Azure Storage Blog articles

File share migrations simplified with Azure Copilot Migration Agent

madhurinrao — Wed, 03 Jun 2026 12:28:05 GMT

Building on our earlier announcement of discovery and assessment support for SMB and NFS file shares in Azure Migrate, we are extending the experience to support end-to-end file share migrations within the same workflow. With Azure Copilot Migration Agent, customers can move from discovery and assessment to migration through a single guided experience in Azure Migrate. By bringing planning and execution together, the agent helps organizations streamline migration activity, reduce handoffs, and maintain continuity across stages.

Overview

Since the release of file share discovery and assessment in Azure Migrate earlier this year, customers have indicated that while visibility into their file share estate improved, the transition to execution remained fragmented. In many cases, teams still had to work across separate workflows for inventory, readiness planning, and migration, increasing operational friction and the risk of losing context between stages.

Azure Copilot Migration Agent helps address this gap by bringing discovery, assessment, planning, and execution into a single guided journey. Azure Migrate provides visibility and recommendations, while Azure Storage Mover supports execution in a connected, agentic experience. The result is a more consistent migration path that reduces complexity, preserves context, and helps teams move file shares to Azure with greater operational confidence.

Invoking the Azure Migration Copilot Agent for on-premises data migration

Customer Value

This update streamlines the migration journey by connecting each stage of the process and reducing operational overhead. Natural language guidance helps teams start and manage migration activities much faster, often in hours or days instead of weeks.

The experience supports the following scenarios:

End-to-end discovery, assessment, and migration for on-premises Windows and Linux file shares (SMB) to Azure Files.
Discovery and assessment for on-premises Windows and Linux file shares (NFS).
Data transfers from one Azure Blob container to another container.

Design principles

The experience preserves continuity across inventory, readiness insights, and execution planning, enables direct movement of validated shares when heavyweight orchestration is unnecessary, maintains approval and sequencing controls, and supports the file and object movement patterns commonly required in production environments.

Getting Started with Storage Migration in Azure Copilot Migration Agent (ACMA)

Launch Azure Migrate: Sign-in to the Azure portal, open Azure Migrate.
From the Getting Started page, open Azure Copilot Migration Agent, then select or create an Azure Migrate project.
Describe the migration in natural language. The agent detects storage migration intent and assists with storage migration planning and routes execution requests seamlessly.

Examples scenarios and prompts

Migration of on-premises Windows Server data over SMB to Azure Files

setting up key vault after source is confirmed

create target if not already present

review configuration before creation of migration jobrun migration job and check status

2. Prompt: Help me transfer data from one Azure blob container to another blob container

Call to action

Storage integrated capability is launching in Limited Preview at Microsoft Build. Sign up for the Preview here.

For questions, contact storagemigrationcopilotagent@microsoft.com.

Learn More

Simpler, scalable file share management in Azure - now generally available

VincentLiu — Tue, 02 Jun 2026 19:07:28 GMT

Linux workloads in Azure are scaling faster than ever, powering everything from container platforms, analytics pipelines, SAP environments to line-of-business applications. As these workloads grow, infrastructure teams commonly run into challenges with scale, cost management, complexity and compliance. IT organizations need more granular control over management and isolation boundaries for file shares independent of storage accounts, to prevent multiple application teams sharing the same capacity pools, limits, and configuration surface across different storage services. Infrastructure administrators seek operational simplicity with managing access control, policy and networking isolation for file shares, so application teams can focus on business logic and development agility.

We are announcing the general availability of a new service management experience for premium SSD file shares (NFS) which allows each file share to be created, secured, scaled, and billed independently, without being tied to a storage account.

Key benefits include:

Familiar and intuitive file share management: Aligns user experience with on-premises NAS and file server paradigms, improving usability compared to the classic model.
Infrastructure-as-Code: Define naming, capacity, IOPS, networking, tags, and security in Bicep or ARM templates for simplified automation with your favorite DevOps tools.
Scale to match the workload: Support for up to 10,000 file shares per subscription per region, with 2.5x faster file share provisioning experience.
Share-level security and networking: Network restrictions, snapshots, and encryption scoped to the individual share, making isolation boundaries match workload boundaries.
Per-share cost visibility: Billing meters emit under the file share resource, teams can crossbill accurately, track per-workload costs, and improve chargeback without workarounds.

Independent performance, security, and billing per share

Combined with the provisioned v2 model, each file share is independently provisioned with its own storage, IOPS, and throughput. This allows organizations to align file shares directly to application or tenant boundaries, rather than grouping them under shared infrastructure constructs.

For multi-tenant SaaS platforms, this enables a natural one-to-one mapping between tenants and file shares. Each tenant operates within its own performance envelope, allowing steady workloads and bursty workloads to scale independently without contention. This reduces the need for capacity planning tradeoffs or overprovisioning to accommodate peak usage across tenants.

This isolation extends beyond performance; each file share carries its own encryption in transit settings, RBAC, policy, and network boundaries. For example, production tenants can be isolated with dedicated private endpoints, while development environments can operate under more flexible configurations. These boundaries align directly with application design, making systems easier to reason about and manage at scale.

Finally, treating each file share as its own resource simplifies cost management. Teams can tag and track usage at the workload or tenant level, enabling more accurate chargeback and better visibility into resource consumption. This makes it easier to understand how individual workloads contribute to overall spending without introducing additional tracking mechanisms.

Start easy, scale big

Cloud-native Linux applications often scale dynamically, so the underlying storage platform must provide resources quickly and support higher scale limits to keep pace with workload demand and enable teams to quickly provision infrastructure and keep pace of development. The new file share experience supports up to 10,000 file shares per subscription per region, making it practical to use a dedicated share for each application, environment, or tenant without running into platform limits. It also provides faster provisioning, with time to first share 2.5x times faster than classic file shares, so teams can spend less time waiting on infrastructure and more time building, testing, and shipping.

“Provisioning is fast and integrates seamlessly with Linux environments through NFS.” - Siam Commercial Bank

Data protection with snapshots

Linux workloads using shared file storage require robust data protection. With the new service management experience, customers can continue to leverage point-in-time incremental snapshots with up to 200 snapshots per share. You can also now edit metadata on individual snapshots, making it easier to organize and identify recovery points. Whether you need short term restore points or need to retain data for compliance requirements, snapshots provide an easy and cost-effective recovery mechanism.

Get started today

The new file share experience is available for NFS 4.1 file shares on SSD storage, using the provisioned v2 billing model with LRS and ZRS options. Whether the deployment model is ARM templates, Bicep, MCP server, or custom CI/CD pipelines, file shares are scriptable, repeatable, and automatable through the same tooling used for the rest of Azure infrastructure. Explore our documentation for step-by-step guidance.

We're continuously enhancing the new file share experience with the goal of achieving full feature parity while delivering improved scale and performance limits. We would love to hear your feedback, please fill out the survey to share your thoughts.

Learn more

For questions or feedback, contact us at azurefiles@microsoft.com.

Secure, Modern Access to Azure Files on macOS with MS Entra ID

grace_kim — Tue, 02 Jun 2026 18:55:03 GMT

Enterprises, large and small, rely on Azure Files for secure, scalable, and cost-efficient file storage. Modern workflows today span devices, platforms, and geographies; seamless, and secure access to shared data across every endpoint is critical to keeping teams productive and collaborative. With the growing demand for access across every device, Azure Files now extends secure access to macOS with Entra ID authentication, supporting design, creative, and AI teams where they work.

Today, we are announcing the Public Preview of MS Entra ID based authentication for Azure Files on macOS. Whether you are running creative production pipelines, design workflows, or AI workloads, macOS users can now access Azure file shares securely, meeting Microsoft Entra ID enterprise governance standards automatically and seamlessly, with no credential prompts, no storage account keys, and no complexity.

Key benefits

Enhanced Security posture: MacOS users can now sign in to their device and open shared files in Finder with no credential prompts and no storage account keys. Microsoft Entra ID governs access, conditional access policies, MFA requirements, and MS Entra ID governance applies automatically with AES-256 encryption.

Reduced operational overhead: IT admins no longer need to manage storage account key distribution/rotation. Provisioning and deprovisioning access is handled through standard Entra ID group membership.

No dependency on Active Directory: Organizations moving away from on-premises infrastructure, including Active Directory, can now give MacOS users full access to Azure file shares using cloud-based identities in MS Entra ID, with no domain controller required. MacOS users get full parity with the traditional Windows SMB share experience.

Identity Based Access model: User authentication is enforced with Kerberos and share-level access is enforced through Azure RBAC. File and folder permissions are controlled through NTFS ACLs, giving organizations precise, layered control.

Enabling AI-Driven Workloads: SMB shares on macOS enables AI teams to seamlessly access and share large datasets, fueling faster experimentation and streamlining developer and AI-generated workflows.

Partnership with Apple

Azure Files support for macOS is built in close collaboration with Apple macOS SMB engineering team. The integration works with Apple’s Platform SSO and the Microsoft Enterprise SSO plug-in, via MDM platforms such as Microsoft Intune. This allows macOS devices to authenticate through Microsoft Entra ID with single sign-in. We are committed to continuing this partnership to ensure Mac users in enterprise environments have a first-class experience accessing cloud services.

Powering Diverse Workloads across Design, Developer and Education Enterprises

Secure SMB access for creative workloads

Creative workflows on macOS have historically required workarounds to reach centralized cloud storage, often meaning local copies, consumer file sharing tools, or storage account keys distributed to individuals. Azure Files gives creative teams direct access to shared project libraries and production files from Finder, with no syncing or local copies needed. For IT, setup is simple: assign the right RBAC role on the share, add users to an Entra group, and access is ready. No keys to distribute and no deep storage expertise required.

"Secure access for our macOS users is a gamechanger for our creative teams. The ability to mount directly and access shared files securely — without keys, without workarounds — changes how we work. It’s how modern enterprise file access should feel." -Peter Day, Senior Engineer, The Marketing Store

SMB shares streamline developer and AI-generated build workflows

MacOS developers rely on local tools like Visual Studio Code, GitHub copilot, or fast iteration, but build artifacts, logs, and AI-generated outputs often end up fragmented across machines and pipelines.

With Azure Files, teams can use SMB shares as a centralized workspace for build outputs and shared assets. Mac build systems can write directly to a mounted share, making artifacts immediately accessible across developers, pipelines, and AI agents. DevOps teams gain a secure, identity-based storage layer using RBAC and Microsoft Entra, without managing keys or custom storage solutions.

