Hello, Cloud Gurus,
and welcome back for this lesson,
where we're going to take an introductory look
at Azure Files.
Let's take a look at what we're going to cover.
First up, we'll take a high-level look
at the Azure Storage Services
so you can see where Azure Files fits
into the bigger Azure Storage picture.
And then we'll dive deeper into Azure Files specifically,
starting with deploying Azure Files,
and then we'll also take a look
at how you can access Azure Files.
And then we'll wrap up with a demo of deploying Azure Files.
And this lesson will really serve
as the foundation for the upcoming lessons in this section.
Let's get started.
When you deploy an Azure Storage account,
you can access a range of Azure Storage services
to use in that Azure Storage account.
Let's take a look at these Azure Storage services
at a high level.
The first to be aware of is Azure Blobs
and it's used to store unstructured binary and text data
and it includes locking mechanisms for that data.
And the locking mechanisms are provided
so you can use Azure Blobs
to store Azure virtual machine disks.
And Blob storage is used typically for unmanaged VM disks,
backups, logs, and media content.
And if you've never heard the term unstructured data before,
it basically means
that the data does not have a defined format,
so it can't be easily queried using industry standard tools.
For example, both a Word document
and a PowerShell script could be a file stored
in Blob storage.
But each of these files has a very different structure,
and you couldn't query each
of these files using the same application.
Another Azure Storage service
to be aware of is Azure Tables,
and Azure Tables provide schemaless, non-relational storage
for structured data.
And schemaless means that there is a defined storage format
for example, like JavaScript Object Notation or JSON.
But what you put in that JSON file is not guaranteed.
For example, you could have 2-person JSON documents:
one that might define a person's height
and the other one that does not.
And non-relational means that there is no tight relationship
between the tables in Azure Storage.
They might reference each other
and you could query and join them together,
but there's no defined relationships
on how the tables are joined
like there is with a traditional relational database.
Another Azure Storage service
to be aware of is Azure Queues.
And it provides temporary storage
for messages sent between distributed applications
so they can communicate asynchronously.
And this is typically used when you have a large application
with many different components
and these components will all serve a single purpose.
For example, you might have a shopping cart component
and the shipping component will be a separate application.
The shopping cart will process the payment
and then drop a message in the queue
for the shipping application to pick up and process.
And the final Azure Storage service to be aware of,
and the one that we'll focus our attention on
in this section, is Azure Files.
And it provides hybrid file storage for unstructured data.
And again, the data is unstructured.
So you can store almost any type of file,
and that means you can use it
like a traditional Windows file share
and even access the data using SMB,
but without all the hassle of buying, deploying,
and managing a file server.
Azure Files, and specifically the hybrid component
of Azure files, is the Focus for the AZ-800 exam.
And it's where we'll focus our efforts on
in the remainder of this section.
But it's good to have a very high-level understanding
of the other Azure Storage services available.
And there are a few important decisions to make
when you deploy your storage account
and these will affect the availability
and performance of your Azure Files file share.
Let's first take a look at the redundancy options.
The first is locally redundant storage.
With locally redundant storage, you get 3 copies
of your data in a single facility, in a single region.
You also have the option of using zone redundant storage
with your storage account.
With zone redundant storage, you get 3 copies
of your data in a single region
but the copies are each stored
in a separate availability zone.
Or you can use geo-redundant storage,
with geo-redundant storage,
you get 3 copies of your data
within a single availability zone
and 3 copies of your data
in a single zone in a separate paired region.
And the final option
is to use geographically zone redundant storage or GZRS.
With GZRS, you get 3 copies of your data
within a single region,
spread across 3 availability zones,
and then 3 copies in a single availability zone
in a separate region.
And you can optionally enable read-only access
in the second region for both GRS and GZRS.
Another important consideration
to make when you deploy your storage account
is the performance requirements.
There are 2 performance tiers available
for use with Azure Files.
The performance is measured
based on how many transaction you perform
against your storage account,
and a transaction is any read or write operation.
For example, this might be listing a file, opening the file,
or saving the file.
And the performance tiers are standard,
which is recommended for most scenarios,
or if you want to perform more than 35 to 40 transactions
per second, per terabyte of storage,
you should consider premium file shares.
For example, you might have this requirement
if you have a large number
of small files that are accessed frequently.
Because the number of transactions
is calculated per terabyte of data.
But what's important to know about this
both for you in your role as a hybrid administrator
and for the exam,
is that you can't use geographic replication,
so GRS and GZRS, with premium storage.
So just keep that in mind.
When you deploy Azure Files,
you first deploy your storage account,
and then you create one or more file shares
for that storage account.
Let's take a look at your authentication options
for connecting directly to that storage account.
Your first and potentially the worst option
to use is the storage account access key.
It provides full access to the storage account
and it's a best practice
to avoid using storage account keys wherever possible.
Another option is to use a shared access signature,
which provides restricted access over HTTP to Azure Files.
And these restrictions include things like start
and end times and the allowed IP addresses.
And the final option, which should be very familiar
to us, is to use identity based authentication over SMB,
which is very similar to a Windows file share.
