How to migrate a NAS to Azure Files

Export the share list with each share's path and share-level permissions from the NAS console. Then measure size and file count per share from the admin PC and record both in your Mailbox and data inventory (one row per share).

Get-ChildItem -Path \\nas01\finance -Recurse -File -Force -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum | Select-Object Count,@{n="GB";e={[math]::Round($_.Sum/1GB,1)}}

Show the ACL on each share root and its first-level folders. Look for entries that are not domain accounts (NAS-local users, unresolved SIDs, Everyone with Full control). Fix them on the NAS by replacing them with domain groups before the copy.

icacls \\nas01\finance
icacls \\nas01\finance\*

List drive maps, login scripts, applications and scheduled tasks that use each UNC path, and any DFS namespace that already points at the NAS. Record the old path and the owner in your Application inventory and dependency map.

Decide one Azure file share per NAS share where you can, which storage account each goes in (busy shares on their own account), the region close to users, and whether each share is cloud-only or synced with Azure File Sync.

Choose the subscription, resource group, a globally unique name and the region from Step 1. Pick the performance and redundancy your owners agreed, and check the vendor's current pricing for that choice. Complete any networking (private endpoint, firewall rules) now, because Microsoft says to configure networking before enabling AD DS authentication.

az storage account create --name stcontosofiles --resource-group rg-files --location <region> --kind StorageV2 --sku Standard_ZRS --enable-large-file-share

Create one share per row of your mapping table, using lower-case names. Set the quota to the share's size plus growth.

az storage share-rm create --resource-group rg-files --storage-account stcontosofiles --name finance --quota 2048

Check TCP 445 to the storage account. If it fails, fix the firewall or plan VPN, ExpressRoute or Azure File Sync before going further.

Test-NetConnection -ComputerName stcontosofiles.file.core.windows.net -Port 445

Download and unzip AzFilesHybrid, run CopyToPSPath.ps1 from its folder, then run the commands below. Join-AzStorageAccount performs the equivalent of an offline domain join and creates a computer account (default) or service logon account for the storage account.

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser
.\CopyToPSPath.ps1
Import-Module -Name AzFilesHybrid
Connect-AzAccount
Select-AzSubscription -SubscriptionId "<subscription-id>"
Join-AzStorageAccount -ResourceGroupName "rg-files" -StorageAccountName "stcontosofiles" -SamAccountName "stcontosofiles" -DomainAccountType "ComputerAccount" -OrganizationalUnitDistinguishedName "OU=AzureFiles,DC=contoso,DC=com"
Debug-AzStorageAccountAuth -StorageAccountName "stcontosofiles" -ResourceGroupName "rg-files" -Verbose

Check the password policy on the OU. Microsoft says you must update the password of the storage account identity in AD DS before the maximum password age, or access to the shares fails. Put the rotation in the operations runbook.

Select the status next to Identity-based access (for example Not configured). Under Microsoft Entra Kerberos select Set up, tick Microsoft Entra Kerberos, optionally enter the domain name and domain GUID (needed only to set permissions from File Explorer) and select Save.

Open the app named [Storage Account] stcontosofiles.file.core.windows.net, select API permissions > Grant admin consent for your directory and confirm. Do not edit this service principal otherwise. Then deploy a Settings catalog policy that sets Kerberos > Cloud Kerberos Ticket Retrieval Enabled to enabled on the clients; it applies after a policy refresh or reboot.

For a default for everyone, under Step 2: Set share-level permissions select Enable permissions for all authenticated users and groups, choose Storage File Data SMB Share Contributor and select Save. For granular control, assign roles to synced groups on each share instead. Give migration and IT admins Storage File Data SMB Share Elevated Contributor so they can change ACLs.

az role assignment create --role "Storage File Data SMB Share Contributor" --assignee-object-id <group-object-id> --assignee-principal-type Group --scope "/subscriptions/<subscription-id>/resourceGroups/rg-files/providers/Microsoft.Storage/storageAccounts/stcontosofiles/fileServices/default/fileshares/finance"

Microsoft recommends mounting with identity-based access and an admin-level RBAC role. If you must use the storage account key (Storage account > Security + networking > Access keys), use the second form, and keep the key out of scripts and tickets.

net use Z: \\stcontosofiles.file.core.windows.net\finance
net use Z: \\stcontosofiles.file.core.windows.net\finance /user:localhost\stcontosofiles <storage-account-key>

Match the root permissions of the NAS share. Remove the default Authenticated Users Modify entry if the NAS root did not grant it, and grant the share's domain groups. Inheritance then carries these down as files arrive.

icacls Z:\
icacls Z:\ /remove "NT AUTHORITY\Authenticated Users"
icacls Z:\ /grant "CONTOSO\Finance-Modify:(OI)(CI)(M)" "CONTOSO\Finance-Read:(OI)(CI)(RX)"

Create a Storage Mover resource. Deploy the agent VM on a host close to the NAS from the image linked in Microsoft's agent deployment article, and register it with the Storage Mover resource (Microsoft prefers SSH for the registration). Allow outbound 443 to the endpoints the agent's connectivity checker lists.

