13.7 Azure File Sync, Cloud Tiering & Monitoring

Azure File Sync, Cloud Tiering & Monitoring

Section 13.6 covered the cloud side of the story. Azure File Sync (AFS) is what makes it hybrid: it centralizes an organization's file shares in Azure Files while keeping on-premises Windows Servers in place as high-performance local caches, so users keep their familiar UNC paths and local read speeds while the authoritative copy lives in Azure.

---

1. Azure File Sync (AFS) Architecture & Components

Azure File Sync (AFS) centralizes organization file shares in Azure Files while preserving local Windows Servers as high-performance local caches.

+-----------------------------------------------------------------------------------+
|                         AZURE FILE SYNC ARCHITECTURE                              |
|                                                                                   |
|   [STORAGE SYNC SERVICE (Azure Resource)]                                         |
|   `-- [SYNC GROUP: CorpDataSync]                                                  |
|       |-- [Cloud Endpoint]                                                        |
|       |   `-- Azure File Share: 'corp-cloud-share' (Central Master Storage)       |
|       |                                                                           |
|       |-- [Server Endpoint 1: NY-FS01]                                            |
|       |   `-- Local Path: 'D:\Shares\Corp' (Cloud Tiering Enabled: 20% Free)      |
|       |                                                                           |
|       `-- [Server Endpoint 2: LON-FS01]                                           |
|           `-- Local Path: 'D:\Shares\Corp' (Cloud Tiering Enabled: 15% Free)      |
+-----------------------------------------------------------------------------------+

Core Terminology

• Storage Sync Service: The top-level Azure Resource Manager resource that manages sync relationships.
• Registered Server: An on-premises or Azure IaaS Windows Server that has the Azure File Sync Agent installed and has been registered with a Storage Sync Service.
• Sync Group: Defines the replication topology. Contains exactly one Cloud Endpoint and one or more Server Endpoints.
• Cloud Endpoint: A specific Azure File Share participating in a Sync Group.
• Server Endpoint: A specific directory path on a registered Windows Server volume (e.g., D:\Shares\Marketing).

---

2. Cloud Tiering Mechanics & Policies

Cloud Tiering is an optional feature of Azure File Sync that transforms local Windows Servers into high-speed caches of the Azure File Share.

+-----------------------------------------------------------------------------------+
|                            CLOUD TIERING FILE STATES                              |
|                                                                                   |
|   [NORMAL FILE (Hot Data)]            [TIERED FILE (Cold Data)]                   |
|   +-------------------------------+   +-------------------------------+           |
|   | Full File Payload on Local Disk|   | NTFS Reparse Point (Pointer)  |           |
|   | Size = Size on Disk           |   | Size on Disk = 0 KB           |           |
|   | Attributes: Standard (A)      |   | Attributes: Offline (O) / Reparse (L)     |
|   +-------------------------------+   +-------------------------------+           |
|                                                       |                           |
|                                        [User Opens Tiered File]                   |
|                                                       |                           |
|                                                       v                           |
|                                       [Transparent Recall from Azure Files]       |
+-----------------------------------------------------------------------------------+

Cloud Tiering File Anatomy

When a file is tiered:

1. The file content is stored safely in the Azure File Share.
2. The local file on the Windows Server volume is replaced with an NTFS Reparse Point.
3. The file's size on disk drops to near 0 KB, while its logical file size remains unchanged.
4. The file is assigned the FILE_ATTRIBUTE_OFFLINE (attribute O) and FILE_ATTRIBUTE_REPARSE_POINT (attribute L) flags.
5. When a user opens the file, the AFS file system filter driver (StorageSync.sys) intercepts the read I/O, recalls the file data from Azure Files across the network, and serves the content transparently.

Cloud Tiering Policies

• Volume Free Space Policy (Always Active): Specifies the percentage of free space that must always be maintained on the local volume (e.g., 20%). When volume utilization exceeds 80%, AFS continuously tiers the least recently accessed files to the cloud until 20% free space is achieved.
• Date Policy (Optional): Specifies that files should be tiered if they have not been accessed or modified within a set number of days (e.g., 30 days).

