AZ-802 · Domain 5 of 7

AZ-802 Domain 5: Manage storage and file services

File and storage services across on-premises and Azure: Azure file shares and File Sync, migrating DFS and file servers, share access, FSRM, DFS and SMB over QUIC, plus disks, Storage Spaces, Storage Spaces Direct, Storage Replica, deduplication, iSCSI and BitLocker.

Exam weight
15–20%
Official functional groups
3
Estimated questions estimate
~9
Suggested study time estimate
12–15 hrs

About 12 min read Reviewed October 2026

Overview

Domain 5 has the longest objective list on AZ-802 and is split into three functional groups. Configure and manage Azure Files covers creating file shares, share permissions with identity-based authentication, Azure File Sync deployment and monitoring, and migrations from DFS Replication or on-premises shares to Azure. Configure and manage Windows Server file shares covers share and NTFS access, File Server Resource Manager, DFS Namespaces and Replication, SMB over QUIC and SMB settings.

Configure Windows Server storage covers disks and volumes, Storage Spaces, Storage Spaces Direct, Storage Replica, Data Deduplication, SMB Direct, Storage QoS, NTFS and ReFS, iSCSI, BitLocker and recovery of encrypted volumes. The range is wide, so this domain rewards a clear mental map of which technology solves which problem: capacity, resilience, replication, access, efficiency or protection.

How it's tested

Questions here often present a file server estate with growth, branch or recovery requirements and ask you to choose a technology and a configuration step. Read for clues about latency, synchronous or asynchronous needs, cloud tiering, client location and data type, since these narrow the answer quickly.

  • Pick the replication technology

    Data must be copied between servers or sites, and you choose Storage Replica, DFS Replication, Azure File Sync or Hyper-V Replica.

  • Design hybrid file access

    Branch users need fast local access to central files, and you configure Azure File Sync with cloud tiering and sync groups.

  • Protect and control storage

    Quotas, file screens, encryption or performance limits are required, and you choose FSRM, BitLocker or Storage QoS settings.

Reasoning it through

Three branch file servers hold the same project data and are replicated with DFS Replication, which causes conflicts and uses local disk on every server. Migrating to Azure File Sync with one Azure file share as the cloud endpoint and each branch server as a server endpoint keeps a single authoritative copy. Enabling cloud tiering keeps frequently used files local while older files become pointers, which reduces branch disk use.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

5.1 Configure and manage Azure FilesAzure file shares, permissions, Azure File Sync, monitoring and migrations.
What it means
This group covers creating Azure storage accounts and file shares, choosing tiers, assigning share-level and file-level permissions with identity-based authentication, deploying Azure File Sync with Storage Sync Services, sync groups and server endpoints, monitoring sync health, migrating DFS Replication deployments to Azure File Sync, and migrating on-premises file shares to Azure Files.
What to understand
Azure file shares support SMB and NFS, with identity-based SMB access through on-premises AD DS, Microsoft Entra Domain Services or Microsoft Entra Kerberos for hybrid identities. Share-level access uses Azure RBAC roles such as Storage File Data SMB Share Contributor, while file-level access uses Windows ACLs. Azure File Sync uses a Storage Sync Service, sync groups with one cloud endpoint and one or more server endpoints, and the agent on each server. Cloud tiering keeps hot files local based on volume free space and date policies. Monitor sync in Azure Monitor and the server's event logs. Migrations commonly use Robocopy or Storage Mover.
How it shows up
Expect questions on choosing permissions, configuring sync groups and cloud tiering, and replacing DFS-R with File Sync.
Common confusion
Assuming share-level RBAC replaces NTFS ACLs; both layers apply and the most restrictive wins.
5.2 Configure and manage Windows Server file sharesShare access, FSRM, DFS, SMB over QUIC and SMB settings.
What it means
This group covers creating SMB shares and combining share and NTFS permissions, access-based enumeration, File Server Resource Manager quotas, file screens, reports and classification, DFS Namespaces and DFS Replication, SMB over QUIC for secure remote access without VPN, and SMB settings such as signing, encryption, protocol versions and continuous availability.
What to understand
Effective access is the more restrictive of share and NTFS permissions. Access-based enumeration hides folders users cannot read. FSRM hard quotas block writes, soft quotas only report, and file screens block extensions in active mode. DFS Namespaces present several shares under one path, while DFS Replication copies changes between servers. SMB over QUIC runs SMB inside TLS 1.3 over UDP 443 and needs a certificate on the server. Windows Server 2025 requires SMB signing by default for outbound connections, and SMB 1.0 should remain disabled.
How it shows up
Expect questions about limiting folder growth, presenting several servers as one path, and giving mobile users secure file access.
Common confusion
Mixing up DFS Namespaces and DFS Replication; namespaces unify paths, replication copies data.
5.3 Configure Windows Server storageDisks, Storage Spaces, S2D, Storage Replica, deduplication, SMB Direct, QoS, file systems, iSCSI and BitLocker.
What it means
This group covers initializing disks and creating volumes, building Storage Spaces pools and virtual disks, deploying Storage Spaces Direct on clustered servers, configuring Storage Replica, enabling Data Deduplication, SMB Direct over RDMA, Storage QoS, choosing NTFS or ReFS, configuring iSCSI targets and initiators, and managing BitLocker and recovering encrypted volumes.
What to understand
Storage Spaces offers simple, mirror and parity layouts on one server. Storage Spaces Direct pools local disks across cluster nodes, uses cache devices and mirror or parity resiliency, and suits hyperconverged Hyper-V. Storage Replica replicates block-level volumes synchronously or asynchronously between servers or clusters, with log volumes on fast storage. Deduplication suits general file shares and VDI, not running databases. ReFS gives integrity streams and fast VHDX operations but lacks some NTFS features such as file-level compression. BitLocker recovery keys can be backed up to AD DS or Microsoft Entra ID.
How it shows up
Expect questions that match a requirement to a storage technology and ask for the correct prerequisite or cmdlet.
Common confusion
Choosing Storage Replica for file-level, multi-master sync; it is one-way block replication and the destination volume is unmounted.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Azure File Sync

    Syncs Windows Server folders with an Azure file share.

