Guide To Azure File Storage

All of us at some point, be it in our educational institutes or in professional world, have used the file share, i.e. the common storage space maintained by the IT team of an organization where users can create their folders, access common software installers, or keep project specific documents. Usually we mount this storage space as a network drive for easy and quick access.

This article describes the details of below topics,

Basics of Azure file storage
Creation of file storage service using Azure portal
Mounting file share as drive
Accessing file share using storage client libraries.
Setting SAS policies on content in file share using storage client libraries.

Basics of Azure file storage

Azure file storage is an offering of Microsoft. Azure is an equivalent to SMB file share. The legitimate question to be asked here is since I can anyways already have SMB file share implementation on premise, why would I go with Azure file storage? And here are your reasons:

You can quickly migrate legacy applications relying on file share.
Avoid costly re-writes.
Azure file storage becomes your central share which can be consumed by Virtual machines running in Azure, Cloud services, any on premise clients with SMB protocol.
Better control and more built in accessibility options available. E.g. System I/O APIs, REST API, Client libraries, PowerShell cmdlets.
Easy integration with Linux.
Better scalability and performance targets.
Simplified hosting for high availability workload data

Note that as of today, file storage doesn’t support active directory based authentication mechanism to validate access requests. Instead it uses access key based mechanism of storage account. If you need to have more control on stored content, then you should use shared access token as an alternative.

What is SMB

The file shares are typically driven by a protocol called as SMB. SMB protocol is Server Message Block, which is nothing but a mechanism to provide shared access to files, printers, and serial ports over the network.

Microsoft’s implementation of this protocol is called as Microsoft SMB. It was introduced with Windows vista operating system as SMB 2.0 and revisions of the same were made later in Windows 7 with subsequent major revisions of 2.1 and 3.0 as of today.

Concepts of Azure file storage

Let’s try to understand the concept of Azure file storage

Storage Account:

Basically it is a subset of Azure storage services and hence we will need an Azure storage account.

Share:

Shares can be considered as logical representations of the drives which you can map. It is a container of directories and you can create unlimited number of shares within a storage account and each share can store maximum of 5 TBs of data.

Directory:

These are nothing but the folders you can create within a file share. It is an optional entity in the hierarchy.

File:

You can store any number and any type of files in a file share. Each share has its quota limit and can be maxed up to 5 TBs. Maximum file size than can be stored is 1TB.

The hierarchy can be visualized as below,

As shown in the image above, storage account contains two file shares. i.e. Share 1 and Share 2. Each share has two directories and each directory is containing some files.
The Url of the file stored within a directory or in a share is formed in a following format
https://<storage account>.file.core.windows.net/<share>/<directory/directories>/<file>

Failover and Backup:

For any storage solutions, one of the key criteria is to make sure that data is not lost even in disaster. File share being an Azure storage offering, it does follow all disaster recovery and failover standards and mechanisms as a storage account however there is slight difference. What is it?

As of writing this article, the file share witness and RA-GRS (Read Access – Geo Redundant Storage) is not supported for file share.

About back up -- although there is no official way to back up the Azure file share there is always a workaround. You can automate the process of backup with the help of AzCopy and backup your file share content to blob storage or install back up agents like Cobian to set up your full and incremental back up procedures of file share mapped drive.
Creation of file storage service using Azure portal

Let’s go ahead and set up and Azure file share using Azure portal. It is a quite straightforward process and starts with creation of a storage account.

Let’s create a storage account with name demofsstorageaccountwithin a resource group which I created earlier. You can choose to create a new resource group if you don’t have one. Once you are done filling all required information, hit create button and it will submit the creation job to Azure.

As this is a demo storage account, I have set its type as locally redundant. To read more about what all types you can select and what their significances are, it is recommended that you should go through this link at least once.

create

Once the storage account gets created, browse to it and click on the Files section as selected in image below,

file

Click on the Add file share button at the top of the File service panel. It will open up another panel where you can give name to the file share and declare its quota.

Let’s give file share name as “sharedfiles” and quota limit as 1 GB, it immediately creates the share for you which looks like below,

Take a note of the highlighted buttons which are quite self-explanatory. We will take a detailed look at connect button later in this article.

