ML — access to the data they need, when they need it. Free snapshots democratize data so up-to-date copies can be made quickly for any team member who can benefit from it.
AI-Ready Database Infrastructure: Your infrastructure evolves from a reactive model which is addressing problems as they arise (i.e. triggering responses on alerts), to a predictive model that utilizes AI/ML to forecast issues and mitigate them before they occur by learning patterns of behavior. Silk enables real-time AI inferencing, for business-critical agents that require access to up-to-date operational data.
Reduced Costs, Improved ROI: Storage optimization, reduced manual overhead, and faster time to value — backed by Azure’s scalability and Silk’s performance.
Accelerated Cloud Migrations: Achieve the enhanced scalability and flexibility of a cloud migration for your Tier 1 databases without refactoring.

Get Started

Ready to take your data management strategy to the next level? Explore how Silk’s software-defined storage and Silk Echo for AI can accelerate your transformation on Microsoft Azure. Whether you're modernizing legacy systems, building AI-driven applications, or simply trying to get more value from your cloud investments, Silk and Microsoft are here to help.

By embracing the power of Silk’s software-defined storage and Silk Echo, organizations can finally make their data in the cloud work smarter, not harder.

Contact Alliances@silk.us for a deeper dive on Silk!

Beyond Basics: Practical scenarios with Azure Storage Actions

ShashankKumarShankar — Fri, 17 Oct 2025 17:00:29 GMT

If you are new to Azure Storage Actions, check out our GA announcement blog for an introduction. This post is for cloud architects, data engineers, and IT admins who want to automate and optimize data governance at scale.

The Challenge: Modern Data Management at Scale

As organizations generate more data than ever, managing that data efficiently and securely is a growing challenge. Manual scripts, periodic audits, and ad-hoc cleanups can’t keep up with the scale, complexity, and compliance demands of today’s cloud workloads. Teams need automation that’s reliable, scalable, and easy to maintain.

Azure Storage Actions delivers on this need by enabling policy-driven automation for your storage accounts. With Storage Actions, you can:

Automate compliance (e.g., legal holds, retention)
Optimize storage costs (e.g., auto-tiering, expiry)
Reduce operational overhead (no more custom cleanup scripts)
Improve data discoverability (tagging, labeling)

Real-World Scenarios: Unlocking the Power of Storage Actions

Let’s explore 3 practical scenarios where Storage Actions can transform customers’ data management approach. For each, we’ll look at the business problem, the traditional approach, and how Storage Actions makes it easier with the exact conditions and operations which can be used.

Scenario 1: Content Lifecycle for Brand Teams

Business Problem:

Brand and marketing teams manage large volumes of creative assets - videos, design files, campaign materials that evolve through multiple stages and often carry licensing restrictions. These assets need to be retained, frozen, or archived based on their lifecycle and usage rights. Traditionally, teams rely on scripts or manual workflows to manage this, which can be error-prone, slow, and difficult to scale.

How Storage Actions Helps:

Azure Storage Actions enables brand teams to automate the content lifecycle management using blob metadata and / or index tag. With a single task definition using an IF and ELSE structure, teams can apply different operations to blobs based on their stage, licensing status, and age without writing or maintaining scripts.

Example in Practice:

Let’s say a brand team manages thousands of creative assets videos, design files, campaign materials each tagged with blob metadata that reflects its lifecycle stage and licensing status. For instance:

Assets that are ready for public use are tagged with asset-stage = final
Licensed or restricted-use content is tagged with usage-rights = restricted

Over time, these assets accumulate in your storage account, and you need a way to:

Ensure that licensed content is protected from accidental deletion or modification
Archive older final assets to reduce storage costs
Apply these rules automatically, without relying on scripts or manual reviews

With Azure Storage Actions, the team can define a single task that evaluates each blob and applies the appropriate operation using a simple IF and ELSE structure:

IF:

- Metadata.Value["asset-stage"] equals "final"

- AND Metadata.Value["usage-rights"] equals “restricted”

- AND creationTime < 60d

THEN:

- SetBlobLegalHold: This locks the blob to prevent deletion or modification, ensuring compliance with licensing agreements.

- SetBlobTier to Archive: This moves the blob to the Archive tier, significantly reducing storage costs for older content that is rarely accessed.

ELSE

- SetBlobTier to Cool: If the blob does not meet the above criteria whether it’s a draft, unlicensed, or recently created, it is moved to the Cool tier.

Once this Storage Action is created and assigned to a storage account, it is scheduled to run automatically every week. During each scheduled run, the task evaluates every blob in the target container or account. For each blob, it checks if the asset is marked as final, tagged with usage-rights, and older than 60 days. If all these conditions are met, the blob is locked with a legal hold to prevent accidental deletion and then archived to optimize storage costs. If the blob does not meet all of these criteria, it is moved to the Cool tier, ensuring it remains accessible but stored more economically. This weekly automation ensures that every asset is managed appropriately based on its metadata, without requiring manual intervention or custom scripts.