Enable collaboration across mixed platform environments

Mac users should not be a special case. Azure Files gives MacOS users the same governed, identity-based access to shared storage that Windows users have always had. Access is provisioned through Entra ID, enforced through RBAC, and managed without a separate workflow, separate keys, or separate infrastructure. For large organizations running mixed-OS environments, this means a single, consistent access model tied to the user and not a device – the user can seamlessly access the SMB share across their Windows and Mac devices.

“By supporting Kerberos authentication for Azure Files on Mac devices, Microsoft delivers secure, consistent access for organizations operating mixed-OS environments. It addresses a long-standing enterprise gap by extending centrally governed identity controls to all users, regardless of device—helping organizations simplify access management and maintain trust at scale.” -Preetham G.K., CDL, Accenture

Modernize Infrastructure and secure access for Educational Institutions

Institutions standardizing on macOS have faced a hard tradeoff: maintain costly on-premises infrastructure at every site or accept that MacOS users fall back on personal drives and consumer file sharing. Neither is acceptable at scale. Azure Files removes the tradeoff. Students, faculty, and staff access shared repositories and course materials directly from an SMB share over Finder using their Entra ID credentials. Access management can be controlled through group membership, with no per-site infrastructure and no manual credential management.

Get started with Azure Files Entra Kerberos authentication for macOS

Start leveraging secure, identity-based file access on macOS today at no added cost. Explore our documentation for step-by-step guidance. Whether you are onboarding new Mac users or modernizing an existing deployment, this feature gives your organization a simple path to identity management for Azure Files on macOS. Make your Mac workloads ready for the future!

For any questions, please reach out to the team at azurefiles@microsoft.com.

From Scale to Breakthrough: Azure NetApp Files Sets a New Cloud Benchmark for EDA Performance

GeertVanTeylingen — Fri, 22 May 2026 15:00:00 GMT

Introduction

New benchmark proof with large volume breakthrough mode

What is Azure NetApp Files large volume breakthrough mode?

Explore the latest Azure NetApp Files SPECstorage® 2020 publications

Results that Speak for Themselves

Single large volume breakthrough mode

Large volume breakthrough mode at scale

Performance that Scales with Your Design Cycles

From large volume scale… to breakthrough mode scale

What Storage Performance Means For EDA Velocity

Learn more

Introduction

In his latest Azure NetApp Files for EDA workloads: From revolution to breakthrough at scale post Aung Oo – Vice President, Azure Storage – explored a fundamental shift in Electronic Design Automation (EDA) infrastructure: cloud storage no longer needs to tradeoff between scale and predictable performance. It unpacked the historical compromises EDA teams made to balance amongst extreme concurrently, shared datasets and the strict latency requirements and how Azure NetApp Files was architected to solve these challenges with consistent, linear scaling behavior.

Just as importantly, that post presented independently validated SPECstorage® Solution 2020 benchmarks showing that Azure NetApp Files can support real-world EDA workloads at scale while sustaining sub-millisecond latency – shifting cloud storage from a bottleneck in modern chip design pipelines to an enabler.

This blog builds on that foundation.

With the introduction of Azure NetApp Files large volume breakthrough mode, the conversation shifts from proving scalable performance to redefining its upper limits. Where earlier results established predictable scaling, breakthrough mode pushes the concurrency envelope further – allowing thousands of parallel jobs to share storage while maintaining consistent latency under sustained load.

The result is a new level of cloud performance for EDA: not just solving scale challenges, but delivering a true performance breakthrough, now validated by the latest SPECstorage® Solution 2020 benchmark publications.

In this blog, we take a closer look at two new SPECstorage® Solution 2020 EDA_BLENDED benchmark submissions that validate the impact of large volume breakthrough mode, both for a single volume configuration and at scale, and place those results in real-world context.

Co-authors:

Ron Hogue, Sr. Program Manager
Ranga Sankar, Azure NetApp Files Product Manager
Andy Chan, Azure NetApp Files HPC/EDA Principal Product Manager
George Strother, Senior Cloud Solutions Architect, NetApp
Cass Morgenstern, Director of Engineering - Office the CTO, NetApp

New benchmark proof with large volume breakthrough mode

Following the same industry‑standard SPECstorage® Solution 2020 EDA_BLENDED workload methodology used in our prior large volume submissions, the newly published results evaluate:

Azure NetApp Files large volume breakthrough mode
Azure NetApp Files large volume breakthrough mode scale

Together, these independently audited benchmark publications validate how breakthrough mode enable Azure NetApp Files large volumes to sustain higher concurrency levels while maintaining the consistent, sub‑millisecond response times that modern chip design pipelines depend on.

What is Azure NetApp Files large volume breakthrough mode?

Azure NetApp Files large volume breakthrough mode unlocks a new level of scale and performance for the most demanding EDA workloads. By combining massive concurrency with consistent sub-millisecond latency, it helps modern chip design pipelines move faster, scale further, and operate without compromise.

For a quick overview, check out the Quick Byte video:

Explore the latest Azure NetApp Files SPECstorage® 2020 publications

These two newly released benchmark publications showcase the exceptional performance and scalability of Azure NetApp Files’ large volume breakthrough mode for EDA workloads.

Azure NetApp Files large volume breakthrough mode:
https://www.spec.org/storage2020/results/res2026q2/storage2020-20260227-00147.html

Azure NetApp Files large volume breakthrough mode scale:
https://www.spec.org/storage2020/results/res2026q2/storage2020-20260227-00148.html

Results that Speak for Themselves

This chapter presents the latest benchmark results for Azure NetApp Files in full detail, highlighting the significant performance advantages enabled by large volume breakthrough mode. Through both single and scaled large volume configurations, these results demonstrate the ability to support demanding EDA workloads with exceptional throughput and consistent low latency. The findings underscore Azure NetApp Files’ capability to meet the rigorous requirements of modern chip design pipelines, ensuring reliability and efficiency at every scale.

Single large volume breakthrough mode

The architecture shown in the diagram was specifically designed to generate the load necessary for producing the benchmark results discussed in this section.

The result:

The Azure NetApp Files large volume breakthrough mode configuration reached 2,880 SPECstorage® Solution 2020 EDA_BLENDED JOBS with an overall response time of 0.51 ms.

A single Azure NetApp Files large volume breakthrough mode delivered 20,910 MB/s (19,941 MiB/s) of throughput and 1,296,040 operations per second at peak.

Throughout the iterations, sub-millisecond latency was observed with latency only breaching 1 ms at the very peak.

This level of performance demonstrates how a single large volume deployment can sustain thousands of concurrent EDA workloads – while preserving the latency profile required for simulation, synthesis, and verification tasks.

Large volume breakthrough mode at scale

The architecture shown in the diagram was specifically designed to generate the load necessary for producing the benchmark results discussed in this section. For resource availability reasons, six volumes were distributed across multiple Azure regions and availability zones, though this is not a requirement. Deployments can use any number of volumes, and regional / zonal distribution is optional – only necessary when targeting specific availability or resilience goals.

The result:

The Azure NetApp Files large volume breakthrough mode scale configuration reached 17,280 SPECstorage® Solution 2020 EDA_BLENDED JOBS with an overall response time of 0.60 ms.

At this scale, the aggregate throughput was 125,474 MB/s (119,661 MiB/s), with 7,776,147 operations per second on the benchmark.

Again, throughout the iterations, sub-millisecond latency was observed with latency only breaching 1 ms at the peak.

Even at six times the workload scale, latency remains consistently sub‑millisecond – enabling highly parallel EDA workflows to scale without introducing storage‑induced bottlenecks.

The multi-region/zone configuration was selected for resource availability reasons. This configuration is not a requirement, and deployments can use any number of volumes – by no means limited to six. A configuration can scale to any number of volumes, provided sufficient large volume capacity is available.

Performance that Scales with Your Design Cycles

Across breakthrough mode and breakthrough mode scale configurations, latency remains tightly bounded as workload concurrency increases — indicating that Azure NetApp Files large volume breakthrough mode enables linear scalability characteristics without introducing latency instability under load.

EDA_BLENDED Metric	Large volume breakthrough mode	Large volume breakthrough mode scale	Factor
Job Sets	2,880	17,280	6.00x
Throughput (MB/s)	20,910	125,474	6.00x
Operations/second	1,296,040	7,776,147	6.00x
ORT (ms)	0.51	0.60	1.18x

This predictable performance and scale behavior is critical for distributed EDA environments, where design teams increasingly rely on massively parallel simulation and verification jobs to accelerate time‑to‑tape‑out.

From large volume scale… to breakthrough mode scale

Compared to previously published (non‑breakthrough mode) large volume results from October 2025,, large volume breakthrough mode expands the achievable throughput envelope while even lowering observed overall response times as workload levels increase.

This allows Azure NetApp Files to deliver:

Higher aggregate throughput ceilings
Greater concurrency tolerance
Consistent latency behavior under scaled-out EDA job submission

– all without architectural changes to application workflows.

More Throughput + Consistent Low Latency = More Jobs!

What Storage Performance Means For EDA Velocity

Modern EDA workflows are built around rapid, iterative design loops, where architects and physical designers continuously refine Register-Transfer Level (RTL), run regressions, analyze timing, fix violations, and repeat often thousands of times before tape‑out. At scale, these workflows depend on large compute grids with hundreds or thousands of cores accessing shared storage simultaneously. In this environment, storage latency is not just a performance metric; it directly determines engineering velocity and business outcomes. Azure NetApp Files large volume breakthrough mode delivers cloud‑native storage performance that keeps every core productive, enabling higher simulation throughput, faster iteration cycles, and predictable performance even under extreme parallel load. The benchmark results independently validate how Azure NetApp Files large volume breakthrough mode empowers the most demanding modern EDA workflows.

Ultimately, this improves engineering velocity. Shorter regression cycles enable more iterations per day, higher compute utilization eliminates idle cores, and predictable performance allows teams to confidently push scale without risk. More iterations before tape‑out translate directly into better Power, Performance, and Area (PPA) outcomes and faster time‑to‑market. For semiconductor design organizations, Azure NetApp Files large volume breakthrough mode elevates storage from supporting infrastructure to a strategic enabler – delivering independently validated, cloud‑scale performance purpose‑built for the most demanding EDA workloads.

Storage Performance Impact on Engineering Velocity:

Shorter regression cycles → more design iterations per day
Higher compute utilization → no idle cores or wasted licenses
Fewer job failures → engineers focus on design, not infrastructure
Faster data movement → smoother transitions across design stages

This is why companies investing in cloud‑scale EDA infrastructure such as AMD, Microsoft, and ASML, consistently report faster time‑to‑market and stronger design outcomes.

