13.8 Migrating DFS Namespaces & DFS Replication to Azure File Sync
Key Takeaways
- Azure File Sync works fully with DFS Namespaces: keep DFS-N for the namespace and let AFS handle sync behind each folder target.
- The migration starts on the server holding the full data set, creates its server endpoint with cloud tiering off, and lets everything sync to the cloud endpoint before any other server is touched.
- DFS-R is disabled after the remaining agents are registered but before their server endpoints are created; creating endpoints while DFS-R still replicates is what produces conflict files.
- Cloud tiering may be enabled only at the final step, after DFS-R has been retired and the topology has been tested.
- The DfsrPrivate and DFSRoots folders are junctions and are skipped by Azure File Sync, and Sysprep is unsupported on a server after the AFS agent is installed.
Migrating DFS Namespaces & DFS Replication to Azure File Sync
The AZ-800 blueprint lists "Migrate Distributed File System (DFS) to Azure File Sync" as its own objective inside Configure and manage Azure Files. It is a favourite scenario item because DFS-N and DFS-R behave completely differently when Azure File Sync (AFS) arrives: one is a namespace service that AFS happily lives alongside, the other is a competing replication engine that must eventually be retired. Confusing the two is the single most common mistake on this objective.
1. DFS-N and DFS-R Interoperability, Side by Side
Azure File Sync supports interoperability with both DFS Namespaces (DFS-N) and DFS Replication (DFS-R), but the intent is different in each case.
| Technology | What it does | AFS relationship |
|---|---|---|
| DFS-N (Namespaces) | Presents a single logical path such as \\contoso.com\public that redirects clients to folder targets | Fully supported alongside AFS. Install the AFS agent on one or more file servers to sync data, and keep using DFS-N for the namespace |
| DFS-R (Replication) | Multi-master replication of folder contents between servers using RDC | A competing replication solution. In most cases, replace DFS-R with Azure File Sync |
Because DFS-N only hands out referrals and never moves file data, it is complementary: users keep hitting \\contoso.com\public, while AFS quietly handles sync and cloud tiering behind each folder target. Migration to AFS therefore usually leaves the namespace untouched, which is precisely why DFS-N is the low-risk half of this objective.
DFS-R is different. Two independent replication engines writing to the same folder produce conflicts, so Microsoft's guidance is to replace it. There are, however, three documented scenarios where DFS-R and AFS legitimately run together:
- You are mid-migration from a DFS-R deployment to an AFS deployment.
- Not every on-premises server that needs a copy of the data can connect directly to the internet.
- Branch servers consolidate data onto a single hub server, and you want AFS on the hub.
Rules for running DFS-R and AFS side by side
When both are running at once, three constraints apply, and each maps directly to an exam distractor:
- You must disable Azure File Sync cloud tiering on volumes that hold DFS-R replicated folders.
- You shouldn't configure server endpoints on DFS-R read-only replication folders.
- Only a single server endpoint may overlap a DFS-R location. Multiple server endpoints overlapping other active DFS-R locations can lead to conflicts.
[!WARNING] The cloud-tiering prohibition is the one candidates miss. Tiering replaces a local file with a reparse point; DFS-R sees a changed file and attempts to replicate a stub, which corrupts the replication group's view of the data. Cloud tiering stays off for the entire coexistence window.
2. The Documented DFS-R to Azure File Sync Migration
Microsoft publishes an ordered procedure. The sequence matters — the exam tests when DFS-R is disabled and when cloud tiering may finally be enabled.
+---------------------------------------------------------------------------+
| DFS-R -> AZURE FILE SYNC MIGRATION SEQUENCE |
| |
| 1. Create a sync group representing the DFS-R topology being replaced |
| 2. Pick the server holding the FULL data set; install AFS on it |
| 3. Register it, create a server endpoint -- CLOUD TIERING OFF |
| 4. Let ALL data sync up to the Azure file share (cloud endpoint) |
| 5. Install + register the AFS agent on the REMAINING DFS-R servers |
| 6. ---- DISABLE DFS-R ---- |
| 7. Create a server endpoint on each -- CLOUD TIERING STILL OFF |
| 8. Let sync finish; test the topology |
| 9. ---- RETIRE DFS-R ---- |
| 10. NOW enable cloud tiering on any server endpoint as needed |
+---------------------------------------------------------------------------+
Written out:
- Create a sync group to represent the DFS Replication topology you're replacing.