Scenario 2: Audit-Proof Model Training

Business Problem:

In machine learning workflows, ensuring the integrity and reproducibility of training data is critical especially when models influence regulated decisions in sectors like automotive, finance, healthcare, or legal compliance. Months or even years after a model is deployed, auditors or regulators may request proof that the training data used has not been altered since the model was built.

Traditionally, teams try to preserve training datasets by duplicating them into backup storage, applying naming conventions, and manually restricting access. These methods are error-prone, hard to enforce at scale, and lack auditability.

How Storage Actions Helps:

Storage Actions enables teams to automate the preservation of validated training datasets using blob tags and immutability policies. Once a dataset is marked as clean and ready for training, Storage Actions can automatically:

Lock the dataset using a time-based immutability policy
Apply a tag to indicate it is a snapshot version

This ensures that the dataset cannot be modified or deleted for the duration of the lock, and it is easily discoverable for future audits.

Example in Practice:

Let’s say an ML data pipeline tags a dataset with stage=clean after it passes validation and is ready for training. Storage Actions detects this tag and springs into action.

It enforces a 1-year immutability policy, which means the dataset is locked and cannot be modified or deleted for the next 12 months.
It also applies a tag snapshot=true, making it easy to locate and reference in future audits or investigations.

The following conditions and operations define the task logic:

IF:

- Tags.Value[stage] equals 'clean'

THEN:

- SetBlobImmutabilityPolicy for 1-year: This adds a write once, read many (WORM) immutability policy on the blob to prevent deletion or modification, ensuring compliance.

- SetBlobTags with snapshot=true: This adds a blob index tag with name “snapshot” and value “true”.

Whenever this task runs on its scheduled interval - such as daily or weekly, it detects if a blob has the tag stage = 'clean', it automatically initiates the configured operations. In this case, Storage Actions applies a SetBlobImmutabilityPolicy on the blob for one year and adds a snapshot=true tag for easy identification.

This means that without any manual intervention:

The blob is made immutable for 12 months, preventing any modifications or deletions during that period.
A snapshot=true tag is applied, making it easy to locate and audit later.
No scripts, manual tagging, or access restrictions are needed to enforce data integrity.

This ensures that validated training datasets are preserved in a tamper-proof state, satisfying audit and compliance requirements. It also reduces operational overhead by automating what would otherwise be a complex and error-prone manual process.

Scenario 3: Embedding Management in AI Workflows

Business Problem:

Modern AI systems, especially those using Retrieval-Augmented Generation (RAG), rely heavily on vector embeddings to represent and retrieve relevant context from large document stores. These embeddings are often generated in real time, chunked into small files, and stored in vector databases or blob storage. As usage scales, these systems generate millions of small embedding files, many of which become obsolete quickly due to frequent updates, re-indexing, or model version changes.

This silent accumulation of stale embeddings leads to:

Increased storage costs
Slower retrieval performance
Operational complexity in managing the timings

Traditionally, teams write scripts to purge old embeddings based on timestamps, run scheduled jobs, and manually monitor usage. This approach is brittle and does not scale well.

How Storage Actions Helps:

Storage Actions enables customers to automate the management of embeddings using blob tags and metadata. With blobs being identified with tags and metadata such as embeddings=true, modelVersion=latest, customers can define conditions that automatically delete stale embeddings without writing custom scripts.

Example in Practice:

In production RAG systems, embeddings are frequently regenerated to reflect updated content, new model versions, or refined chunking strategies. For example, a customer support chatbot may re-index its knowledge base daily to ensure responses are grounded in the latest documentation.

To avoid bloating storage with outdated vector embeddings, Storage Actions can automate cleanup with task conditions and operation such as:

IF:

- Tags.Value[embeddings] equals 'true'

- AND NOT Tags.Value[version] equals ‘latest’

- AND creation time < 12 days ago

THEN:

- DeleteBlob: This deletes all blobs which match the IF condition criteria.

Whenever this Storage Action runs on its scheduled interval - such as daily - it scans for blobs that have the tag embeddings = ‘true’ and is not the latest version with its age being more than 12 days old, it automatically initiates the configured operation. In this case, Storage Actions does a DeleteBlob operation on the blob.

This means that without any manual intervention:

The stale embeddings are deleted
No scripts or scheduled jobs are needed to track.

This ensures that only the most recent model’s embeddings are retained, keeping the vector store lean and performant. It also reduces storage costs by eliminating obsolete data and helps maintain retrieval accuracy by ensuring outdated embeddings do not interfere with current queries.

Applying Storage Actions to Storage Accounts

To apply any of the scenarios, customers create an assignment during the storage task resource creation. In the assignment creation flow, they select the appropriate role and configure filters and trigger details.