Learn more

Action required: Kerberos RC4 hardening may affect Azure Files Active Directory Domain Services

grace_kim — Fri, 05 Jun 2026 21:50:11 GMT

A Windows security hardening change beginning in April 2026 updates default Kerberos encryption behavior and may impact customers using Azure Files with Active Directory Domain Services (AD DS) authentication over SMB. If you created Azure Files shares prior to 2023, or chose RC4 encryption for your file shares, you will need to reconfigure to use AES-256 to avoid disruption to file share access. This is in accordance with the updated security posture and recommendation from Windows CVE-2026-20833.

Background

Azure Files uses Kerberos authentication for identity-based access when integrated with on-premises Active Directory Domain Services (AD DS). AES-256 Kerberos encryption has been supported since AzFilesHybrid module v0.2.2, and it has been the default since v0.2.5. Historically, RC4 was the only supported option until AES-256 support was added. This is a Windows platform security hardening change; Azure Files service behavior is not being modified.

You may be impacted if:

You use Kerberos-based SMB access to Azure Files with AD DS authentication, and
Kerberos encryption settings are RC4-only or unset (null) for relevant AD objects, service accounts, or computer accounts associated with Azure Files authentication.

When will this happen:

April 2026 – July 2026: Install the Windows security update and validate access. Domain controllers will default to issuing AES-256 tickets when msDS-SupportedEncryptionTypes is not explicitly set.
After July 2026: Manual rollback is removed. If you have not migrated to AES-256 by then, Kerberos-based SMB access to your Azure Files shares may fail.

What you should do now:

Find out if you are impacted, run the following PowerShell command on a domain-joined machine, with read access to AD. This identifies storage accounts that use Azure Files with AD DS authentication but have not been upgraded to AES-256 or follow the detection steps in aka.ms/rc4azurefiles:

Get-ADObject ` -LDAPFilter "(&(servicePrincipalName=*.file.core.windows.net)(!(msDS-SupportedEncryptionTypes=*)))" -Properties servicePrincipalName, msDS-SupportedEncryptionTypes | Select-Object Name, ObjectClass, servicePrincipalName, msDS-SupportedEncryptionTypes

Update configurations to support and prefer AES256-based Kerberos ticket encryption.
Validate end-to-end SMB authentication and application access to Azure Files shares.
Run klist purge from an elevated command prompt to clear any cached Kerberos tickets that still use RC4.
Remount the Azure file share.

For any questions, please reach out to the team at azurefiles@microsoft.com

Resources:

Azure Files documentation on this change
Read the full Windows hardening guidance: How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833.
Learn about RC4 usage in Windows and its risks: Detect and remediate RC4 usage in Kerberos.
Learn more about the related vulnerability: CVE-2026-20833.
Windows Server Blog: Beyond RC4 for Windows authentication

Modernizing Azure Virtual Desktop with Nerdio and Azure Files

Vybava_Ramadoss — Mon, 04 May 2026 16:05:17 GMT

Coauthored with Nerdio

Organizations adopting Azure Virtual Desktop (AVD) typically begin with small pilot deployments that perform well under limited load. As these environments scale to hundreds or thousands of users, a consistent set of challenges emerges. At the center of that shift is the user profile layer. FSLogix profile containers—stored on file shares—sit directly on the critical path of the user experience. During peak periods such as login storms, profile attach latency becomes a primary determinant of sign-in performance. At the same time, identity dependencies, storage configuration complexity, and cost management introduce variability across environments. What worked in a pilot often becomes more difficult to manage consistently at scale.

Common challenges include:

Performance variability during peak concurrency
Complex identity configurations for SMB access
Configuration drift across environments
Cost inefficiencies from peak-based provisioning

At enterprise scale, these issues converge at the storage and identity layers—making them central to both user experience and operational efficiency.

Nerdio: simplifying how AVD is deployed and operated

Nerdio Manager (available as Nerdio Manager for Enterprise and Nerdio Manager for MSP) is a deployment, management, and auto-scaling platform for Azure Virtual Desktop (AVD) with capabilities such as desktop image management, performance monitoring, and user session control to eliminate the need for complex scripting and speed up responses to end-users. Nerdio Manager helps organizations deploy and operate AVD environments in a more consistent, repeatable way. Rather than treating compute, storage, and identity as separate workflows, Nerdio integrates these components into a single operational model. Storage provisioning, permissions, and FSLogix configuration are handled as part of host pool deployment and scaling. This reduces coordination overhead, minimizes configuration drift, and keeps storage aligned with how environments grow.

This view shows how Nerdio brings users, host pools, and storage into a single control plane—ensuring storage is configured as part of deployment, not after.

Azure Files: enabling performance and identity at scale

Azure Files provides the foundational storage layer for FSLogix profile containers in many AVD environments. Because profiles attach at sign-in, storage performance directly impacts user experience.

Provisioned v2: performance without over-provisioning

Azure Files Provisioned v2 decouples performance (IOPS and throughput) from capacity. Previously, higher performance required over-provisioning storage. With Provisioned v2, organizations can align performance directly to workload needs. This is especially important for FSLogix, where login storms create short bursts of high IOPS demand even when data volumes are modest. The result: better cost efficiency and more predictable performance.

“We’ve been early adopters of Nerdio and consistently see meaningful Azure cost optimization… With Azure Files Provisioned v2, the decoupling of quota and IOPS… gives us precise control over performance and cost.” — David Wasserman, Chief Value Officer, FlexibleIT.com

Entra ID authentication: simplifying identity architecture

Azure Files supports Microsoft Entra ID authentication for SMB, enabling a cloud-native identity model.

This eliminates the need for domain infrastructure used only for storage access, resulting in:

Reduced infrastructure overhead
Simpler networking
Lower operational burden
Alignment with Zero Trust

These capabilities are already in use in Nerdio Manager for MSP environments managing multi-tenant deployments, and are being extended to Nerdio Manager for Enterprise in Q3 CY26 to enable the same cloud-native model within enterprise environments

This highlights how provisioning, monitoring, scaling, and identity are handled as part of a unified system instead of fragmented tasks.

Operationalizing storage at scale, why this matters for enterprises

Enterprise AVD environments operate under fundamentally different constraints. User populations are larger and more concentrated, compliance requirements are stricter, and tolerance for performance variability is significantly lower.

In practice, these pressures converge at the storage layer.

For enterprise customers, the goal is not automation itself—it is better user experience, lower cost, and predictable operations.

Faster, more consistent deployments. Storage is configured alongside compute, reducing dependency on separate teams and minimizing drift.
Lower cost without sacrificing peak performance. Capacity and performance align with actual demand instead of peak assumptions.
More predictable sign-ins during login storms. Standardized configuration reduces bottlenecks during high concurrency.
Audit-ready governance by default. RBAC, snapshots, backup, and data protection policies are applied consistently across environments.

Get started

At scale, Azure Virtual Desktop is as much about storage and identity as it is about compute. Azure Files plays a central role in determining sign-in performance, user experience, and cost efficiency. With Provisioned v2 and Entra ID authentication, organizations can move toward a more predictable and cloud-native model. Nerdio builds on this foundation by integrating storage and identity into a unified AVD deployment and operations workflow. Get started with Nerdio today.

AHEAD helps us launch the Strategic Azure Storage Services Partner Program

karautenMSFT — Fri, 01 May 2026 00:49:28 GMT

Authors:

Aung Oo, Vice President Azure Storage Product Management

Parker Leavitt, Partner Account Manager, AHEAD

Special thanks to:

Michael Johnson, Vice President, Cloud, AHEAD

AHEAD background

AHEAD was formed in 2007 and possesses deep expertise in Infrastructure, Cloud Platforms, AI, Analytics, Networking, Storage, Security and many more technical disciplines. 80% of AHEAD’s employees are engineers who help customers with the assessment of their needs to design optimal solutions and through implementation of complex application and infrastructure deployments. Headquartered in Chicago, IL, AHEAD has locations worldwide and is ready to assist with your most complex Azure projects. They hold over 1,000 Microsoft certifications and 4 Advanced Specializations.

Valued collaboration

AHEAD has been a key advisor to Azure Storage throughout the design and build of our Channel strategy. As a premier Microsoft Cloud and AI Partner, and with decades of Storage expertise, AHEAD helped us to create the Learning Path channel partners will need to complete to qualify as a Strategic Azure Storage Services Partner (SASS). SASS Partners have been validated by us to possess the skills to offer consulting, design, implementation, and migration services to Azure and ISV Storage services.

What can you expect?

AHEAD brings their history of infrastructure expertise to Azure Storage customers through a catalog of services that make it possible to select the optimal solution to ensure the ideal blend of price, performance, and resiliency.

Assessment

What are you doing to prepare for the industry wide memory shortage? How well do you understand your datasets? What are your performance requirements? Are there features you are paying for and not using? When was the last time that directory hosting the “Super Important Project” files was accessed? Is there mission critical data hiding that you should be leveraging to fuel Enterprise AI Agents? Is an Azure Storage Service the best fit for your data, or is it better to migrate it to one of our Storage ISV services?

AHEAD provides Microsoft-funded assessments that deliver data-driven guidance to help you align your application and data set needs with the ideal storage service(s) on Azure. We have long advocated that the best solution is the one that meets your requirements both today and in the future. AHEAD can help you get there.

Migration

After gaining insight into your data estate, AHEAD has the experience to help you migrate safely with best-of-breed solutions. Whether offline migration with Data Box or online over the network with Storage Mover or one of our validated ISVs like Komprise, Cirrus Data, or Cirata, AHEAD can help you move your data to an Azure Storage service like Blob Storage, Files, Elastic SAN, or NetApp Files – or one of our ISV Partners like Nasuni and Pure Storage. You can find our full list of validated partners on Microsoft Learn.

Azure Storage ISV Strength

An important reason we chose to onboard AHEAD as our first Strategic Channel Partner was the large crossover in mutual ISV relationships they possess, and their proven skills with each. You can view AHEAD’s full list of partners, including Nasuni, NetApp, Everpure, Commvault, Veeam, Rubrik, and Dell on their website. Our recent engagements with AHEAD and Nasuni are a great example of AHEAD’s depth. They were able to quickly determine Nasuni as the best fit for a customer who required a single centralized Azure-based repository for their data that could then be accessed within Azure and multiple remote locations simultaneously.

AHEAD has shown us that across their portfolio of ISVs, they can help you implement best-of-breed ISV services that include solutions in:

Air Gap Business Continuity
VMware Modernization
Storage Modernization
Cloud Scale Analytics
AI Dataset Curation

How can you move forward?

