Azure Files gives you managed file shares in the cloud that clients mount over SMB or NFS. This guide follows Microsoft’s portal walkthrough for classic file shares: first the storage account, then the share.
Before you start
- An Azure subscription.
- Only if you script it: the latest Azure PowerShell or Azure CLI. The portal needs neither.
Step 1: Create the storage account
- In the Azure portal, search for storage accounts, select it, then + Create.
- On Basics, pick the subscription, resource group and region.
- Name the account: 3–24 characters, lowercase letters and numbers only, globally unique. It becomes the SMB server name.
- Set Primary service to Azure Files (required for provisioned v2 billing).
- Choose Performance: Standard (HDD) or Premium (SSD).
- Choose File share billing: Provisioned v2 (Microsoft recommends it for new deployments), Provisioned v1 (SSD only) or Pay-as-you-go (HDD only).
- Choose Redundancy: LRS, ZRS, GRS or GZRS. SSD shares support only LRS and ZRS.
| Tab | What to check |
|---|---|
| Advanced | Optional encryption-in-transit requirements for SMB, and for NFS (NFS appears only with Premium). |
| Security | Secure transfer for REST, storage account key access, minimum TLS version. Untick secure transfer only if clients need unencrypted SMB such as SMB 2.1. |
| Data protection | Soft delete for file shares is on by default with 7 days retention. Adjustable. |
| Encryption | Microsoft-managed or customer-managed keys; optional infrastructure encryption. |
Networking and Tags are optional, and networking can be set later. Select Review + create, then Create.
Step 2: Create the file share
Open the storage account and go to Data storage > Classic file shares > + File share. The fields depend on the billing model you chose.
- Provisioned v2: enter the name, provisioned storage (GiB), and IOPS and throughput (recommended or manual), then the protocol.
- Provisioned v1 (SSD): enter the name, provisioned storage (IOPS and throughput are calculated), and the protocol.
- Pay-as-you-go (HDD, SMB only): enter the name and access tier. Microsoft suggests Transaction optimized during a migration, then moving to a lower tier if needed.
Share names allow lowercase letters, numbers and single hyphens, must start and end with a letter or number, and can’t contain consecutive hyphens. Protocol is chosen on the share, not the account: SMB (default) or NFS (creates an NFSv4.1 share).
Step 3: Decide on backup
Backup is enabled by default when you create a share in the portal. Keep the defaults, create a new Recovery Services vault (same region and subscription as the storage account), create a new policy, or untick Enable backup. NFS shares don’t support Azure Backup. Then select Review + create and Create.
Step 4: Configure networking
- SMB: not required but recommended. Configure at the storage account under Security + networking.
- NFS: required. Use a private endpoint or service endpoint. NFSv4.1 uses port 2049, so allow outbound 2049 from on-premises clients and make sure network security groups don’t block inbound 2049.
For an NFS private endpoint: open the share, select Review options under Network configuration, then Setup a private endpoint > + Private endpoint. Set the target sub-resource to File, pick the VM’s virtual network and subnet, keep dynamic IP allocation, integrate with a private DNS zone (Yes), then Create. For on-premises access, Microsoft lists Point-to-Site VPN, Site-to-Site VPN or ExpressRoute.
Good to know
- Blob-specific Advanced settings (hierarchical namespace, SFTP, blob tiers, versioning) don’t apply to Azure Files.
- Deleted shares stay recoverable for the soft-delete retention period.
- This page doesn’t cover deleting or resizing a share. Microsoft links a separate article for that.
