Azure File Shares Resource

Key Concepts

• Azure File Share (New Resource Type): A top-level, standalone Azure resource (microsoft.fileshares) that decouples file shares from the traditional Storage Account architecture.
• Storage Account (Classic): The legacy container for file shares where limits, networking, and security keys are shared across all child resources.
• Control Plane vs. Data Plane: The distinction between management operations (creating/deleting shares) and actual data throughput/IOPS.
• Provisioned Throughput/IOPS: The ability to independently scale performance metrics based on provisioned capacity.
• Token Bucket Algorithm: The mechanism used to manage control plane operations, ensuring a steady rate of allowed management actions per file share.

---

1. The Shift from Storage Account-Based Shares

Historically, Azure File Shares were child resources of a Storage Account. This created several architectural bottlenecks:

• Shared Limits: All file shares within a storage account competed for the same pool of IOPS, throughput, and capacity.
• Security Risks: Access was governed by Storage Account keys, which provided broad, "all-powerful" access to everything within that account.
• Management Complexity: Networking (Private Endpoints) and billing were tied to the Storage Account, making granular chargeback or showback difficult.
• Control Plane Contention: Because management operations were aggregated at the account level, high-frequency administrative tasks could lead to throttling.

2. The New microsoft.fileshares Resource

The new GA (General Availability) release introduces a top-level resource. It is no longer a child of a storage account, meaning it possesses its own identity, lifecycle, and configuration.

Key Technical Improvements:

• Independent Scaling: Users can independently provision capacity, IOPS, and throughput.
• Granular Control: Each share has its own network configuration (Public/Private Endpoints), tags, and security policies.
• Elimination of Account Keys: By removing the dependency on Storage Account keys, the security posture is significantly improved.
• Increased Scale: The limit has been raised from 1,000 to 10,000 file shares per region per subscription.
• Control Plane Quotas: Each share now operates on a "bucket" system for management operations (create, modify, delete, snapshots), which refills over time, virtually eliminating control plane throttling.

3. Step-by-Step Provisioning Logic

When creating the new file share resource, the workflow is simplified:

1. Resource Creation: Select "File Shares" as a top-level resource (no parent storage account required).
2. Tier Selection: Currently limited to SSD tier (NFS protocol).
3. Resiliency: Choose between LRS (Locally Redundant Storage) or ZRS (Zone Redundant Storage).
4. Performance Tuning: Define specific capacity, IOPS, and throughput. The system allows for high-performance scaling (up to 102,400 IOPS and 10,340 MB/s depending on capacity).
5. Networking: Configure specific network access controls directly on the share.

4. Comparison and Decision Framework

The speaker provides a clear framework for choosing between the "Classic" and "New" file share types:

| Feature | Classic (Storage Account) | New (Top-Level Resource) | | :--- | :--- | :--- | | Architecture | Child of Storage Account | Standalone Resource | | Security | Storage Account Keys | No Account Keys | | Networking | Inherited from Account | Configured per Share | | AKS Support | Yes (CSI Driver) | Coming Soon | | Advanced Features | CMK, Soft Delete, etc. | Coming Soon |

Recommendation:

• Use the New Resource if: You require NFS, SSD performance, independent scaling, or granular control plane management.
• Stick to Classic if: You require features not yet supported in the new model, such as specific AKS CSI driver integration, Customer Managed Keys (CMK), or soft-delete functionality.

5. Synthesis and Conclusion

The introduction of the standalone microsoft.fileshares resource represents a significant evolution in Azure storage management. By moving away from the "Storage Account as a bucket" model, Microsoft has provided users with greater architectural flexibility, improved security through the removal of account keys, and significantly higher management scale. While the new resource is currently focused on SSD/NFS workloads, it is positioned as the future of Azure file storage, with feature parity (like AKS support and advanced security) expected to arrive in future updates.