Do you need help understanding your data estate? Could you use expertise selecting the ideal service in Azure to host your data? Reach out to the AHEAD Azure team at info@ahead.com or via their Rapid Assess offer on Microsoft Marketplace and get started today!

Strategic Azure Storage Services Partner

In coming months, you will see our list of SASS Channel Partners expand, but we could not be more grateful to AHEAD for being a not only a pioneer, but a trusted advisor. Their commitment to Azure and Azure customers has made an impact that will benefit our customers worldwide.

Prefix-scoped access for User Delegation SAS is now generally available for Azure Blob Storage

despindola — Wed, 06 May 2026 20:01:06 GMT

We would like to share that prefix-scoped access for User Delegation SAS for Azure Blob Storage is generally available in all Azure regions.

SAS tokens for Blob Storage have historically supported two levels of scope: container and individual blob. With this release, you can now scope access to a prefix or virtual directory within a container, granting access to all blobs beneath the path.

This is especially valuable for applications that organize data by tenant, workspace, project, or department within a shared container. Instead of granting access to an entire container or generating many blob-level tokens, you can now issue a single SAS token scoped to a set of blobs through a prefix.

For example, if a container has these blobs:

contoso/sales/Q1-report.csv

contoso/sales/Q2-report.csv

contoso/invoice.pdf

A SAS token scoped to the prefix contoso/sales would grant access only to the two sales reports. This simplifies manageability by not having to generate multiple blob scoped tokens which significantly reduces overhead to manage permissions for large scale data storage estates. In addition, it helps customers provide more scoped permissions to a certain set of blobs rather than broader permissions at a container level.

Prefix-scoped access is supported for both Blob and Data Lake storage accounts.

As a best practice, we recommend using Entra ID with RBAC or ABAC for least privilege access. If you need to use SAS for your use cases, we recommend using user delegation SAS and prefix-based scoping is a good option to consider for more scoped permissions for a certain set of blobs.

Pricing and Availability

There is no additional cost for prefix-scoped access for user delegation SAS. Pricing is based on standard transaction costs for your storage account type. To learn more, see Azure Storage Pricing. 

Prefix-scoped access for user delegation SAS is available in all Azure regions.

How to generate a prefix-scoped SAS

To generate and use a prefix-scoped SAS:

Identify the prefix (or virtual directory) you want to authorize.
Follow the steps in the documentation to create a prefix-scoped SAS for user delegation SAS.
Use the SAS token with your application.

Notes

Support for prefix-scoped access parameters is available with authorization version 2020-02-10 or later via REST API and .NET Blob SDKs starting with version 12.29.0-beta.1 and newer.
The semantics for prefix scope (sr=d) are similar to container scope (sr=c), except that access is restricted to a prefix. When creating a prefix-scoped SAS, you must specify the signedDirectoryDepth (sdd) to indicate how many directory levels from the container root to the specified directory. For example, to grant access to dir2 on path container1/dir1/dir2, set the directory depth (sdd) = 2 to indicate the SAS is scoped to dir2 and everything beneath it.
Below are .NET SDK and REST API examples for reference.

.NET SDK Sample Definition

BlobSasBuilder blobSasBuilder = new BlobSasBuilder( permissions: BlobContainerSasPermissions.All, expiresOn: Recording.UtcNow.AddDays(1)) { BlobContainerName = test.Container.Name, BlobName = blobName, IsDirectory = true, }; // Test using same name as SAS BlobUriBuilder blobUriBuilder1 = new BlobUriBuilder(test.Container.Uri) { BlobName = blobName, Sas = blobSasBuilder.ToSasQueryParameters(Tenants.GetNewSharedKeyCredentials()) }; AppendBlobClient appendBlobClient1 = new AppendBlobClient(blobUriBuilder1.ToUri(), GetOptions()); await appendBlobClient1.CreateAsync(); // Test using SAS name + suffix BlobUriBuilder blobUriBuilder2 = new BlobUriBuilder(test.Container.Uri) { BlobName = blobName + "/test", Sas = blobSasBuilder.ToSasQueryParameters(Tenants.GetNewSharedKeyCredentials()) }; AppendBlobClient appendBlobClient2 = new AppendBlobClient(blobUriBuilder2.ToUri(), GetOptions()); await appendBlobClient2.CreateAsync();

REST API Sample Request

GET https://myaccount.blob.core.windows.net/mycontainer

?restype=container

&comp=list

&prefix=dir1/dir2/

&sr=d

&sdd=2

&sp=rl

&sv=2024-11-04

&se=2026-04-22T06:00:00Z

&skoid=<signed-oid>

&sktid=<signed-tid>

&skt=2026-04-22T00:00:00Z

&ske=2026-04-22T08:00:00Z

&sks=b

&skv=2024-11-04

&sig=<signature>

Next Steps

For a deeper dive, explore these resources:

Help and Support

If you have questions, get answers from community experts in Microsoft Q&A. If you have a support plan and you need technical help, create a support request:  

For Issue type, select Technical.  
For Subscription, select your subscription.  
For Service, select My services.  
For Service type, select Blob Storage.  
For Resource, select the Azure resource you are creating a support request for.  
For Summary, type a description of your issue.  
For Problem type, select Authentication and Authorization .
For Problem subtype, select Issues using Shared Access Signature (SAS Token).

Secure, Keyless Application Access with Managed Identities - Now GA in Azure Files SMB

Priyanka-Gangal — Mon, 20 Apr 2026 17:57:56 GMT

As enterprises modernize applications and strengthen their security posture, identity is central to how applications access shared storage. Traditional identity models relying on account keys, stored credentials, or domain‑joined infrastructure add operational overhead and introduce security risks such as credential leakage, lack of identity attribution, and excessive privilege if shared keys are compromised. Today, we are excited to announce the General Availability (GA) of Managed Identity support for Azure Files over SMB, enabling applications and virtual machines to securely access Azure Files without secrets, passwords, or key distribution.

Managed Identity support enables customers to meet modern enterprise security standards without reliance on storage account keys, streamlining how organizations securely enable file‑based application access and reducing the operational overhead of filing internal exceptions. New storage accounts can support secure, identity‑based SMB access out of the box, while existing deployments can get secure by enabling Managed Identity authentication.

From web application workloads such as WordPress, to databases on Azure Kubernetes Service (AKS), to CI/CD pipelines, applications require secure access. In a world where security is foundational, continued reliance on key-based access conflicts with Zero Trust principles and least privilege access.

What’s New In GA

AKS Workload Identity Support

AKS Workload Identity (preview) extends the traditional managed identity model for Kubernetes by shifting the identity from the node to pods. Instead of inheriting the identity of the underlying cluster, each Kubernetes pod can use its own federated identity, mapped directly to a Microsoft Entra ID principal.

This feature enables:

Pod-level identity isolation, rather than cluster-level
Least-privilege access with secure RBAC
Seamless scaling and redeployment, without identity reconfiguration
No secrets, no key rotation, no credential injection

When combined with Azure Files over SMB, Workload Identity allows AKS workloads to access shared file storage securely and natively per pod, using the same identity-driven model as cluster level managed identities. Now available with AKS 1.35, for customers specifically in the financial services industries, AKS Workload Identity enables per‑application, least‑privilege access to Azure Files without credentials, improving isolation and auditability. This allows regulated, stateful workloads to run securely on AKS while meeting strict compliance and regulatory requirements.

Co-existence of Application Identities and end-user identity access

Azure Files now enables both Managed Identity and end‑user access on the same storage account, with users and applications independently authenticated via Entra ID and authorized through a shared permissions model.
This unified access model eliminates the need for duplicate storage or credentials, enabling secure collaboration, troubleshooting, and automation on shared data without compromising governance or compliance.

This supports scenarios such as:

Developers accessing the same file share as an application for debugging
Admins managing content used by automated workflows
Hybrid environments with user-driven and app-driven access

Simplified Storage Account enablement via the Azure portal

We have now added a dedicated Managed Identity property that makes enabling identity‑based SMB access simple and transparent via the Azure portal for new as well as existing storage accounts. With a single configuration at the storage account level, customers can allow applications to authenticate to Azure Files using Managed Identities. This portal experience supports incremental adoption, making it easy to modernize authentication while maintaining compatibility with existing user access and governance models.

Get Started with Managed Identities with SMB Azure Files

Start using Managed Identities with Azure Files today at no additional cost. This feature is supported on HDD and SSD SMB shares across all billing models. Refer to our documentation for complete set-up guidance.

Whether provisioning new storage or enhancing existing deployments, this capability provides secure, enterprise‑grade access with a streamlined configuration experience.

For any questions, reach out to the team at azurefiles@microsoft.com.

Simplify On-prem File share Migration to Azure: Discover & assess suitability using Azure Migrate

bapic — Fri, 22 May 2026 10:24:28 GMT

UPDATE as of 20th May 2026: We are happy to announce that this capability is now GA worldwide.

Migrating on‑premises file servers to the cloud is a complex infrastructure transformation—not just a data move. Many organizations lack the visibility needed to decide whether to rehost or modernize file shares spread across Windows and Linux servers. Azure Migrate now extends its discovery and assessment capabilities to SMB and NFS file shares, enabling a data‑driven approach to modernizing on‑premises file workloads with Azure Files, or alternatively rehosting to deployment within an Azure VM.

We are pleased to introduce the public preview of Azure Migrate’s new comprehensive discovery and assessment of on-premises SMB and NFS file shares for migration to Azure Files. This enhancement simplifies the migration process by integrating discovery and evaluation tools for SMB and NFS shares across both Windows and Linux platforms. Users can efficiently identify file shares, analyze their compatibility, and compare cost benefits for transitioning to Azure Files, all within an intuitive and streamlined interface.

Why does this matter

File shares remain a foundational service for most workloads - supporting applications, analytics, user home directories, and shared content. Planning such a vast amount of data for migration can be slow, manual, and fragmented. This new Azure Migrate capability is designed to help with:

Reduce migration planning from months to weeks through automated discovery and assessment of SMB and NFS file shares.
Perform holistic migration planning of your data and storage alongside servers, applications and data bases from within Azure Migrate experience.
Modernize confidently to Azure Files with tailored SKU recommendations, readiness assessments, and comprehensive cost insights, enabling you to build a clear business case by comparing ongoing on-premises and Azure Files costs.

What’s available in public preview

Discover and view details of all on-premises SMB, NFS shares hosted on Windows and Linux servers
Group, tag, filter shares by Production, non-production, project, business group for better planning.
Create and review assessment for each share, its target Azure Files SKU based on region, redundancy, pricing options and media type.
Generate a business case for selected group of shares running on Azure Files against on-premises cost.