For example, a compliance cleanup scenario might run across the entire storage account with a recurring schedule every seven days to remove non-compliant blobs. A cost optimization scenario could target a specific container using a blob prefix and run as a one-time task to archive older blobs. A bulk tag update scenario would typically apply to all blobs without filtering and use a recurring schedule to keep tags consistent. After setting start and end dates, specifying the export container, and enabling the task, clicking Add queues the action to run on the account.

Learn More

If you are interested in exploring Storage Actions further, there are several resources to help you get started and deepen your understanding:

Documentation on Getting Started: https://learn.microsoft.com/en-us/azure/storage-actions/storage-tasks/storage-task-quickstart-portal
Create a Storage Action from the Azure Portal: https://portal.azure.com/#create/Microsoft.StorageTask
Azure Storage Actions pricing: https://azure.microsoft.com/en-us/pricing/details/storage-actions/#pricing
Azure Blog about the GA announcement: https://azure.microsoft.com/en-us/blog/unlock-seamless-data-management-with-azure-storage-actions-now-generally-available/
Azure Skilling Video with a walkthrough of Storage Actions: https://www.youtube.com/watch?v=CNdMFhdiNo8

Have questions, feedback, or a scenario to share?

Drop a comment below or reach out to us at storageactions@microsoft.com. We would love to hear how you are using Storage Actions and what scenarios you would like to see next!

Introducing Cross Resource Metrics and Alerts Support for Azure Storage

dafalkne — Mon, 06 Oct 2025 12:38:16 GMT

Aggregate and analyze storage metrics from multiple storage accounts in a single chart.

We’re thrilled to announce a highly requested feature: Cross Resource Metrics and Alerts support for Azure Storage!

With this new capability, you can now monitor and visualize metrics across multiple storage accounts in a single chart and configure alerts across multiple accounts — within the same subscription and region. This makes managing large fleets of storage accounts significantly easier and more powerful.

What’s New

Cross Resource Metrics Support

Visualize aggregated metric data across multiple storage accounts.
Break down metrics by individual resources in a sorted and ordered way.

Cross Resource Alerting Support

Create a single alert rule that monitors a metric across many storage accounts and triggers an action when thresholds are crossed on any resource.

Full Metric Namespace Support

Works across Blob, File, Table, and Queue metric namespaces.
All existing storage metrics are supported for cross resource visualization and alerting.

Why This Matters

Centralized Monitoring for Large Environments

Manage and monitor dozens (or hundreds) of storage accounts at once with a unified view.

Fleet-wide Alerting

Set up a single alert that covers your whole storage fleet, ensuring you are quickly notified if any account experiences performance degradation or other issues.

Operational Efficiency

Helps operations teams scale monitoring efforts without needing to configure and manage separate dashboards and alerts for each account individually.

How To Get Started

Step 1: Create a Cross Resource Metrics Chart

Go to Azure Monitor -> Metrics.
Scope Selection:
- Under Select a scope, select the same Metric Namespace (blob/file/queue/table) for multiple Storage Accounts from the same Subscription and Region.
- Click Apply.
- In the below example, two storage accounts have been selected for metrics in the blob metric namespace.

Configure Metric Chart:
- Select a Metric (e.g., Blob Capacity, Transactions, Ingress)
Aggregation:
- - By default, a Split by clause on ResourceId is applied to view individual account breakdowns.
  - Or view aggregated data across all selected accounts by removing the Split by clause.

Example

As another example, lets monitor total transactions across storage accounts on the Hot tier to view aggregate or per-account breakdown in a single graph.

From the same view, select the Transactions metric instead.
Select 5 storage accounts by using the Add Filter clause and filtering by the ResourceId property.
Add another filter and select a specific tier, say Hot. This will show aggregated transactions on data in the Hot tier per minute across all selected storage accounts.

Select Apply Splitting and select ResourceId to view an ordered breakdown of transactions per minute for all the Storage accounts in scope. In this specific example, only 4 storage accounts are shown since 1 storage account is excluded based on the Tier filter.

Step 2: Set Up Cross Resource Alert Rules

Click on New alert rule from the chart view shown above in order to create an alert that spans the 5 storage accounts above and get alerted when any account breaches a certain transactions limit over a 5 minute period.
Configure required values for the Threshold, Unit and Value is fields. This defines when the alert should fire (e.g., Transactions > 5000)
Under the Split by dimensions section, ensure that the Microsoft.ResourceId dimension is not included.

Under Actions, attach an Action Group (Email, Webhook, Logic App, etc.).
Review and Create.

Final Thoughts

Cross Resource Metrics and Alerts for Azure Storage makes monitoring and management at scale much more intuitive and efficient. Whether you're overseeing 5 storage accounts or 500, you can now visualize performance and respond to issues faster than ever. And you can do it for metrics across multiple storage services including blobs, queues, files and tables!

We can't wait to hear how you use this feature! Let us know your feedback by commenting below or visiting Azure Feedback.