- Start on the server that has the full set of data in the DFS-R topology. Install Azure File Sync on that server.
- Register that server and create a server endpoint for it. Don't enable cloud tiering.
- Let all of the data sync to your Azure file share (the cloud endpoint).
- Install and register the Azure File Sync agent on each of the remaining DFS-R servers.
- Disable DFS-R.
- Create a server endpoint on each of the DFS-R servers. Don't enable cloud tiering.
- Ensure that sync finishes, and test your topology as needed.
- Retire DFS-R.
- You can now enable cloud tiering on any server endpoint as needed.
Three ordering facts carry the marks:
- The authoritative-copy server goes first (step 2). Seeding from a partially-populated DFS-R member risks uploading an incomplete namespace as the cloud master.
- DFS-R is disabled at step 6, after the agents are installed on the remaining servers but before their server endpoints are created. Creating a second server endpoint while DFS-R is still replicating is what produces conflict files.
- Cloud tiering is enabled only at step 10, after DFS-R is retired — never during the migration.
3. Keeping the Namespace Stable with DFS-N
Because DFS-N is fully supported with AFS, the user-visible path survives the migration untouched. A typical hybrid end state:
\\contoso.com\public (DFS-N namespace root)
|
+--------------+--------------+
| |
\\FS-HQ\public \\FS-BR1\public
(AFS server endpoint) (AFS server endpoint)
| |
+---------> Azure file share <-+
(cloud endpoint)
Both folder targets are now AFS server endpoints syncing to one cloud endpoint, and DFS-N continues to steer clients to the site-local target. If you decommission a branch file server, you retarget or remove its DFS-N folder target; clients following \\contoso.com\public never see a changed path.
For a full lift to the cloud, Azure Files can be surfaced directly under a DFS-N folder target, letting you retire the on-premises server while keeping the namespace.
4. Related Constraints Worth Memorizing
| Item | Behaviour with Azure File Sync |
|---|---|
DfsrPrivate and DFSRoots folders | Junctions — skipped by AFS and never synced |
| Reparse points | Skipped |
| Alternate Data Streams | Preserved on the server, but not synced |
| NTFS compression + cloud tiering | Don't combine; recall with Invoke-StorageSyncFileRecall then compact /U /S |
| Sysprep after installing the AFS agent | Not supported. Install and register the agent only after image deployment and mini-setup |
| Other HSM solutions | Not supported alongside AFS cloud tiering |
Pre-seeding remains available for the bulk data movement itself — RoboCopy with /MIR /COPY:DATSO /DCOPY:DAT, Azure Data Box, or AzCopy — but pre-seeding is a data transfer optimization, not a substitute for the DFS-R retirement sequence above.
5. Exam Traps
| Scenario | Correct response |
|---|---|
"We want AFS but must keep \\contoso.com\shared" | Keep DFS-N; it is fully supported. Only DFS-R is replaced |
| Conflict files appear during migration | A second server endpoint was created while DFS-R was still enabled — DFS-R must be disabled at step 6 |
| Branch servers have no direct internet access | A documented reason to keep DFS-R and AFS running together |
| Free space is critically low mid-migration | Cloud tiering still cannot be enabled until DFS-R is retired; add capacity or finish the sequence |
| Server was cloned from an image with the AFS agent installed | Unsupported — Sysprep after agent installation causes unpredictable results |
During a DFS-R to Azure File Sync migration, an administrator installs the AFS agent on the remaining DFS-R member servers and immediately creates server endpoints on each of them while DFS Replication is still running. Conflict files begin appearing. Which documented step was performed out of order?
A hybrid file environment must run DFS Replication and Azure File Sync side by side because several branch servers cannot reach the internet directly. Which configuration requirement applies?
An organization is replacing DFS Replication with Azure File Sync but must keep the existing \contoso.com\public path working unchanged for all users. What is the correct approach?