How do you get this feature? Install the latest Azure Migrate appliance, or enable the auto update feature for the appliance will receive this new capability. All existing SMB, NFS file shares will be reported in the Azure Migrate portal along with their Windows and Linux hosts. You do not need to perform any additional steps to discover the shares.

End-to-end experience

The experience is fully integrated into Azure Migrate and follows a familiar, guided workflow as below.

1. Discover on‑premises file servers and file shares

You can start by creating an Azure Migrate project in the Azure portal and enabling discovery using the Azure Migrate appliance. The appliance can be deployed in connected or disconnected mode and runs on VMware, Hyper‑V, or physical servers. Once deployed, the appliance automatically discovers file servers and the file shares they host, including:

Operating system (Windows or Linux)
File share protocol (SMB or NFS)
Associated volumes
Estimated capacity
Basic performance metrics such as IOPS and throughput (when performance collection is enabled)

Discovered file shares appear directly in Azure Migrate inventory views, where they are surfaced as inventory items under respective Windows or Linux systems. This makes it easy to filter, tag, and review all shares at scale.

2. Build a business case

The next step is to create a business case. This offers a clear comparison of on-premises costs versus Azure, highlights long-term savings and operational benefits, and justifies modernizing to Azure Files rather than rehosting file servers on virtual machines. This allows IT leaders to make data-driven decisions confidently.

3. Create and review an Azure Files assessment

Once you have finalised your business case and decided to move to Azure Files, you can initiate an Azure Files assessment right from the Azure Migrate platform. The assessments are adaptable, allowing you to focus solely on file shares, include their parent servers, or even expand to scenarios that cover VMs, databases, and file shares—reflecting real-world planning needs. Each assessment reviews readiness and provides recommendations based on inventory and performance metrics gathered. Furthermore, you can tailor assessment settings, including selecting a target Azure region, pricing and savings preferences, media type, redundancy options, and choosing either performance-based or as-is sizing. The assessment offers a detailed overview of migration readiness and economic factors, supporting well-informed decisions for subsequent actions.

Key insights include:

Readiness states for each file share (Ready, Ready with conditions, or Not ready)
Recommended Azure Files SKU based on performance and suitability. For example, Azure Files provisioned v2 premium SSD for a NFS 4.1 share as target.
Monthly cost estimates for the recommended SKU.
On‑premises vs Azure TCO comparison, helping customers understand long‑term cost implications

Azure Migrate also identifies potential warnings and provides necessary remediation guidance. For example, when a redundancy type is not available in an Azure region, it is flagged as ready with conditions and recommend choosing an alternative redundancy type and fallback to next available option.

Prepare for migration with appropriate tools

Once you are ready to migrate, Azure Migrate also highlights recommended migration tools as part of the assessment. Azure Storage Mover is the default recommended path for file share migrations—providing a first party, managed service to move data efficiently to Azure Files. To learn more about Microsoft’s recommendations to unstructured data migration using other tools, please visit: https://aka.ms/migratemydata.

Learn more about creation of assessment and review assessment to get started with understanding your on-premises file shares estate today. Write to us at migratemydata@microsoft.com for any questions or feedback - we look forward to hearing from you!

Unlocking AI-Ready Unstructured Data at Scale with Komprise and Azure

dmalbrough — Thu, 02 Apr 2026 09:53:30 GMT

Why Move Unstructured Data to Azure

On-premises storage environments are often over-provisioned to accommodate future growth, driving costs and operational complexity. Azure’s cloud-based storage platform enables organizations to right-size their environments through elastic scaling and Microsoft’s global economies of scale. This flexibility is especially critical for regulated industries managing sensitive data at massive scale.

Azure also delivers enterprise-grade security capabilities, including immutability and object locking, which protect data against ransomware and malicious deletion. By moving unstructured data to Azure, organizations gain not only cost efficiency, but also a more resilient and secure data foundation.

A strong example of this approach is the Florida Department of Environmental Protection. With support from Komprise and funding through Microsoft’s Azure Migrate program, the department successfully migrated large volumes of data to Azure, enabling the phase-out of on-premises data centers while maintaining access to data for analysis across regions. This demonstrates how organizations can modernize data infrastructure without disrupting business operations.

Hybrid Cloud and Intelligent Tiering

Most enterprises operate in hybrid environments, balancing on-premises systems with cloud storage. Komprise and Microsoft address this reality by enabling intelligent tiering of unstructured data across environments.

Using Azure Blob Storage, organizations can transparently move cold and infrequently accessed data to lower-cost cloud tiers while keeping frequently accessed data close to applications and users. This approach reduces pressure on expensive on-premises storage infrastructure without sacrificing accessibility. For example, a major healthcare organization achieved approximately $2.5 million in storage cost savings by tiering cold data to Azure while maintaining seamless access for clinicians and applications.

AI Depends on Data Curation

AI's efficacy is reliant on data quality. The need for high-quality and curated data cannot be enough emphasized so AI can generate meaningful and accurate results. In partnership with Komprise, organizations can efficiently cleanse and enhance their data by identifying and eliminating redundancies. By curating data before AI processes, organizations have achieved impressive accuracy improvements—as demonstrated by a financial services firm that increased their AI output accuracy by 135%.

Making Data AI-Ready on Azure

Azure provides a powerful execution platform for AI and Komprise enhances this by bringing structure to unstructured data through its data classification, metadata extraction capabilities and with search, curation and intelligent ingestion via its data workflow and governance capabilities. These ensure only high-quality, relevant and compliant data feeds AI workflows.

This approach enables smoother integration with AI services and applications such as Microsoft Foundry and Copilot, while preserving flexibility. By treating data readiness as a foundational step, organizations can accelerate time to value from AI while reducing risk.

Security, Governance, and Responsible AI

As cyber threats and regulatory requirements continue to intensify, security and governance are no longer optional. Organizations must manage data flows carefully, maintain auditability, and protect sensitive information—especially when using data for AI.

Azure’s built-in security capabilities, including immutability, versioning, and backup, provide a strong foundation for protecting unstructured data. Komprise complements these capabilities by automating data governance policies, enforcing compliance, and helping organizations maintain visibility and control across hybrid environments. Together, they enable organizations to use data safely and responsibly, supporting both regulatory compliance and responsible AI practices.

Conclusion

As AI adoption accelerates, success increasingly depends on data readiness rather than algorithms alone. Clean, well-governed, and properly placed data is the foundation for meaningful AI outcomes.

By combining Azure’s scalable and secure cloud platform with Komprise’s intelligent data management, organizations can reduce costs, strengthen security, and unlock real value from unstructured data at scale.

To learn more, watch the Microsoft–Komprise fireside chat, where we discuss customer examples, architectural best practices, and proven approaches for managing unstructured data across hybrid environments. We also invite you to explore our joint Azure and Komprise solutions to see how you can move from data sprawl to AI value while maintaining control, security, and flexibility.

In a recent fireside chat now available on YouTube, Azure Storage VP Aung Oo joined Komprise COO Krishna Subramanian to explore how Azure and Komprise are empowering customers to mobilize, curate, and optimize unstructured data to make it AI-ready.

To leverage the Storage Migration Program with Komprise to migrate your data to Azure find more information at Microsoft Marketplace. To take advantage of the full Komprise suite including automated tiering and smart workflows – additional details are available here.

Enterprise Identity Meets Secure File Transfer: Entra ID Public Preview on Azure Blob Storage SFTP

JeevanManoj — Fri, 13 Mar 2026 10:37:25 GMT

We are excited to announce the public preview of Entra ID-based access for Azure Blob Storage SFTP. This new capability enables you to use Microsoft Entra ID (formerly Azure Active Directory) identities (including guest users via Entra External Identities) to securely connect to Azure Blob Storage via SFTP without needing local users. This feature eliminates the operational overhead of managing local SFTP users and passwords by introducing enterprise-grade identity management powered by Microsoft Entra ID.

For IT administrators and security teams, this means no more creating, tracking, rotating, or decommissioning local SFTP credentials. For developers and architects, it means seamless integration with your existing identity infrastructure. For business users, it means faster, more secure access to the data they need, all while maintaining compliance with enterprise security policies.

Azure Blob Storage SFTP

Azure Blob Storage SFTP natively enables secure file access and management without third-party solutions. This simplifies operations for customers and removes the need for complex, custom SFTP solutions. Until this Public Preview, Azure Blob Storage SFTP utilized a form of identity management called local users as the only authorization mechanism. Local users must use either a password or a Secure Shell (SSH) private key credential for authentication. Learn more about local users here.

The Challenge: SFTP Local User Management

Organizations currently face challenges when managing SFTP access at scale with Azure Storage SFTP Local Users. Local User based SFTP access require IT teams to:

Manually create and provision local user accounts for each SFTP user
Generate, distribute, and securely store SSH keys or passwords
Implement custom workflows for lifecycle management
Manage offboarding processes to ensure departed users lose access immediately
Audit and track access across disconnected identity silos
Handle external partner and vendor access through ad-hoc, often insecure methods

The Solution: Enterprise Identity Meets Secure File Transfer

With Entra ID-based access for Azure Blob Storage SFTP, you can now leverage your organization's centralized identity platform to authenticate and authorize SFTP users. This integration brings the full power of Microsoft Entra ID to your file transfer workflows, delivering the following benefits:

1. Eliminate Local User Management

Simplify SFTP management by assigning access with Entra ID—no separate SFTP accounts needed.

No local credential generation or distribution—users authenticate with their existing corporate credentials
No orphaned accounts when users change roles or leave the organization
Reduced attack surface by eliminating static, long-lived local credentials
Centralized user lifecycle management through your existing identity platform

2. Enterprise-Grade Identity and Security

Leverage the full security capabilities of Microsoft Entra ID for your SFTP infrastructure:

Multi-Factor Authentication (MFA): Require additional verification factors beyond passwords, significantly reducing the risk of account compromise
Conditional Access: Define policies that grant or block access based on user location, device compliance, sign-in risk, and other conditions
Identity Protection: Benefit from Microsoft threat intelligence and risk detection to identify and respond to compromised accounts
Privileged Identity Management (PIM): Provide just-in-time elevated access for administrative operations

3. Native Azure RBAC, ABAC, and ACL Integration

Your SFTP access control seamlessly integrates with Azure comprehensive authorization framework:

Role-Based Access Control (RBAC): Assign built-in or custom roles at the storage account, container, or even blob level
Attribute-Based Access Control (ABAC): Create sophisticated access policies based on resource tags, user attributes, and environmental conditions
Access Control Lists (ACLs): Apply fine-grained permissions at the directory and file level for hierarchical namespace-enabled accounts
Unified Permission Model: SFTP access respects the same permissions as REST API, Azure CLI, and other access methods—no separate permission system to manage

4. Faster SFTP Onboarding and Time-to-Value

Onboard new SFTP users or partners in minutes instead of hours or days, saving significant time and boosting business agility.

