Migrate On-Premise Files Shares to Cloud File Storage
Looking to migrate Windows File Shares to cloud file storage? You’re not alone!
Businesses of all sizes have been searching for the right mix of technologies that will allow them to migrate their on-premise file shares to cloud file storage.
For small businesses and startups, services like Dropbox, Box, Egnyte and SharePoint are a good alternative.
For larger businesses, governments, higher education and compliance restricted firms, migrating away from private cloud file storage under their own control requires significant planning.
Larger companies are concerned about the loss of file ownership, data sovereignty, compliance, ongoing costs and navigating costly and complex migrations.
These businesses are considering migrating their file shares to cloud file storage so that they can outsource the management of servers and infrastructure while still desiring to maintain control of their company files and sidestepping the software vendor lock-in associated with EFSS.
Until now they could meet some of these requirements with costly Enterprise File Sync and Share (EFSS) systems on-premise however they were still stuck managing complex migrations, having new databases to manage and license and re-inventing long term backup and data retention plans.
These businesses have been searching for a simple alternative cloud file storage sharing option that provides the same benefits of traditional mapped drives, fast local speeds and secure file remote access.
The technologies to enable cloud-based file server file shares are now converging with all the components needed to make this dream a reality!
Contents
In this article, we will explore the components needed to provide full cloud-based file sharing services that can be accessed remotely.
Active Directory Domain Service
Currently, with Microsoft Azure, enterprises have a mix of alternatives for authentication including Azure AD, Azure AD Domain Services and Active Directory Virtual Machines.
Azure AD is the backbone of Azure Authentication and is used for not only Azure services but office online as well. Typically, companies use Azure AD sync to synchronize their local Active Directory with Azure AD to provide a single sign on experience.
Larger organizations may also federate with Azure AD using ADFS. Azure AD itself is currently incomplete as a standalone directory service and cannot provide the level of control and management that enterprises require.
This is why customers maintain their own Active Directory Servers and sync or federate them to Azure AD so they can take advantage of single sign on and other services such as Azure Multi Factor Authentication when using Azure AD as their SAML Identity Provider (IDP).
Azure AD Domain Services
Azure AD Domain Services (not to be confused with Azure AD) or as a hosted service in AWS, is an option to host active directory services in the cloud with some limitations. Azure AD Domain Services provide what is essentially an Organizational Unit (OU) hosted by Microsoft Azure with full redundancy built in.
Currently to migrate to Active Directory from on-premise machines to Active Directory, customers must use Azure AD as an intermediary – The customer’s Active Directory is synced to Azure AD, then from Azure AD it’s synced to Azure Active Directory.
There are some important differences between Azure AD Domain Services managed domains and self-managed Active Directory domains detailed here.
Active Directory Domain Services
Customers may also run and manage their own Active Directory servers in the cloud as a virtual machine.
This option requires managing and maintaining multiple domain controllers in separate regions connected by VPN links to ensure availability and redundancy. Customers must also manage backups and windows updates on these Virtual Machines which may reduce the value proposition for those firms looking to go all in with a cloud option.
These firms do still have the benefits of redundancy, outsourcing management of hardware infrastructure and retain ownership and management of their AD domains. Microsoft has detailed important considerations when deploying Active Directory Domain Controllers as virtual machines.
Microsoft Azure File Shares (AFS) are hosted SMB accessible file shares hosted by Azure. By utilizing Azure File Shares, companies are relieved of the responsibility of maintaining windows file server-based file shares. Azure Files offers fully managed file shares in the cloud that are accessible via the industry standard SMB protocol.
AFS has built in capabilities including integrated backup and the ability to sync AFS to multiple locations using Azure File Share sync. Azure File Shares also had a file share size limitation of 4 TB. This has been recently increased to now support up to 100 TiB capacity, 10K IOPS, and 300 MiB/s throughput!!
We have updated our our MyWorkDrive Azure Image in the marketplace to allow it to easily join an existing Windows Active Directory Server that will further simplify the process! View our complete Setup Article here on how to integrate Azure File Shares with MyWorkDrive.
Active Directory Authentication
Azure Files Active Directory integration using customers own Active Directory Domain’s managed by customers, is now available in preview in all regions. Read more about the benefits of Azure Files Active Directory Integration and follow this step by step guidance to get started. MyWorkDrive has fully tested and supports this method for accessing Azure File Shares.
Users can login to Azure File Shares using their existing username/passwords currently in Active Directory or using SAML/Single Sign-on since Azure File Shares added to customer managed Active Directory domains since AFS Active Directory integration fully supports Impersonation/Delegation.
Azure AD Domain Services Authentication
An additional option for authenticating against Azure File Shares is the ability to connect AFS to Azure Active Directory Domain Services (AAD-DS) for authentication.
Many smaller firms may already have Azure AD as part of their existing Office Online subscriptions. With AAD DS, Customers can simply enable AAD DS without managing any additional servers at a cost starting around $110/month.
Be aware; when using Azure AD Domain Services users can only login to Azure File Shares using username/password – AAD-DS does not support computer object based delegation required for Azure File Shares needed to support SAML/Single Sign-On. In addition, user’s password hashes must be synced or changed for them to be stored in AAD-DS for AFS authentication.
