Azure Recordsdata, Reimagined: High-Degree Shares with Per-Share Networking, Billing, and Scale

Hey Of us!

When you have ever wrestled with Azure Recordsdata inside a storage account, juggling shared RBAC, shared networking, and shared IOPS throughout a pile of shares that actually mustn’t reside collectively, this session goes to handle all that. Throughout Microsoft Azure Infra Summit 2026, Vincent Du and Will Gries (each Product Managers on the Azure Recordsdata staff) walked us by the brand new Microsoft.FileShares useful resource supplier, a administration mannequin that promotes the file share itself to a top-level Azure useful resource.

📺 Watch the session:

For years, file shares lived inside a storage account, and that storage account dictated lots of choices for you. If one staff wanted a personal endpoint and one other wanted a service endpoint, you both compromised otherwise you created one other storage account. If one share received sizzling and consumed all of the IOPS, the opposite shares felt it too. Vincent and Will are on the staff that constructed the brand new mannequin to take away that compromise.

Here’s what modifications for you as an IT professional:

• Every file share is its personal Azure useful resource with its personal RBAC, networking, billing, IOPS, and throughput.
• Per-share price exhibits up straight in Azure Price Administration’s per-resource view, no extra Excel guesswork.
• Encryption in transit is on by default for NFS shares, at no further price.
• Provisioning is dramatically sooner. Of their head-to-head demo, 200 shares completed in about 50 seconds on the brand new mannequin versus about 720 seconds with the traditional stream.
• A brand new MCP server helps you to create and handle shares from GitHub Copilot in VS Code with pure language.

In brief, the brand new mannequin trades the storage-account-as-gatekeeper sample for one thing that feels much more like the remainder of Azure (assume VMs and disks, the place the useful resource you care about is the useful resource you truly handle).

The brand new Microsoft.FileShares useful resource supplier helps you to deploy a file share with out first standing up a storage account. Once you go into the Azure portal, seek for “File share,” and click on create, you fill out a single create blade with the issues that truly matter for that share: title, area, redundancy (LRS or ZRS), provisioned capability, IOPS and throughput, networking, and tags. Microsoft Be taught confirms the provisioned capability vary is 32 GiB to 262,144 GiB, and solely LRS and ZRS redundancy can be found at launch (see the Create a file share doc linked under).

At GA, the brand new expertise helps NFS 4.1 on the SSD media tier. SMB help, HDD help, customer-managed key encryption at relaxation, smooth delete, and the AKS CSI driver integration are all on the roadmap and known as out because the most-requested follow-ups. When you want these options at present, the traditional file share inside a storage account continues to be there for you.

Within the portal, Vincent confirmed off a small however significant element: the icon shade modified from blue (traditional) to purple (new). It’s a small factor, however if you find yourself scanning a useful resource group, that visible cue saves you a click on.

The brand new mannequin is constructed on the provisioned v2 billing construction. Microsoft Be taught describes provisioned v2 as a billing mannequin the place you independently provision storage, IOPS, and throughput, and also you pay for what you provision no matter how a lot you truly use. It is a actual shift from the older provisioned v1 mannequin, the place IOPS and throughput had been a perform of how a lot storage you provisioned.

Will walked by the mathematics. In his instance, provisioning 14 TiB of storage on v1 gave 17,000 IOPS, about 1.5 GB/s throughput, and a invoice of roughly $2,297. Transferring to v2 with the very same numbers was already noticeably cheaper. Then, as a result of v2 helps you to tune storage, IOPS, and throughput individually, he provisioned the precise storage he wanted with barely much less IOPS and throughput, dropping the invoice to roughly a 3rd. For database-hot workloads you possibly can dial IOPS up; for warm archive situations you possibly can dial them all the way down to the minimal. That form of flexibility is genuinely helpful.

Encryption in transit deserves its personal callout. The brand new shares default to encrypted NFS mounts utilizing the AZNFS mount helper. Microsoft Be taught explains that AZNFS wraps the NFS connection in a Stunnel-based TLS tunnel utilizing AES-GCM, so that you get TLS safety with no need Kerberos or exterior authentication. The helper installs cleanly on Ubuntu, RHEL, SUSE, Rocky, Oracle Linux, Alma Linux, and Azure Linux. If a workload genuinely can’t use the encrypted mount, you possibly can uncheck the field and fall again to a conventional NFS mount.

Networking is per share. You may connect a service endpoint or a personal endpoint to every particular person share, which implies you possibly can put a strict private-endpoint-only share subsequent to a service-endpoint share for dev/take a look at, all in the identical useful resource group, with out compromise.

On the request facet, traditional shares throttle with a set window (you possibly can burst, then you’re locked out for the remainder of the window). The brand new mannequin makes use of a token-bucket algorithm (the identical one Azure Useful resource Supervisor itself makes use of), which implies you get a sustained refill price. The staff additionally gave you a separate delete bucket, so a giant cleanup operation doesn’t starve writes. That element issues greater than it sounds: batch cleanups in opposition to the traditional mannequin usually crowd out new share creation.

The place does this truly repay? A number of trustworthy situations:

• Mission-critical and controlled workloads. A healthcare org with workloads at completely different sensitivity ranges can put strict private-endpoint-only shares subsequent to much less delicate service-endpoint shares with out the storage-account ceiling.
• Chargeback and showback. With per-share assets, finance can pull a value report that strains as much as the staff or mission that owns every share. No extra saying “we can’t itemize, the storage account is shared.”
• Excessive-density tenants. The traditional mannequin successfully caps you at 34 file shares on an SSD provisioned v2 storage account (due to IOPS minimums) and 50 absolute. The brand new mannequin goes as much as 10,000 shares per subscription per area. That may be a completely different recreation.
• Tuned database and analytics shares. Provisioned v2 helps you to right-size IOPS to the workload. As Will confirmed, that may drop the invoice to roughly a 3rd for the best form of workload.
• Sooner deployment automation. A 14x enchancment on a 200-share deployment is just not a micro-optimization. When you spin up environments for CI, coaching, or per-customer tenants, that provides up shortly.

The trustworthy tradeoff: at present, the brand new mannequin is NFS-only on SSD. When you want SMB, HDD, customer-managed keys for NFS, or AKS CSI driver help, keep on the traditional mannequin for now. The staff was upfront about that, and the GA-and-then-iterate roadmap is obvious.

Right here is the concrete path:

1. Register the Microsoft.FileShares and Microsoft.Storage useful resource suppliers in your subscription (Subscriptions, Useful resource suppliers, Register).
2. From the Azure portal, seek for “File share” within the market and click on Create. Decide LRS or ZRS, set the capability between 32 GiB and 262 TiB, and both settle for the really useful IOPS/throughput or set them manually.
3. On the Superior tab, depart “Require encryption in transit” enabled (it’s on by default) and decide a customized mount title if you’d like one distinct from the useful resource title.
4. On the Networking tab, connect a service endpoint or a personal endpoint, per share.
5. Mount it in your Linux VM with the AZNFS mount helper. The portal generates the precise command to your distribution.
6. When you reside in IaC land, the Microsoft.FileShares ARM and Bicep varieties can be found, and Terraform help is coming.
7. When you reside in AI-assisted dev land, set up the Azure MCP server and ask Copilot in VS Code to create a share for you, pointing at an present VNet.

Catch the complete Microsoft Azure Infra Summit 2026 session playlist right here.

Cheers!

Pierre Roman