5. Secure External Collaboration with Entra External Identities

Seamlessly enable secure external SFTP access by allowing partners to authenticate with their own credentials using Entra External Identities (Azure AD B2B).

External users authenticate with credentials they already manage
Full audit trail of external user activity
Ability to apply Conditional Access policies to external users
Automatic access revocation when B2B relationships end

Real World Scenarios

Financial Services: A bank receives daily transaction files from merchants via SFTP. Merchants authenticate with their own Entra ID credentials (B2B collaboration), MFA is enforced, and access is restricted to assigned directories. Access is instantly revoked when a merchant is removed from the B2B directory.
Healthcare: A hospital exchanges patient data with insurers and labs. Entra ID authentication ensures only authorized staff access sensitive PII, with full audit logs for HIPAA compliance. Conditional Access restricts connections to approved locations and devices.
Media & Entertainment: A production company enables freelance editors and agencies to transfer large media files. Entra External Identities provide time-limited access and automatic revocation when projects end—no need for local SFTP accounts.
Manufacturing: A manufacturer receives CAD files and orders from suppliers using SFTP. With Entra ID, suppliers use unified credentials and access policies across all systems, streamlining supply chain management.

How It Works

Entra ID simplifies SFTP access to Azure Blob Storage by authenticating users with their corporate credentials. After authentication, users receive a short-lived Open SSH certificate to connect. The service verifies certificate validity and user permissions, enabling secure file operations and automatic access revocation in line with current identity policies. Learn more here.

Getting started with the Public Preview

We encourage you to try Entra ID-based access for Azure Blob Storage SFTP in your non-production environments today. Learn more about how to register for the preview and get started with the detailed ms docs learn guide here. This preview gives you an opportunity to shape the feature development by providing feedback on what works well and what could be improved.

Note: Local user accounts for SFTP access are still supported, but we strongly recommend switching to Entra ID-based access for greater security, simpler management, and automatic access control.

Questions or feedback? We would love to hear from you! Reach out to our team at blobsftp@microsoft.com

We are excited to bring enterprise-grade identity management to Azure Blob Storage SFTP, and we cannot wait to see how you use this capability to simplify operations, enhance security, and enable new collaboration scenarios.

Happy transferring!

Understanding the Standard HDD I/O unit size update and what it means for your workloads

austin-ma — Wed, 22 Apr 2026 15:18:03 GMT

As Azure continues to evolve to support modern workload patterns, we are refining how transactions are measured for Standard HDD Managed Disks. This update helps align billing more closely with actual I/O behavior while maintaining predictable cost controls for customers.

In this post, we’ll walk through what’s changing, how transaction billing is calculated, and what this may mean for your workloads.

With this update, the number of billable transactions for select Standard HDD disk sizes (S4, S6) will be measured using 16 KiB I/O units.

I/O operations ≤ 16 KiB count as one billable transaction
I/O operations > 16 KiB are counted as multiple billable transactions

Example

A 64 KiB read/write on an S4 disk = 4 billable transactions
A 4 KiB read/write on an S4 disk = 1 billable transaction

This update provides more consistent alignment between workload behavior and transaction billing. For latest information on regional availability, please refer to the Standard HDD Managed Disks documentation.

Built-in transaction caps to help manage costs

To maintain predictable cost boundaries, Azure will implement hourly caps on billable transactions for the Standard HDD disk sizes with an I/O unit size.

If a disk exceeds its hourly cap, additional transactions in that hour are not billed. The transaction caps are listed below and on the Azure Disks Pricing Page.

Disk Size	Disk GiB	Hourly Billable Transaction Cap
S4	32 GiB	450,000
S6	64 GiB	858,000

These caps help provide cost predictability, particularly for bursty workloads.

Understanding potential cost impact

Workloads with larger I/O sizes and sustained IOPS may see changes in the number of billed transactions on their invoice. Workloads with small or infrequent I/O operations may see little to no impact.

Determining your workload’s cost

The following table lists three different examples to illustrate how transaction billing* compares for different IO load intensities on an S4 Standard HDD disk vs. an E4 Standard SSD disk. Assume the disks are in Central US region.

Workload Average

Billable Transactions / hour on Standard HDD

Billable Transactions / hour on Standard SSD

Total Cost on Standard HDD

Total Cost on Standard SSD

Low

4 KiB workload, 10 IOPS

36,000

(10 billable transactions * 60 seconds * 60 minutes)

36,000

(10 billable transactions * 60 seconds * 60 minutes)

$2.85/mo

(36,000 * 730 hours * $0.0005 / 10,000 transactions) = $1.31 Transaction cost

$1.31 + $1.54 capacity/mo cost = $2.85/mo

$7.66/mo

(36,000 * 730 hours * $0.002 / 10,000 transactions) = $5.26 Transaction cost

$5.26 + $2.40 capacity/mo cost = $7.66/mo

Medium

32 KiB workload, 20 IOPS

144,000

(40 billable transactions with the IO Unit Size * 60 * 60)

43,400

(after Standard SSD transaction cap)

$6.80/mo

$8.73/mo

High

64 KiB workload, 40 IOPS

450,000

(after Standard HDD transaction cap)

43,400

(after Standard SSD transaction cap)

$17.97/mo

$8.73/mo

*Any operation against the storage is counted as a transaction, including reads, writes, and deletes. Host caching being enabled might affect the number of transactions against the storage that are counted.

Choosing the right disk for your workload

Running workloads on SSD-based disk types may also unlock higher availability, higher reliability, more consistent performance, and lower latency.

For OS disks running on Standard HDD, consider migrating to Standard SSD or Premium SSD Managed Disks. Standard HDD OS disks will be retired in September 2028.
For non-OS disk workloads, consider high performance and flexible provisioning benefits of Premium SSD v2 Managed Disks, or benefits of Standard SSD or Premium SSD Managed Disks. Learn more here about the different disk types and their benefits.
To learn more about switching your disk types, view our documentation page.

To learn more about the billing changes, view the Pricing Page and documentation for Standard HDD Managed Disks.

Public Preview: Restrict usage of user delegation SAS to an Entra ID identity

ellievail — Tue, 03 Mar 2026 22:43:07 GMT

Shared access signatures (SAS) grant time-bound, scoped access to Azure Storage resources without sharing account keys. Over time, Azure Storage has continued to strengthen SAS security, moving from account keys to user delegation (UD) SAS secured by Microsoft Entra ID.

Today, we’re taking the next step forward by announcing public preview for user-bound user delegation SAS, an extension of UD SAS that ensures a SAS token can only be used by a specific Entra ID identity. This new capability helps customers significantly reduce the risk of unintended access while preserving the flexibility of SAS.

UD SAS is an existing feature which utilizes Entra ID and Azure role-based access control (RBAC). Users retrieve a user delegation key tied to their Entra ID account and then use it to create SAS tokens granting a subset of their own access rights. The resulting token can be traced to the delegator and can only be valid for up to 7 days. User-bound UD SAS is an extension of user delegation (UD) SAS which allows users to create a more secure SAS token by restricting the usage of the SAS token to an end user identity. The delegator specifies the Entra identity (security principal) of the end user in the SAS token and the end user needs to authenticate to Entra ID to use the token. The end user can either be in the same tenant or a different tenant as the delegator.

Pricing and availability

There is no additional cost for user-bound user delegation SAS. Pricing is based on the standard read/write transaction costs for your storage account type. To learn more, please see Azure Storage Pricing.

User-bound user delegation SAS is in preview in all public regions. This preview will be available via REST APIs, SDKs, PowerShell, and CLI experiences.

Getting started

Getting started is simple:

User-bound user delegation SAS is available on all GPv2 storage accounts in public regions.

If the end user of the SAS token is in a different tenant, the allowCrossTenantDelegationSas setting must be enabled on the storage account. If you are not planning on using this feature cross-tenant, the account setting can remain disabled.

Perform the following steps in the create a user delegation SAS documentation to generate and use a user-bound UD SAS token:

Ensure you have the correct RBAC roles assigned to the delegator to create a user delegation key. These roles will include the Storage <Service> Data Contributor and Storage <Service> Delegator (replace Service with the respective service you are using). Here are all of the applicable roles for each service:

Azure Blob	Azure Table	Azure Files	Azure Queue
Storage Blob Data Contributor	Storage Table Data Contributor	Storage Files Data Contributor	Storage Queue Data Contributor
Storage Blob Delegator	Storage Table Delegator	Storage Files Delegator	Storage Queue Delegator

Get a user delegation key (instructions here)
Get the OAuth object ID and tenant ID from your end user. They will have to get these IDs (instructions here) and provide them to you.
Create the user-bound user delegation SAS token (instructions here. Note that the steps are the same as for a normal UD SAS token; you will just have to specify the end user and tenant if applicable).
Share the SAS token to the application/user intended to access Azure Storage.
Tokens should be passed within applications automatically or shared via key vault for best practice.

Feedback

If you have questions or feedback, please fill out this feedback form. If you need help, create a support request.

Azure Migrate: Now Supporting Premium SSD V2, Ultra and ZRS Disks as Targets

Lakshya_Jalan — Wed, 18 Feb 2026 17:22:53 GMT

We are excited to announce that we have added assessment and migration support for Premium SSD v2,Ultra Disk and ZRS Disks as storage options in Azure Migrate, with Premium SSD v2 and ZRS Disks now Generally Available and Ultra Disk in Public Preview. This further enhances the assessment and migration experience Azure Migrate offers and allows you to bring your mission critical workloads to these key Azure Storage offerings seamlessly.

What’s New

Additional Assessment targets: Premium SSD v2 and Ultra Disks

As part of the migration journey to the cloud, Azure Migrate makes recommendations on what cloud resources to move your workloads to. Post successful discovery of on-prem workloads, Azure Migrate utilizes multiple parameters like size, IOPS, and throughput to make target recommendations in Azure. Instead of just static sizing, assessments can map actual performance demand to Azure VM and disk SKUs, optimizing performance, resiliency, and total cost of ownership to give you a tailored recommendation that fits your cloud migration journey.

With today’s announcement, we are adding more supported disks to Azure Migrate, providing you with improved guidance to ensure that you land on the resources in Azure that align with your goals.

