Azure Recordsdata, Reimagined: Prime-Degree Shares with Per-Share Networking, Billing, and Scale

Good day People!

When you’ve got ever wrestled with Azure Recordsdata inside a storage account, juggling shared RBAC, shared networking, and shared IOPS throughout a pile of shares that actually mustn’t dwell collectively, this session goes to handle all that. Throughout Microsoft Azure Infra Summit 2026, Vincent Du and Will Gries (each Product Managers on the Azure Recordsdata staff) walked us via the brand new Microsoft.FileShares useful resource supplier, a administration mannequin that promotes the file share itself to a top-level Azure useful resource.

📺 Watch the session:

For years, file shares lived inside a storage account, and that storage account dictated a variety of selections for you. If one staff wanted a non-public endpoint and one other wanted a service endpoint, you both compromised otherwise you created one other storage account. If one share received scorching and consumed all of the IOPS, the opposite shares felt it too. Vincent and Will are on the staff that constructed the brand new mannequin to take away that compromise.

Here’s what adjustments for you as an IT professional:

• Every file share is its personal Azure useful resource with its personal RBAC, networking, billing, IOPS, and throughput.
• Per-share price exhibits up straight in Azure Value Administration’s per-resource view, no extra Excel guesswork.
• Encryption in transit is on by default for NFS shares, at no further price.
• Provisioning is dramatically sooner. Of their head-to-head demo, 200 shares completed in about 50 seconds on the brand new mannequin versus about 720 seconds with the basic movement.
• A brand new MCP server helps you to create and handle shares from GitHub Copilot in VS Code with pure language.

In brief, the brand new mannequin trades the storage-account-as-gatekeeper sample for one thing that feels much more like the remainder of Azure (assume VMs and disks, the place the useful resource you care about is the useful resource you truly handle).

The brand new Microsoft.FileShares useful resource supplier helps you to deploy a file share with out first standing up a storage account. If you go into the Azure portal, seek for “File share,” and click on create, you fill out a single create blade with the issues that really matter for that share: identify, area, redundancy (LRS or ZRS), provisioned capability, IOPS and throughput, networking, and tags. Microsoft Study confirms the provisioned capability vary is 32 GiB to 262,144 GiB, and solely LRS and ZRS redundancy can be found at launch (see the Create a file share doc linked under).

At GA, the brand new expertise helps NFS 4.1 on the SSD media tier. SMB assist, HDD assist, customer-managed key encryption at relaxation, gentle delete, and the AKS CSI driver integration are all on the roadmap and referred to as out because the most-requested follow-ups. When you want these options as we speak, the basic file share inside a storage account continues to be there for you.

Within the portal, Vincent confirmed off a small however significant element: the icon shade modified from blue (basic) to purple (new). It’s a small factor, however when you find yourself scanning a useful resource group, that visible cue saves you a click on.

The brand new mannequin is constructed on the provisioned v2 billing construction. Microsoft Study describes provisioned v2 as a billing mannequin the place you independently provision storage, IOPS, and throughput, and also you pay for what you provision no matter how a lot you truly use. It is a actual shift from the older provisioned v1 mannequin, the place IOPS and throughput had been a operate of how a lot storage you provisioned.

Will walked via the maths. In his instance, provisioning 14 TiB of storage on v1 gave 17,000 IOPS, about 1.5 GB/s throughput, and a invoice of roughly $2,297. Shifting to v2 with the very same numbers was already noticeably cheaper. Then, as a result of v2 helps you to tune storage, IOPS, and throughput individually, he provisioned the precise storage he wanted with barely much less IOPS and throughput, dropping the invoice to roughly a 3rd. For database-hot workloads you may dial IOPS up; for warm archive eventualities you may dial them right down to the minimal. That type of flexibility is genuinely helpful.

Encryption in transit deserves its personal callout. The brand new shares default to encrypted NFS mounts utilizing the AZNFS mount helper. Microsoft Study explains that AZNFS wraps the NFS connection in a Stunnel-based TLS tunnel utilizing AES-GCM, so that you get TLS safety without having Kerberos or exterior authentication. The helper installs cleanly on Ubuntu, RHEL, SUSE, Rocky, Oracle Linux, Alma Linux, and Azure Linux. If a workload genuinely can not use the encrypted mount, you may uncheck the field and fall again to a standard NFS mount.

Networking is per share. You’ll be able to connect a service endpoint or a non-public endpoint to every particular person share, which suggests you may put a strict private-endpoint-only share subsequent to a service-endpoint share for dev/take a look at, all in the identical useful resource group, with out compromise.

On the request aspect, basic shares throttle with a hard and fast window (you may burst, then you’re locked out for the remainder of the window). The brand new mannequin makes use of a token-bucket algorithm (the identical one Azure Useful resource Supervisor itself makes use of), which suggests you get a sustained refill charge. The staff additionally gave you a separate delete bucket, so a giant cleanup operation doesn’t starve writes. That element issues greater than it sounds: batch cleanups towards the basic mannequin recurrently crowd out new share creation.

The place does this truly repay? Just a few trustworthy eventualities:

• Mission-critical and controlled workloads. A healthcare org with workloads at completely different sensitivity ranges can put strict private-endpoint-only shares subsequent to much less delicate service-endpoint shares with out the storage-account ceiling.
• Chargeback and showback. With per-share assets, finance can pull a value report that traces as much as the staff or challenge that owns every share. No extra saying “we can not itemize, the storage account is shared.”
• Excessive-density tenants. The basic mannequin successfully caps you at 34 file shares on an SSD provisioned v2 storage account (due to IOPS minimums) and 50 absolute. The brand new mannequin goes as much as 10,000 shares per subscription per area. That may be a completely different recreation.
• Tuned database and analytics shares. Provisioned v2 helps you to right-size IOPS to the workload. As Will confirmed, that may drop the invoice to roughly a 3rd for the precise form of workload.
• Quicker deployment automation. A 14x enchancment on a 200-share deployment just isn’t a micro-optimization. When you spin up environments for CI, coaching, or per-customer tenants, that provides up shortly.

The trustworthy tradeoff: as we speak, the brand new mannequin is NFS-only on SSD. When you want SMB, HDD, customer-managed keys for NFS, or AKS CSI driver assist, keep on the basic mannequin for now. The staff was upfront about that, and the GA-and-then-iterate roadmap is obvious.

Right here is the concrete path:

1. Register the Microsoft.FileShares and Microsoft.Storage useful resource suppliers in your subscription (Subscriptions, Useful resource suppliers, Register).
2. From the Azure portal, seek for “File share” within the market and click on Create. Choose LRS or ZRS, set the capability between 32 GiB and 262 TiB, and both settle for the really useful IOPS/throughput or set them manually.
3. On the Superior tab, go away “Require encryption in transit” enabled (it’s on by default) and choose a customized mount identify if you need one distinct from the useful resource identify.
4. On the Networking tab, connect a service endpoint or a non-public endpoint, per share.
5. Mount it in your Linux VM with the AZNFS mount helper. The portal generates the precise command in your distribution.
6. When you dwell in IaC land, the Microsoft.FileShares ARM and Bicep varieties can be found, and Terraform assist is coming.
7. When you dwell in AI-assisted dev land, set up the Azure MCP server and ask Copilot in VS Code to create a share for you, pointing at an present VNet.

Catch the complete Microsoft Azure Infra Summit 2026 session playlist right here.

Cheers!

Pierre Roman