# Register an on-premises Windows Server with Azure File Sync
Register-AzStorageSyncServer `
    -ResourceGroupName 'RG-Storage' `
    -StorageSyncServiceName 'CorpStorageSync' `
    -TenantId '11111111-2222-3333-4444-555555555555'

# Create a Server Endpoint with Cloud Tiering enabled (20% Volume Free Space, 60-day Date Policy)
New-AzStorageSyncServerEndpoint `
    -ResourceGroupName 'RG-Storage' `
    -StorageSyncServiceName 'CorpStorageSync' `
    -SyncGroupName 'CorpDataSync' `
    -ServerId (Get-AzStorageSyncServer -ResourceGroupName 'RG-Storage' -StorageSyncServiceName 'CorpStorageSync').ServerId `
    -ServerLocalPath 'D:\Shares\Corp' `
    -CloudTiering $true `
    -VolumeFreeSpacePercent 20 `
    -TierFilesOlderThanDays 60

---

3. Monitoring, Troubleshooting & Migration Strategies

Monitoring & Diagnostics

• Event Viewer: Azure File Sync writes to the Telemetry event log under Applications and Services Logs -> Microsoft -> FileSync -> Agent:
  • Event ID 9102: Logged once a sync session completes. HResult = 0 means the session succeeded, and PerItemErrorCount reports how many individual items failed inside it.
  • Event ID 9302: Logged every 5-10 minutes while a sync session is active. Compare AppliedItemCount against TotalItemCount to confirm the session is still making forward progress; a session stuck at AppliedItemCount=0 eventually fails and logs a 9102 carrying the error.
  • Event ID 9121: Logged once per distinct per-item error after a session completes, with PersistentCount and TransientCount. This is where locked files and unsupported characters surface.
  • Event ID 9003: Cloud tiering error distribution for a server endpoint (Total Error Count plus ErrorCode, one event per error code). The portal's Tiering errors figure is built from this event; 9006 is its recall-error counterpart.
  • Event ID 9016: Ghosting (tiering) results for a volume - free space percent, number of files ghosted in the session, and number of files that failed to ghost.

[!WARNING] Exam trap: 9003 is a cloud tiering error event, not a sync-session event, and 9102 is the session-level result, not the per-item error. The per-item error event is 9121. A question that describes "one event logged per error code" is pointing at 9003/9006, while one that describes an HResult for the whole session is pointing at 9102.

• Azure Monitor: Track telemetry metrics including Sync Health, Tiering Recall Size, and Server Endpoint Low Disk Space Mode.

Migration Strategies: Moving to Azure File Sync

+-----------------------------------------------------------------------------------+
|                        AFS DATA PRE-SEEDING WORKFLOW                              |
|                                                                                   |
|   [Step 1: Pre-seed to Azure]  ---> RoboCopy / Azure Data Box / AzCopy uploads    |
|                                     bulk data directly to Azure File Share        |
|                                      |                                            |
|                                      v                                            |
|   [Step 2: Server Endpoint]    ---> Deploy AFS Agent & Create Server Endpoint     |
|                                      |                                            |
|                                      v                                            |
|   [Step 3: Fast Cloud Recall]  ---> Server downloads lightweight namespace /      |
|                                     reparse points without downloading full data  |
+-----------------------------------------------------------------------------------+

1. Storage Migration Service (SMS): Automates the discovery, inventory, transfer, and cutover of legacy Windows Server 2008/2012/2016/2022/2025 file servers directly into Azure File Sync endpoints.
2. RoboCopy Pre-Seeding: For multi-terabyte shares over slow WAN links, administrators pre-seed data to Azure Files, install the AFS agent on the local server, and let AFS reconcile namespaces using hash signatures without transferring full payloads across the WAN:

# Multi-threaded RoboCopy command preserving NTFS ACLs, ownership, and timestamps
robocopy D:\SourceData \\mystorageacct.file.core.windows.net\share\SourceData `
    /MIR `
    /COPY:DATSO `
    /DCOPY:DAT `
    /ZB `
    /MT:32 `
    /R:3 `
    /W:5 `
    /LOG:C:\Logs\Preseed.log