If you are looking to migrate your demanding on-premises applications and workloads to Azure, you will benefit from these advanced disk options, which come with greater flexibility and enhanced performance. For example, Premium SSD v2 disks decouple capacity from performance, allowing you to dial IOPS and throughput precisely to your workload’s needs. For high-end scenarios, Ultra Disks offer the highest performance among Azure managed disks, while ZRS disks provide zonally redundant storage to further protect your data. With these included in Azure Migrate’s assessment engine, you end up with a right‑sized, data‑driven target configuration that aligns Azure storage choices with how workloads actually run.

Below is a snippet of how the assessment recommendations appear in Azure Migrate for Premium V2 SSD disks. Customers can get details on the disk type, provisioned IOPS, throughput, cost, and seamlessly migrate using the assessment to the recommended target.

Detailed view of Azure Managed disk recommendations for source on-prem disks in an assessment.

Migrating to Premium SSD v2 and Ultra Disks in Azure Migrate

When Premium SSD v2 or Ultra disks are identified as the optimal targets based on workload characteristics during the assessment phase, they can be auto-populated seamlessly into the migration process. This workflow accelerates the lift-and-shift of on-prem disks to Azure’s high performance managed disks. Below is a snippet from the replication step during migration:

Assessing and Migrating to ZRS Disks in Azure Migrate

Azure Migrate also has enhanced resiliency by supporting migration to ZRS Disks during Migration. Zone-Redundant Storage (ZRS) for Azure Disks synchronously replicates data across three physically separate availability zones within a region - each with independent power, cooling, and networking - enhancing Disk availability and resiliency.

While creating Assessments in Azure Migrate, you can configure a range of target preferences, including the newly introduced option to enable zone-redundant storage (ZRS). You can opt-in to enable ZRS Disk recommendations by editing the Server (Machine) default settings in the Advanced settings blade.

Since the preview announcement for these capabilities, recommendations for Ultra, Premium v2 and ZRS Disks have led to petabytes of data being successfully migrated into Azure. Below is a quote from our Premium v2 (Pv2) customer that was provided during the preview:

"Through this preview, we have Pv2 disks recommendations in place of Pv1, which is beneficial for our estate during migration in terms of both cost and performance. We are now awaiting General Availability "

– Yogesh Patil, Cloud Enterprise Architect, Tata Consultancy Services (TCS)

With these added capabilities, Azure Migrate and Azure disk storage are more ready than ever for migrating your most demanding and mission-critical workloads. Learn more about Azure Migrate and for expert migration help, please try Azure Accelerate. You can also contact your preferred partner or Microsoft field for next steps. Get started in Azure today!

Azure File Sync: Azure Arc Integration, Additional Regions, and Secure Syncing

grace_kim — Fri, 16 Jan 2026 18:02:58 GMT

As organizations accelerate their cloud journeys, the ability to modernize file data without disrupting daily operations is critical for enterprises. Azure Files and Azure File Sync empower IT and devops teams to seamlessly bridge on-premises Windows File Servers with the flexibility and scale of the cloud. With the latest updates, Azure File Sync is now available in four new regions—bringing data closer to users for regional residency. This release also introduces a modern, identity-driven approach to authentication, providing end to end secure access with managed identities. Azure File Sync now provides simplified onboarding via Azure Arc integrating with the Azure hybrid management experience. With simplified onboarding, secure access and expanding list of regions, Azure File Sync enables organizations to seamlessly expand their hybrid file services, ensuring predictable cost, and scale.

Simplified deployment with Azure Arc extension

Customers using Azure Arc managed servers can now easily deploy Azure File Sync using the Azure Arc extensions. With Azure Arc, customers can simply add the File Sync agent to their servers using a few clicks on portal, or by using an automated workflow with PowerShell, or CLI. The Azure Arc extension model provides a trusted and predictable installation and upgrade experience, with built-in security. Once installed, the Arc extension simplifies Azure File Sync deployments for ARC managed servers.

Beginning January 2026, File Sync will be available at no per‑server cost for customers using Windows Server Software Assurance with Azure Arc and File Sync agent v22 or later. As your environment grows, this reduces the incremental cost of adding servers and reinforces Azure File Sync as a scalable foundation to move your data to Azure.

Azure File Sync available in 4 new regions

Azure File Sync is now generally available in Italy North, New Zealand North, Poland Central, and Spain Central, adding top requested new geographies to the service. With these additions, customers have even more flexibility to keep data close to users, align with regional mandates and regulatory requirements, and improve performance for regional workloads. This matters especially for customers modernizing branch offices, factories, retail locations, or government sites, where the ability to select a region that is physically close to the workload can be a key part of the storage strategy. As Azure continues to grow, File Sync is growing with it, ensuring that customers can bring hybrid file services wherever their business expands.

Secure by default with Managed Identities

Managed Identities support for Azure File Sync was introduced with v20, to ensure secure end-to-end access by default between the File Sync Server, Storage Sync Service and Azure Files, using Microsoft Entra ID. This reduces security risk of using passwords and operational effort to rotate keys. This means that customers don’t need to configure storage account keys or worry about resetting server certificates when using Azure Files or Azure File Sync. We have now further extended this support to Managed Identities for Azure Files SMB.

Get Started

Whether you are provisioning new storage, expanding to new regions, or modernizing existing deployments, these capabilities provide secure, enterprise-grade access with a streamlined configuration experience.

Refer to the documentation below to get started:

For any questions, please reach out to the team at azurefiles@microsoft.com

User delegation SAS for Azure Tables, Azure Files, and Azure Queues is now Generally Available

ellievail — Wed, 01 Apr 2026 20:27:47 GMT

We’re excited to announce that user delegation (UD) SAS is now generally available for Azure Tables, Azure Files, and Azure Queues in all regions.

User delegation SAS is already available for Azure Blobs, and we are now extending support to Azure Tables, Azure Files, and Azure Queues. This will allow users to create a more secure SAS token than account or service SAS by tying the SAS token to the creator’s identity.

UD SAS extends Entra ID and Azure role-based access control (RBAC) for Azure Storage, meaning lower-privileged users and services can now delegate subsets of their access to clients, using a pre-authorized URL. Clients retrieve a user delegation key tied to their Entra ID account and then use it to create SAS tokens granting a subset of their own access rights.

This extension of User Delegation Key based SAS enables delegated access at multiple granularities—including table, table entity, queue, queue message, file share, and individual file.

Pricing and availability

There is no additional cost for user delegation SAS. Pricing is based on the standard read/write transaction costs for your storage account type. To learn more, please see Azure Storage Pricing.

UD SAS for Azure Tables, Azure Files, and Azure Queues is generally available in all regions. This capability is available via REST APIs, SDKs, PowerShell, and CLI experiences. Note: this feature is only available in SDKs, PowerShell, and CLI for Azure Files and Azure Queues, but available in all three services for REST APIs.

Getting Started

Getting started is simple:

All general-purpose v2 storage accounts are eligible to use UD SAS. There is no account setting that must be enabled to use this feature.

Perform the following steps in the create a user delegation SAS documentation to generate and use a UD SAS token:

Ensure you have the correct RBAC roles assigned to create a user delegation key. These roles will include the Storage <Service> Data Contributor and Storage <Service> Delegator (replace Service with the respective service you are using)

Get a user delegation key (instructions here)

Create the user delegation SAS token (instructions here. Note the steps are similar for each service, but permissions vary slightly from service to service)

Share the SAS token to the application/user intended to access storage data

Tokens should be passed within applications automatically or shared via key vault for best practice

Feedback

If you have questions or feedback, please fill out this feedback form. If you need help, create a support request.

Secure, Seamless Access using Managed Identities with Azure Files SMB

Priyanka-Gangal — Mon, 15 Dec 2025 17:46:43 GMT

As organizations evolve their application and storage environments, whether on‑premises, hybrid, or cloud, secure access is top of mind. Organizations are vigilant about protecting sensitive data while enabling agile application access across distributed environments. SMB shares are commonly used for persistent storage in applications like AKS for container workloads, web applications, and App Services. Traditional models that rely on credentials like storage account keys do not meet the demands of a Zero Trust architecture, where every access request must be verified explicitly, granted with least privilege, and designed to assume malicious access from bad actors.

We are excited to announce the Public Preview of Managed Identities support with Azure Files SMB. This capability provides a secure, identity-driven approach for customer applications that eliminates credentials-based access and integrates seamlessly with MS Entra ID. Azure virtual machines, containers, and applications running in Azure can now authenticate to Azure Files using their own managed identity, and mount shares using short lived OAuth tokens over Kerberos. This unlocks secure file share access for both first party and customer applications, including Azure Kubernetes Service (AKS), Azure Functions, App Services, and other cloud native services

By leveraging Managed Identities, customers gain:

Zero Trust Alignment–Identity tied to a specific resource, token refreshes every hour, and no passwords or keys to manage or rotate with Azure handling end-to-end identity management
Role Based Access Control – Built-in RBAC for least-privilege enforcement
Compliance Mandate Resolution – Compliant with FIPS, removing need for NTLMv2
Multi-Client Support – Works with Windows and Linux clients over SMB

This capability brings a secure, simple, and scalable access model that helps organizations meet industry standard security requirements while inheriting Microsoft Entra ID’s enterprise grade identity, governance, and security capabilities for file shares.

Securing Real World Applications

To illustrate how Managed Identities strengthen security, the following example workloads highlight where customers will benefit from this capability.

Eliminate Secret Sprawl for Continuous Integration, Continuous Deployment (CI/CD) workloads

Azure Files SMB provides a centralized location for storing software development artifacts generated during CI/CD pipelines. CI/CD workloads span far beyond application code, covering infrastructure updates, data engineering workflows, ML pipelines, and compliance automation, making them foundational to modern DevOps practices.

Build agents in Azure DevOps or other CI/CD systems often run on both Linux and Windows, requiring a common storage backend for binaries and configuration files. Historically, these agents authenticated to Azure Files using storage account keys. With Managed Identities, build agents can now authenticate using their own identity from Microsoft Entra ID, with authorization governed through Azure RBAC. This enhances security, removes static credentials, and simplifies compliance.

“Managed Identities support with SMB shares will enable us to remove dependencies on storage account keys to run our CI/CD pipelines, enabling stronger security and alignment with Zero-Trust principles." Alex Garcia, Staff Dev Ops Engineer, Unity Technologies.

Secure Persistent Files Storage with Azure Kubernetes Service (AKS)

Stateful AKS workloads rely on persistent volumes for configuration, logs, and application data. Previously, mounting Azure Files required storing account keys or secrets in Kubernetes. Organizations requested exceptions from their security organizations to continue using shared keys until a secure managed identities-based solution was available. With this feature, AKS clusters can authenticate directly to Azure Files SMB without storage account keys.