Store the NAS username and password as two secrets in an Azure Key Vault. Select Create source endpoint, choose SMB, enter Host name or IP and Share name, select the Key vault and the Select secret for username and Select secret for password secrets, then Create. Then select Create target endpoint, pick the Subscription, Storage account, a file share Target type and the File share, and select Create.

Create a project per group of shares, then a job definition. On the Source and Target tabs choose the endpoints, and on the Settings tab review the copy mode and migration outcome carefully before you save. Start the job. Rerun it for each delta pass.

Run Microsoft's recommended command. /B needs an elevated window; /COPY:DATSO and /DCOPY:DAT keep data, attributes, timestamps, NTFS ACLs and owner; /MIR mirrors and deletes target items not on the source. Microsoft found 8 to 20 threads gives balanced performance for the first run. Auditing information (U) cannot be stored in Azure Files.

robocopy \\nas01\finance Z:\ /MT:20 /R:2 /W:1 /B /MIR /IT /COPY:DATSO /DCOPY:DAT /NP /NFL /NDL /XD "System Volume Information" /UNILOG:C:\migration\finance-pass1.log

Run the same command nightly with a new log name. Each pass copies only changes. Record the duration of each pass in your runsheet; the last one sets your outage length.

robocopy \\nas01\finance Z:\ /MT:20 /R:2 /W:1 /B /MIR /IT /COPY:DATSO /DCOPY:DAT /NP /NFL /NDL /XD "System Volume Information" /UNILOG:C:\migration\finance-pass2.log

Create one Storage Sync Service in the same region as the storage accounts. Install the agent on the Windows Server and register the server. In the Storage Sync Service create a sync group per share (the share becomes the cloud endpoint), then Add server endpoint with the local folder. If the server has less disk than the NAS data, turn on cloud tiering and set volume free space to 99% during the migration.

Azure File Sync cannot sync from a NAS directly, so Robocopy the NAS share into the server endpoint folder with the same switches, then run delta passes. If Robocopy stops with Volume full, wait for cloud tiering to free space and rerun.

robocopy \\nas01\finance D:\Shares\Finance /MT:20 /R:2 /W:1 /B /MIR /IT /COPY:DATSO /DCOPY:DAT /NP /NFL /NDL /XD "System Volume Information" /UNILOG:C:\migration\finance-afs-pass1.log

To keep the NAS name (\\nas01\finance), use a stand-alone namespace with root consolidation. Otherwise use a domain-based namespace (\\contoso.com\files\finance) and update drive maps once. A stand-alone namespace keeps its metadata in the server registry and cannot have a second namespace server, so Microsoft recommends a failover cluster for high availability.

Under File and Storage Services > File and iSCSI Services, select DFS Namespaces and complete the wizard. Do not use a domain controller for a root consolidated namespace.

Set the registry value Microsoft documents and restart the DFS service. The service reads it only at start-up. The namespace is then named after the old server with a # prefix, for example #nas01.

New-Item -Path "HKLM:SYSTEM\CurrentControlSet\Services\Dfs\Parameters\Replicated" -Force
Set-ItemProperty -Path "HKLM:SYSTEM\CurrentControlSet\Services\Dfs\Parameters\Replicated" -Name "ServerConsolidationRetry" -Value 1
Restart-Service -Name "Dfs"

Create the namespace (#nas01 for root consolidation, or your chosen name). For each share select New Folder, use exactly the old share name, select Add and enter \\stcontosofiles.file.core.windows.net\finance. If the console warns the path cannot be contacted, Microsoft says this is expected; select Yes. For a pre-cutover test, add the folders now but do not take over the old name yet.

Ask pilot users from each team to open, edit and save files, check they cannot reach folders they should not, and open a file from a line-of-business app. Fix permission or sign-in issues before the cutover date.

At the start of the outage, set the NAS shares to read-only (or change the root ACLs) so no new changes land on the source. Microsoft gives pointing the DFS namespace at a non-existent location or changing root ACLs as examples.

Run one last delta pass and check its log or run history for failures. Its duration is your downtime.

Take the NAS off the network or rename it first. Remove its service principal names, add the old name as an alternate computer name of the namespace server with netdom (Microsoft says not to hand-build SPNs with setspn instead), then create a CNAME for the old name pointing at the namespace server's FQDN. If you are not keeping the old name, update drive maps in Group Policy to the new path instead.

setspn -L nas01
setspn -D HOST/nas01 nas01
netdom computername dfsn01.contoso.com /add:nas01.contoso.com

Enable Azure Backup for each share in a Recovery Services vault and run a first backup. For Azure File Sync, change the cloud tiering volume free space back from 99% to your long-term value on every server endpoint on the volume.