Share via

File Share Migration from IaaS VMs to Azure Files (PaaS) Without Changing Client Paths

Plinio Pereira 0 Reputation points
2026-02-23T23:48:48.3766667+00:00

I'm currently working on a project to migrate file shares from VMs in Azure to Azure Files

Today, our environment has multiple file shares hosted directly on 10 Azure VMs. These shares are heavily used by:

  • End users (mapped network drives and UNC paths)

Applications

Excel spreadsheets and other integrated systems

Services running under domain accounts

There is no DFS-N (Distributed File System Namespace) implemented in the current environment. All file servers are domain-joined and clients access the shares directly using UNC paths such as:

\\server-name\share-name

Our main concern is avoiding the need to update UNC paths across all users, applications, scripts, spreadsheets, and services after the migration. Given the scale of consumption, manually updating paths would be highly complex and risky.

Is it possible to preserve existing UNC paths without requiring client-side changes?

Is DNS aliasing, CNAME records, or other supported mechanisms can be used safely in this scenario?

Is there any official Microsoft documentation that covers this specific migration pattern (Windows File Server to Azure Files with minimal client impact).

I'm looking for a supported, best-practice approach that minimizes disruption and avoids the need to update application and user configurations.

Azure Files
Azure Files

An Azure service that offers file shares in the cloud.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marcin Policht 91,150 Reputation points MVP Volunteer Moderator
    2026-02-24T00:04:49.15+00:00

    AFAIK, the recommended approach to such migration would involve an abstraction layer, rather than implemented SMB aliasing combined with Active Directory–based authentication.

    Azure Files SMB endpoints use names like \\storageaccount.file.core.windows.net\share. When you domain-join Azure Files using AD DS or Entra ID Kerberos, authentication works against that service principal name. If you create a DNS CNAME such as server-name.domain.local pointing to storageaccount.file.core.windows.net, Kerberos authentication would fail unless the storage account is configured to support that alternate SPN. To support arbitrary DNS aliasing you would need to configured the storage account for AD DS authentication and then register appropriate SPNs.

    My suggestion would be to introduce DFS-N before migration. You create a namespace such as \\domain.local\files\share-name and configure DFS folder targets that point to the existing file servers. Clients are then migrated to use the DFS path. After adoption, you migrate the data to Azure Files and update the DFS folder target to the Azure Files UNC path. Because clients access the DFS namespace rather than the physical server, no further client changes are required.

    If you absolutely need to preserve the exact existing UNC path \\server-name\share-name, then you'd need to reuse the server name as a DNS alias and configure Azure Files for Active Directory Domain Services authentication, then register the corresponding SPN on the storage account’s computer object in AD. This typically involves setting the storage account to use AD DS authentication and validating SPNs similar to:

    setspn -L <StorageAccountADObjectName>

    Microsoft documentation covers the migration model which includes Azure Files identity-based authentication with Active Directory Domain Services, planning for an Azure Files deployment, and file server migration guidance using Azure File Sync and DFS Namespaces. Azure File Sync is frequently used as a transition mechanism - you install the Azure File Sync agent on existing file servers, sync data to Azure Files, cut over gradually, then either keep a lightweight server as a cache layer or remove it entirely while redirecting access via DFS-N.

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.