--- title: Using Azure File Shares with Windocks description: Tips for using Azure file shares with Windocks as both a source for backup files and a target for VHDX files. ---     TECHNICAL DOCS # Using Azure File Shares with Windocks ### Tips for using Azure file shares with Windocks as both a source for backup files and a target for VHDX files #### [Prerequisites](https://23302346.hs-sites.com/docs-azure-file-shares#prereq) #### [1. Set default share-level permissions](https://23302346.hs-sites.com/docs-azure-file-shares#default) #### [2. Set share-level permissions to an AAD group](https://23302346.hs-sites.com/docs-azure-file-shares#group) #### [3. Store AAD credentials for local administrator](https://23302346.hs-sites.com/docs-azure-file-shares#local)     ## **Prerequisites** Before using Azure file shares with Windocks you should have configured the following: - Azure Active Directory Domain Services (AADS) [installed and configured](https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance) - An Azure Windows VM targeted for Windocks installation.  The Azure MarketPlace features a prebuilt image with [SQL Server 2022](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/microsoftsqlserver.sql2022-ws2022?tab=Overview) installed.  Make sure you note the local administrator username and password, even if you have privileges through your domain credentials. - The Azure VM [joined to the AADDS domain](https://learn.microsoft.com/en-us/azure/active-directory-domain-services/join-windows-vm) - [A storage account](https://learn.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-portal?tabs=azure-portal#create-a-storage-account) with an [Azure file share](https://learn.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-portal?tabs=azure-portal#create-an-azure-file-share) It is recommended that you follow all of the instructions below prior to [installing Windocks on the Azure VM](https://23302346.hs-sites.com/docs-install-azure). [Back to Top ](https://23302346.hs-sites.com/docs-azure-file-shares#top) [Back to Technical Docs Gallery ](https://23302346.hs-sites.com/resources)     ## 1. Set default share-level permissions Windocks services run as local administrator on the machine and thus don't have Azure AD (AAD) identities to connect to the share. A Microsoft article provides the instructions for [ensuring default share-level permissions for all authenticated identities](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal#share-level-permissions-for-all-authenticated-identities). Per the instructions in that Microsoft article, verify that **Active Directory (SMB) **is** Configured **and that your **Default share-level permissions** are **Enabled**. ![file-share-config](https://23302346.hs-sites.com/hs-fs/hubfs/file-share-config.png?width=1324&height=906&name=file-share-config.png) If you want to inspect your default share-level permissions, click the **Enabled** link and verify the permissions are set to **Storage File Data SMB Share Contributor**. ![enable-smb-share-level-permissions](https://23302346.hs-sites.com/hs-fs/hubfs/enable-smb-share-level-permissions.png?width=1324&height=906&name=enable-smb-share-level-permissions.png) Please continue to follow the instructions, as this step does not always complete the configuration for Windocks access to the Azure file share. [Back to Top ](https://23302346.hs-sites.com/docs-azure-file-shares#top) [Back to Technical Docs Gallery ](https://23302346.hs-sites.com/resources)     ## 2. Set share-level permissions to an AAD group You should also define a group that has access to this Azure File Share that includes your computer running SQL Server.  A [Microsoft Tech Community article](https://techcommunity.microsoft.com/t5/azure-virtual-desktop/step-by-step-guide-on-computer-account-auth-for-azure-files/m-p/1855164) describes this practice. Assuming your domain syncs with Azure Active Directory, you can create a [basic group and add members](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-manage-groups#create-a-basic-group-and-add-members) in Azure Active Directory.  Ensure that you not only add your desired users but also add the service principal for the VM running SQL Server. The following screenshot shows an Azure AD group called "fileaccess" that includes both users and the VM running SQL server ("sqltest4") as a service principal. ![sqlserver-as-service-principal](https://23302346.hs-sites.com/hs-fs/hubfs/sqlserver-as-service-principal.png?width=1324&height=906&name=sqlserver-as-service-principal.png) Then, follow the instructions in this Microsoft article to [add share-level permissions for the specific AD group](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal#share-level-permissions-for-specific-azure-ad-users-or-groups) that includes the service principal for the VM running SQL Server.  The share-level permission should be set to **Storage File Data SMB Share Contributor.** The following screenshot shows the "fileaccess" group with the **Storage File Data SMB Share Contributor** role assigned. ![group-with-smb-privileges](https://23302346.hs-sites.com/hs-fs/hubfs/group-with-smb-privileges.png?width=1324&height=906&name=group-with-smb-privileges.png) Please continue to follow the instructions, as this step does not always complete the configuration for Windocks access to the Azure file share. [Back to Top ](https://23302346.hs-sites.com/docs-azure-file-shares#top) [Back to Technical Docs Gallery ](https://23302346.hs-sites.com/resources)     ## 3. Store AAD credentials for local administrator Because Windocks runs as the local computer administrator, it is often required to also associate Azure Active Directory credentials with the local computer administrator account. 1. Ensure you are logged into the local administrator account you specified when you created the [SQL Server 2022 VM](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/microsoftsqlserver.sql2022-ws2022?tab=Overview).  It is important that you are logged as a local computer administrator and not as a domain user that happens to have administrator privileges. 2. Using File Explorer, try to connect using the fully qualified UNC path to the share in the address bar.  You may see a **Windows Security** dialog box with a prompt to enter your network credentials. ![remember-credentials](https://23302346.hs-sites.com/hs-fs/hubfs/remember-credentials.png?width=1125&height=593&name=remember-credentials.png) 3. Enter your Azure Active Directory (or domain) credentials and check **Remember my credentials**.  Click **OK**. You should now be ready to install and use Windocks on Azure and to utilize this Azure file share both to specify backup files in dockerfiles, as well as to use this file share as a target for virtual hard drive (VHDX) files for database virtualization. For more information, check out the instructions to [install and configure Windocks in Azure](https://23302346.hs-sites.com/docs-install-azure). [Back to Top ](https://23302346.hs-sites.com/docs-azure-file-shares#top) [Back to Technical Docs Gallery ](https://23302346.hs-sites.com/resources) ## Extend CI/CD to your data layer [GET A DEMO ](https://23302346.hs-sites.com/schedule-demo) [TRY FREE ](https://23302346.hs-sites.com/try-free)