This enables secure, token‑based access for persistent volume mounts, improving security posture and eliminating the need for exceptions to use access tied to storage account keys. Learn more in the Azure Files AKS CSI documentation.

Get Started with Managed Identities with SMB Azure Files

Whether provisioning new storage or enhancing existing deployments, this capability provides secure, enterprise‑grade access with a streamlined configuration experience.

Secure your workloads today!

For any questions, reach out to the team at azurefiles@microsoft.com

Transforming Data migration using Azure Copilot

madhurinrao — Thu, 11 Dec 2025 18:57:02 GMT

Introduction

Data migration is critical, yet it is one of the most complex tasks in any cloud adoption journey. Whether you’re moving workloads from on-premises environments, consolidating hybrid deployments, or transitioning from other cloud providers, the migration process involves multiple tools, intricate planning, and risk management.

What’s New in Azure Copilot

With the new “Storage Migration Solutions Advisor” capability in Azure Copilot, Microsoft is transforming this experience into a conversational, AI-driven workflow that accelerates decision-making and reduces operational friction.

Why This Matters

Traditionally, customers faced challenges such as:

Weeks of advisory time spent choosing the right migration tool amongst the many (Azure Storage Mover, AzCopy, Data Box, File Sync etc., and various Partner solutions).
High support overhead due to missteps during migration if a sub-optimal tool or service is used.

The Storage Migration Solutions Advisor feature introduces:

Conversational Guidance: Share your migration needs with Copilot, like talking with an Azure advisor.
Scenario-Based Recommendations: Tailored suggestions based on transfer data size, protocol, and bandwidth.
Expanded Coverage: Supports on-premises to Azure, cloud-to-cloud (AWS/GCP to Azure), and hybrid scenarios.
Native and Partner solutions: Copilot can recommend Microsoft-native (1P) solutions and third-party (3P) tools for specialized scenarios —ensuring flexibility for enterprise needs.

User Workflow: Step-by-Step

Initiate Migration: Start with a prompt like “How can I migrate my data into Azure?” or “What’s the best tool for moving 1 PB from AWS S3 to Azure Blob?”
Provide Details: Copilot will guide you by asking for details about your requirement, such as source type (e.g., NAS, SAN, AWS S3, GCS), protocol (e.g., NFS, SMB, S3 API), target (e.g., Azure Blob, Files, Elastic SAN), data size, and bandwidth.
Azure and Partner Solutions: Based on your requirements, Copilot recommends the best-fit Azure solution. If a partner solution is better suited to your requirement, Copilot will also select and recommend the appropriate solution with links to its documentation and/or its Azure marketplace page.

Examples

Copilot generates recommendations for migrating an on-premises file share to Azure Files.

Figure 1 Prompt from user invokes Copilot Migration recommendation workflow

Figure 2 Copilot understanding protocols that customer environment has access to

Figure 3 Copilot asking user's target Storage type

Figure 4 Copilot gathering inputs on data size, network bandwidth availability and transfer direction

Figure 5 Copilot recommendation for user scenario

Copilot recommends Partner solutions for specialized migration scenarios

Figure 1 Prompt from user invokes Copilot Migration recommendation workflow

Figure 2 Copilot understanding protocols that customer environment has access to

Figure 3 Copilot asking user's target Storage type

Figure 4 Copilot gathering inputs on data size, network bandwidth availability and transfer direction

Figure 5 Copilot recommendation for user scenario

Pro Tips

Run a small proof-of-concept migration to estimate throughput and timing, especially for large datasets or small file sizes.
Combine Copilot’s recommendations with Azure Storage Discovery for visibility into your storage estate after migration.

Getting Started

Navigate to Azure Portal → Copilot.
Try prompts like:

o “Help me migrate an NFS share to Azure Files.”

o “What’s the best tool for moving 1 PB from AWS S3 to Azure Blob?”

Explore Manage and migrate storage accounts using Azure Copilot | Microsoft Learn for detailed guidance.

Ready to simplify your migration journey? Start using Azure Copilot’s Storage Migration Solutions Advisor today and experience AI-driven efficiency for your cloud transformation.

Pure Storage Cloud, Azure Native evolves at Microsoft Ignite!

Aung_Oo — Wed, 19 Nov 2025 17:45:00 GMT

The Azure Storage team has heavily invested in our partner ecosystem to meet all customer data storage needs and make it easier to migrate any application workload to Azure. You will find our complete list in the validated partner catalog (link below) and find partner solutions conveniently located in Storage Center on the Azure Portal.

Azure Native Pure Storage Cloud is the latest example of our deep investment in partners. Pure Storage has been recognized as a leader in Enterprise Storage Systems by Gartner for 12 consecutive years thanks to their commitment to robust features, performance, resilience, and customer support. We quickly reached General Availability of the service in September and are now announcing additional Azure Service integration – provisioning volumes to Azure Virtual Machines.

Pure Storage Cloud brings the Purity OS features and value to Azure with the Portal, CLI, and Azure Resource Manager experience that simplifies deployment and ongoing management. Pure Storage Cloud is built on a solid foundation of the latest generation of Azure Virtual Machines utilizing Azure Boost accelerated networking and Azure Premium Managed Disks v2. You can learn more about Azure Native Integrations on this blog, read more about the technical details or Pure Storage Cloud here and find a series of step-by-step demos here.

“We are thrilled to make this giant leap in our partnership with Microsoft — building off of the incredible cost savings and enterprise capabilities Pure Storage has delivered to customers in Azure,” said Dan Kogan, vice president enterprise business management, Pure Storage. "This jointly developed solution extends the benefits of the Pure Storage Cloud with industry leading data reduction, advanced data management capabilities and resilience into a fully managed service with a truly Azure native experience, offering a simpler and more secure enterprise-grade storage experience for Microsoft customers.”

Figure 1 - Azure Portal Integration

Our work with Pure initially offered a tightly integrated experience with Azure VMware Solution, and today we are announcing the first expansion of Pure Storage Cloud into other Azure Services with support for volumes provisioned to Azure VMs! Pure Storage Cloud now provides a tremendous value proposition for Linux or Windows-based applications on Azure with their efficiency, protection and cloning, and performance-at-scale capabilities.

The benefits for Azure VMs will mirror those that AVS customers have come to rely on, like a US-based financial services firm with over 300 VMware VMs who moved their VMware environment to Azure discovered. Their workloads are primarily SQL, business applications, and virtual desktops. They found Pure Storage to be extremely cost effective (20 to 40% lower than the out-of-the-box AVS deployment) while providing the enterprise class Storage features they relied on on-premises.

Figure 2 - Simplified Provisioning and Management

Customer Story

Over the past seven years, Pure Storage has partnered with Microsoft to bring industry-leading storage and data management services to the public cloud and make cloud migrations easier. Together, we’ve helped organizations like Perdoceo Education build a modern, flexible, and cost-effective storage solution in Azure—reducing database restores from eight hours to just five minutes, achieving 12:1 data reduction, and lowering total cost of ownership by 40%. We’ve enabled a major manufacturer to cut cloud storage costs by 50% and redirect those savings into AI and innovation. And we’ve supported a financial services organization in migrating VMware to the cloud—improving both ROI and security along the way.

Summary

Azure Native Pure Storage Cloud is ready to support your virtual machine storage needs and we encourage you to review the assets below and give the service a try. It is available as a 30-day free trial and offers a cost-effective and performant solution as an external storage solution for AVS and now for Azure Virtual Machines as well!

Learn more:

Pure Storage Cloud Documentation

Pure Storage Cloud in the Azure Marketplace

Azure Storage Validated Partners

Azure Storage Blog articles

File share migrations simplified with Azure Copilot Migration Agent

Overview

Customer Value

Design principles

Getting Started with Storage Migration in Azure Copilot Migration Agent (ACMA)

Examples scenarios and prompts

Call to action

Learn More

Simpler, scalable file share management in Azure - now generally available

Independent performance, security, and billing per share

Start easy, scale big

Data protection with snapshots

Get started today

Learn more

Secure, Modern Access to Azure Files on macOS with MS Entra ID

Key benefits

Partnership with Apple

Powering Diverse Workloads across Design, Developer and Education Enterprises

Secure SMB access for creative workloads

SMB shares streamline developer and AI-generated build workflows

Enable collaboration across mixed platform environments

Modernize Infrastructure and secure access for Educational Institutions

Get started with Azure Files Entra Kerberos authentication for macOS

From Scale to Breakthrough: Azure NetApp Files Sets a New Cloud Benchmark for EDA Performance

Table of Contents

Introduction

New benchmark proof with large volume breakthrough mode

What is Azure NetApp Files large volume breakthrough mode?

Explore the latest Azure NetApp Files SPECstorage® 2020 publications

Results that Speak for Themselves

Single large volume breakthrough mode

Large volume breakthrough mode at scale

Performance that Scales with Your Design Cycles

From large volume scale… to breakthrough mode scale

What Storage Performance Means For EDA Velocity

Learn more

Action required: Kerberos RC4 hardening may affect Azure Files Active Directory Domain Services

Background

You may be impacted if:

When will this happen:

What you should do now:

Resources:

Modernizing Azure Virtual Desktop with Nerdio and Azure Files

Nerdio: simplifying how AVD is deployed and operated

Azure Files: enabling performance and identity at scale

Provisioned v2: performance without over-provisioning

Entra ID authentication: simplifying identity architecture

Operationalizing storage at scale, why this matters for enterprises

Get started

AHEAD helps us launch the Strategic Azure Storage Services Partner Program

AHEAD background

Valued collaboration

What can you expect?

Assessment

Migration

Azure Storage ISV Strength

How can you move forward?

Strategic Azure Storage Services Partner

Prefix-scoped access for User Delegation SAS is now generally available for Azure Blob Storage

Pricing and Availability

How to generate a prefix-scoped SAS

.NET SDK Sample Definition

REST API Sample Request

Next Steps

Help and Support

Secure, Keyless Application Access with Managed Identities - Now GA in Azure Files SMB

What’s New In GA

AKS Workload Identity Support

Co-existence of Application Identities and end-user identity access

Simplified Storage Account enablement via the Azure portal

Get Started with Managed Identities with SMB Azure Files

Simplify On-prem File share Migration to Azure: Discover & assess suitability using Azure Migrate

UPDATE as of 20th May 2026: We are happy to announce that this capability is now GA worldwide.

Why does this matter

What’s available in public preview

End-to-end experience

1. Discover on‑premises file servers and file shares

2. Build a business case

3. Create and review an Azure Files assessment