Before we add some files, let’s add a directory in file share and which will act as folder for our files. Name it as “Shared Content”.

Click on the upload button and it opens up a panel with typical file upload control with multiple selection enabled. You can browse files that needs to go on file share and select start upload button in header of the panel. We can see that directory and files are being shown in the file share now.

share

Select any file and click on properties button in the header. You will be shown URL of the file which follows the same format as mentioned above in this article,

Note that there is ETAG associated with each file, meaning that the files will be cached depending on the change in contents of the file. The cached copy of the document will be sent down to the client every time it is requested.

Let’s try to update our Excel file by deleting it from share and uploading a new copy with same name. Observe the change in the ETAG,

etag

Mapping file share as network drive

As mentioned before, we can map the file share as network drive so that content on it becomes easily accessible and you can browse through different directories quickly.

It is quite a straightforward process and I am sure many of you might have done it already but even if you haven’t, here are simple steps to do it.

Before we go ahead and map it as local drive, there are certain things you need to be aware of,

The client device should support SMB 3.0 protocol (Windows 8 and above OS) and port 445 (TCP outbound) is open.
If your mapping drive on windows virtual machine is hosted on Azure in the same subscription and same region as your file share service then the traffic between Azure VM and file share will be free, else you would be charged for the traffic as external bandwidth.
For Windows 7 devices, though they support SMB 2.1, access from outside of Azure is restricted due to lack of channel encryption in SMB 2.1, however SMB 2.1 is supported if you are accessing the share within Azure.

Mapping can be done in multiple ways, one is using command prompt and other is using UI on windows devices.
Remember the Connect button mentioned above in this article? It shows simple instructions how you can map your file share as network drive using command prompt.

Open “My Computer” (Quickest way to launch it Windows key + “E”) and select the option from the top action links which says Map Network Drive.

Name the drive and enter path of the file share which we just created.

For us the share is \\demofsstorageaccount.file.core.windows.net\sharedfiles

Since Azure file share doesn’t support any other authentication mechanism than typical storage key as of now, select both checkboxes i.e re-connect on logon and connect using different credentials.

Once you are done, you will be asked for credentials. Make sure you enter your storage account credentials in the authentication dialog. You can get the primary or secondary storage key of your account in storage account Settings >Access keys.

map
finish

After successful authentication, you should be able to see the mapped drive in your explorer.

Accessing file share using storage client libraries

Before we start this, make sure that you are using 5.x + version of storage client assemblies. Also note that Azure emulator currently does not support File share so make sure that you are pointing to correct file share service on azure.
Let’s create a console application which will access and download the files in a file share which we have recently created. Create new console application project in visual studio and install “WindowsAzure.Storage -Version 6.2.0” nugget on it.

The sample code to access and download the file is as below

Note – The code below is just for the demo purpose and may not be the best performing code.
It connects to the file share and verifies if it exists and then proceeds, same is done for getting connected to directory and file to be downloaded. It downloads the file to the local file system.

Note that it reads the connection string of the storage account from the application configuration file so to run the code below as-is, you will need to add the key with same name to your app.config and set it’s value to connection string of your storage account (which can be easily found on azure portal by going in the Settings > Access Keys).

classProgram
{
staticvoid Main(string[] args)
{
try
{
CloudStorageAccountstorageAccount = CloudStorageAccount.Parse(ConfigurationManager.AppSettings["StorageAccountConnectionString"]);
CloudFileClientfileClient = storageAccount.CreateCloudFileClient();
CloudFileSharefileShare = fileClient.GetShareReference("sharedfiles");
if (fileShare.Exists())
{
CloudFileDirectoryrootDirectory = fileShare.GetRootDirectoryReference();
if (rootDirectory.Exists())
{
CloudFileDirectorycustomDirectory = rootDirectory.GetDirectoryReference("Shared Content");
if (customDirectory.Exists())
{
CloudFile file = customDirectory.GetFileReference("The Word.docx");
if (file.Exists())
{
Console.WriteLine("Downloading file..");
DownloadFileFromShare(file, @ "D:\Downloaded_The_Word.docx");
}
}
}
}
} catch (Exception ex)
{
Console.WriteLine("Error: " + ex.Message);
} finally
{
Console.WriteLine("Enter to exit..");
Console.ReadLine();
}
}
privatestaticasyncvoidDownloadFileFromShare(CloudFile file, stringsaveToPath)
{
awaitfile.DownloadToFileAsync(saveToPath, System.IO.FileMode.OpenOrCreate);
}
}