In fact, to use this option,
you need to join your storage account
to an Active Directory Domain Services domain,
but access using just Azure AD is coming.
To provide access over SMB,
you're going to need to configure share-level permissions.
And this is just like a Windows file server,
but what's different about this is that these permissions
are assigned using Azure role-based access control.
And there are 3 roles to be aware of
when you're configuring share-level permissions
for your Azure file share.
The first role to be aware of
is the Storage File Data SMB Share Reader,
which grants share-level permissions to read data.
The second role to be aware of
is the Storage File Data SMB Share Contributor role,
which grants share-level read-write access
to the Azure file share.
And this is the most common Azure role that you'll assign
to your users to access the file share.
And the last role to be aware of,
and one that you'll probably assign yourself
when you're setting up the file share,
is the Storage File Data SMB Share Elevated Contributor,
which grants full control share-level permissions
including permissions to modify the NTFS permissions
on the file share.
And that last role is important,
because just like a Windows file server,
we need to set both share level and file-level permissions.
And the Elevated Contributor role can be used to do this.
And we'll take a look at this in the demos in this section.
All right, let's put all this together now
and take a look at a demo of deploying Azure Files.
In this demo, we'll deploy a storage account
and then we'll create a file share on that storage account.
Then we'll explore identity-based access by granting
the Storage File Data SMB Share Elevated Contributor role,
and you don't need to know how to perform a domain join
for your storage account for the AZ-800 exam.
So we will access the storage account
using the storage account key.
But just remember that this is not recommended
in your production environments.
Let's take a look at the demo.
All right, so here I am in the Azure portal.
Let's go ahead and create a storage account.
So I'll go ahead and hit Create
and then we'll select Create under Storage Account,
and we'll just change the resource group
to the resource group that we want to use
for our storage account.
We'll set the region to Australia East
and then we just need to provide a storage account name.
I'm going to paste in the storage account name
that I'm going to use.
Now, let's quickly take a look at the redundancy options.
So you can see that you can create
a locally redundant storage account,
zone redundant storage account,
or one of the geo-redundant storage accounts.
And when you select a geo-redundant storage account
either GRS or GZRS,
you can make the data read-only in the second region.
And if we switch the performance tier
from standard to premium,
and then change the account type to file shares,
we can see that we lose access
to the geo-redundant storage options.
We're going to go ahead
and create a standard storage account
and we'll make it locally redundant
just for our lab environment.
Now, there are a range
of other options that you can configure
for your storage account,
but for our purposes, we can skip over those.
So I'm going to go ahead and select Review and Create,
then I'll run final validation,
and then I'll go ahead and hit Create.
This will just take a moment to deploy,
so we'll come back when this is done.
All right, that deployment is now complete.
We'll go ahead and go to the resource.
Now, let's go ahead and create a file share.
So under Data Storage, we'll navigate to file shares
and we'll click the Add File Share button.
And we just need to provide a name for our file share.
I'm going to use the name data
and then we can go ahead and hit Create.
All right, now let's configure access for the file share.
We'll navigate to access control, IAM,
and then we'll navigate to Role Assignments,
and we'll click Add
and we'll select Add Role Assignment.
Now, let's take a look at those storage file data SMB roles.
So I'll just search for Storage File Data SMB,
and you can see you can grant access using
the Contributor, Elevated Contributor, or Reader roles.
But we're going to access the share
using the storage account key.
So we don't need to configure this access,
but if you had a domain-joined storage account,
then you would need to grant access using these roles.
We'll navigate back to our storage account,
navigate into File Shares,
and then navigate into our file share.
And then we'll hit Connect.
We'll use the storage account key.
We'll go ahead and copy the PowerShell required to connect.
We'll jump over to our virtual machine,
and we'll just right-click
to paste in our PowerShell script.
And then we'll press Enter to run it.
You can see that it's going to map Z-drive
to our file share.
It's gone ahead and done that successfully.
Let's navigate to our file share.
So we'll open up File Explorer,
then we can see we have our new file share available
as a network location.
All right, that concludes this demo.
And we'll continue to use this storage account
for the upcoming lessons in this section.
Now, let's wrap up
with a bit of a summary
of what we've covered in this lesson.
So what have we covered?
Azure Files is a service provided
by Azure Storage account that provides access
to files using SMB or Server Message Block,
which is a familiar service
for any Windows file server admin.
And Azure Storage accounts can be configured
with one of four redundancy options
including locally redundant storage or LRS,
zone redundant storage or ZRS,
geo-redundant storage or GRS,
and geo-zone-redundant storage or GZRS.
And you can optionally configure read-only access
for the geographically replicated data.
And you can use either standard
or the premium performance tier,
but the premium performance tier
does not support geographic replication.
And you can grant access using either storage account keys,
shared access signatures, or identities using SMB.
And when you're using SMB,
you'll need to configure both share-level
and data-level NTFS permissions.
And Microsoft will sometimes call these
data level permissions, Windows ACLs.
And share level permissions are configured
using Azure role-based access control.
All right, that concludes this lesson.
Thanks for being with me,
and I hope you found it useful.
And I look forward to seeing you in the next lesson.