With Azure File Share Sync multiple locations can be sync’d from on-premise to AFS and remote locations. Using Azure File Share Sync is another alternative to connect AFS to customer’s own Active Directory since NTFS ACL’s are syncd in addition to files and folders. In addition, Azure Files supports preserving, inheriting, and enforcing Microsoft file system NTFS ACLs on all folders and files in a file share.
Azure NetApp Files Service
Azure NetApp Files (ANF) is a new option for storing enterprise SMB and NFS files in Azure via a bare-metal all-flash infrastructure, powered by NetApp. Just coming out of preview, ANF is scheduled to be released to full production on May 28th,2019.
With ANF, customers may host file shares in Azure with higher performance and Active Directory managed by customers on their own virtual machines.
Since ANF shares are part of active directory, delegation and impersonation may be enabled – an important consideration for enterprises looking to enable SAML Single Sign On and multi factor authentication using another IDP such as Azure AD.
Currently Azure NetApp Files does not have an integrated backup solution.An additional server which can back up shares over SMB (such as Commvault) will be required. Integrated backup and snapshot scheduling are features slated for release by end of Q3 2019.
Azure NetApp Files is a premium experience suitable for enterprises of any size. The onboarding and registration pages for Azure NetApp Files are located here.
AWS File Shares is another cloud file storage option that can be easily integrated into Active Directory to eliminate the management of Windows File Servers. Customers can quickly deploy MyWorkDrive in AWS using our image to test drive our capabilities or run their own private Cloud File Server in AWS permanently with access from anywhere while taking advantage of AWS Backups and redundancy on a virtual machine that they control. Files can be stored on their own virtual server or on Amazon FSX File Shares for Windows, which are maintained backed up by AWS. Files are stored using a standard NTFS formats which can be easily migrated, backed up or sync’d to other locations. AWS DataSync can now transfer data to and from SMB file shares to easily migrate and sync existing file shares to AWS Cloud File Storage.
Secure Remote File Access
To map drives remotely to Azure File Shares or Azure NetApp Files Service requires connecting to ports 445 and 139 over SMB protocol which are only accessible from the same local area network or via VPN.
Microsoft documentation is frequently interpreted to mean this is an option for accessing files remotely via SMB ports, but those ports are normally blocked on nearly every firewall and service out there due to security/malware concerns.
Businesses will need to maintain VPN tunnels from Azure to each location (and pay for usage and bandwidth) as well as VPN gateways for users to access files on the go.
Since SMB Shares are made available directly over VPN these shares are subject to the same security and ransomware concerns as file shares on-premise.
As an alternative to VPN, MyWorkDrive can be enabled in Azure as a virtual machine to provide secure azure cloud storage gateway access to Azure File Shares or Azure NetApp file shares over port 443 (SSL) with a mapped drive, web browser and mobile clients.
Instead of using VPN’s, end users may access files over port 443 with built in the security and intelligence (such as blocking files by size and type) not available in traditional VPN solutions.
With MyWorkDrive files remain stored and backed up on AFS or ANF shares providing a complete cloud file server solution without managing and maintaining traditional file servers or active directory on-premise.
The customer maintains control of their file shares and they remain in native NTFS format which may be backed up and stored in long term archives to meet retention requirements indefinitely without vendor lock-in ransomware concerns.
Rob Schenk of Intivix.com, a co-founder of MyWorkDrive notes: “As a long-time Microsoft partner and co-founder of an IT consultancy, I’ve recently seen a significant uptick in security compromises and ransomware infections across the industry. I’m happy that that the security model utilized by MyWorkDrive significantly reduces the attack footprint helping our clients be less susceptible to security intrusions.”
– Rob Schenk, Co-Founder and CEO Intivix
Migrating to File Shares to Azure is an important planning consideration when designing an Azure based cloud file storage share solution.
In addition to migrating files, enterprises will want to plan files types that require LAN speeds such as design files and databases. These file types cannot be safely opened over the WAN. For smaller firms with supported file types, traditional file copy migration tools such as Robocopy may suffice.
NTFS permissions may be copied with files since both Azure File Shares and NetApp File Shares support ACL’s. For larger customers consider using Azure File Share Sync or NetApp Cloud Sync. NetApp cloud sync customers utilizing the new Azure NetApp File Service may obtain a free license for a limited time from NetApp.
Conclusion & Recommendation
The current state of cloud file storage for Windows-based organizations in Azure is continuing to evolve at an accelerated pace.
For any organization, a combination of Azure File Shares or AWS FSX File Shares with MyWorkDrive is an excellent choice with Active Directory native authentication to provide the most flexible and optimal file share remote access option.
On January 13th, 2020 We have updated our our Azure MyWorkDrive Image in the marketplace to allow it to easily join an existing Windows Active Directory Server that will further simplify the process.
For organizations who need very large file shares with higher performance, Azure NetApp Files connected to VM based Active Directory Domain Controllers and MyWorkDrive is another alternative.
Exciting Article Updates! June 15th, 2020
*Azure News Update: Azure Files AD Integration for SMB access using Active Directory Domain’s managed by customers, is now available and fully supported.
Dan Gordon
Daniel, Founder of MyWorkDrive.com, has worked in various technology management roles serving enterprises, government and education in the San Francisco bay area since 1992. Daniel is certified in Microsoft Technologies and writes about information technology, security and strategy and has been awarded US Patent #9985930 in Remote Access Networking