Setting SAS policies on content in file share

As mentioned in the article above, we can set up SAS policies using storage client libraries for better control over the content, let’s see how it can be done.

This article assumes that users have basic understanding of SAS and related policies and so will only focus on setting these policies on file share contents. If you do not know about SAS, you can read more information here.

The basic idea is, when you don’t trust your storage clients and still you want to provide access to resources in storage then you can achieve this by providing shared access signature token and letting clients access the resource for limited period. You can optionally define the access policy and generate a token from the policy which we will do in our example below. The benefit you get out of this is, you don’t have to share the primary or secondary key of your storage account to the end users which ultimately provides them the administrative access to your storage account.

In our sample code below what we will do is, we will define a SAS policy with read-only permissions on the file share which we created. We will try to perform the write operation on file share i.e. by creating a new file in file share, it is expected that the code should run with an error as we don’t have any write permissions yet.

If we run code below as-is then we should get error like this,

output

class Program
{
static void Main(string[] args)
{
try
{
CloudStorageAccountstorageAccount = CloudStorageAccount.Parse(ConfigurationManager.AppSettings["StorageAccountConnectionString"]);
CloudFileClientfileClient = storageAccount.CreateCloudFileClient();
CloudFileSharefileShare = fileClient.GetShareReference("sharedfiles");
if (fileShare.Exists())
{
string policyName = "DemoPolicy" + new Random().Next(50);
FileSharePermissionsfileSharePermissions = fileShare.GetPermissions();
// define policy
SharedAccessFilePolicysharedAccessFilePolicy = newSharedAccessFilePolicy()
{
SharedAccessExpiryTime = DateTime.UtcNow.AddHours(1),
Permissions = SharedAccessFilePermissions.Read
//Permissions = SharedAccessFilePermissions.Write
};
fileSharePermissions.SharedAccessPolicies.Add(policyName, sharedAccessFilePolicy);
// set permissions of file share
fileShare.SetPermissions(fileSharePermissions);
// generate SAS token based on policy and use to create a new file
CloudFileDirectoryrootDirectory = fileShare.GetRootDirectoryReference();
if (rootDirectory.Exists())
{
CloudFileDirectorycustomDirectory = rootDirectory.GetDirectoryReference("Shared Content");
if (customDirectory.Exists())
{
CloudFile file = customDirectory.GetFileReference("DemoFile.txt");
stringsasToken = file.GetSharedAccessSignature(null, policyName);
//generate URL of file with SAS token
UrifileSASUrl = newUri(file.StorageUri.PrimaryUri.ToString() + sasToken);
CloudFilenewFile = newCloudFile(fileSASUrl);
newFile.UploadText("Hello!");
}
}
}
} catch (Exception ex)
{
Console.WriteLine("Error: " + ex.Message);
} finally
{
Console.WriteLine("Enter to exit..");
Console.ReadLine();
}
}
}

Now we will simply change the permission of the policy and let users give permissions to write and run the code.

Note that the change in is only in a line i.e.

// define policy
SharedAccessFilePolicysharedAccessFilePolicy = newSharedAccessFilePolicy()
{
SharedAccessExpiryTime = DateTime.UtcNow.AddHours(1),
Permissions = SharedAccessFilePermissions.Read | SharedAccessFilePermissions.Write
};

Code runs successfully, let’s verify if the file got created in file share.

share

If you download the file and see the content, you should be able to see Hello! Which we wrote using our console application.

There are lots of other possibilities to configure and play around the file share using the client storage assemblies and PowerShell scripts.

Thanks for reading this and your views and comments will be appreciated.