The S2S VPN posture built end to end. Private endpoint, the privatelink DNS zone, on-prem resolution, a closed storage firewall, and hardened SMB, plus the Entra Kerberos step that teaches the storage application its private-link SPNs so mounts get a ticket instead of error 1326.
Yes, Azure Files is literally SMB on port 445 to a public endpoint. Whether that should scare you depends on facts most people arguing about it do not have.
Named groups, real NTFS ACLs, the manifest tag, and the Conditional Access exclusion: the full identity build for an Azure file share with no domain controller.
The identity source you pick for Azure Files is a one-per-account authority decision, and the right answer changed in May 2026. The four paths, the device matrix, and the MFA limitation nobody mentions.
From an empty subscription to a mounted drive letter with Kerberos sign-in, no domain controller required. The starter build for anyone who has never touched Azure Files.
The honest answer to "can Azure Files replace my file server" changed in 2026. Here is what the platform actually is now, and the three deployment postures I defend.
Cost views and budgets by tag, the subscription-vending checklist, the add-a-spoke runbook, and the monthly health and drift checks. The operating loop made concrete, and the final build sheet of the series.
The foundation is built; now it is operated and grown. Day-two cost management where the mandatory tags finally pay off, the where-does-new-X-go framework, and the series-closing argument that a real foundation grows by placement, not by rebuild.