    Remember
    One cloud endpoint per sync group.
    Tested as
    Hybrid file server questions.
    Trap
    Adding two Azure shares to one sync group.

  • Cloud tiering

    Keeps hot files local and replaces cold ones with pointers.

    Remember
    Volume free space and date policies.
    Tested as
    Branch capacity questions.
    Trap
    Enabling it on the system volume.

  • Identity-based Azure Files access

    SMB authentication with AD DS, Entra Domain Services or Entra Kerberos.

    Remember
    RBAC at share level plus ACLs at file level.
    Tested as
    Permissions questions.
    Trap
    Using storage account keys for users.

  • FSRM quotas and screens

    Limits folder size and blocks file types.

    Remember
    Hard quota blocks; soft quota warns.
    Tested as
    Governance questions.
    Trap
    Using NTFS disk quotas for folder limits.

  • DFS Namespaces

    One logical path across several shares.

    Remember
    Domain-based namespaces store data in AD DS.
    Tested as
    Consolidation questions.
    Trap
    Expecting it to copy data.

  • SMB over QUIC

    SMB over UDP 443 with TLS 1.3.

    Remember
    Needs a server certificate.
    Tested as
    Remote worker access questions.
    Trap
    Opening TCP 445 to the internet instead.

  • Storage Spaces Direct

    Software-defined storage across cluster nodes.

    Remember
    Requires failover clustering.
    Tested as
    Hyperconverged questions.
    Trap
    Using it on a single standalone server.

  • Storage Replica

    Block-level volume replication between servers or clusters.

    Remember
    Synchronous or asynchronous, needs log volumes.
    Tested as
    Disaster recovery questions.
    Trap
    Expecting active-active access to both copies.

  • Data Deduplication

    Removes duplicate chunks on a volume.

    Remember
    Use the right usage type: general, Hyper-V or backup.
    Tested as
    Capacity questions.
    Trap
    Enabling it for running SQL databases.

  • SMB Direct

    SMB over RDMA network adapters.

    Remember
    Low latency and CPU use.
    Tested as
    S2D and Hyper-V storage questions.
    Trap
    Expecting it on non-RDMA NICs.

  • ReFS

    Resilient File System with integrity streams.

    Remember
    Preferred for S2D and Hyper-V workloads.
    Tested as
    File system choice questions.
    Trap
    Choosing it when NTFS-only features are required.

  • BitLocker recovery

    Recovering access with recovery passwords or keys.

    Remember
    Back up keys to AD DS or Entra ID.
    Tested as
    Encryption recovery questions.
    Trap
    Assuming keys are escrowed automatically without policy.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Replication technologies

ConceptMeaningKey differenceCommon trap
Storage Replica Block-level volume replication Sync or async, one-way Expecting writable destinations
DFS Replication File-level multi-master replication Conflicts possible Using it for open database files
Azure File Sync Server folders synced to an Azure share Cloud as the hub with tiering Adding several cloud endpoints

Storage Spaces vs Storage Spaces Direct

ConceptMeaningKey differenceCommon trap
Storage Spaces Pools disks on one server Shared SAS JBODs or local disks Expecting node failure tolerance
Storage Spaces Direct Pools local disks across cluster nodes Survives node loss Deploying without a cluster

NTFS vs ReFS

ConceptMeaningKey differenceCommon trap
NTFS General-purpose file system Supports compression, EFS and boot volumes Using it for large S2D volumes by default
ReFS Resilience-focused file system Integrity streams and block cloning Expecting to boot from it

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Storage Replica as multi-site file share

    What candidates pick
    Use Storage Replica so two offices can both edit the same files.
    Why it looks right
    It replicates data between sites.
    Why it's wrong
    Storage Replica is one-way; the destination volume is not accessible during replication.

    Clue to watch for Users in both locations write to the data.

  2. DFS-R across branches forever

    What candidates pick
    Keep DFS Replication for branch file servers syncing over the WAN.
    Why it looks right
    It already works.
    Why it's wrong
    Azure File Sync centralizes data in one Azure share and adds tiering, which avoids DFS-R conflicts and full local copies.

    Clue to watch for Requirements mention reducing local storage or central backup.

  3. Soft quota to block writes

    What candidates pick
    Configure a soft quota to stop users exceeding 10 GB.
    Why it looks right
    Quotas sound like limits.
    Why it's wrong
    Soft quotas only notify; hard quotas block writes.

    Clue to watch for The words prevent or block.

  4. Port 445 to the internet

    What candidates pick
    Publish SMB on TCP 445 for remote staff.
    Why it looks right
    It is the standard SMB port.
    Why it's wrong
    Exposing 445 is unsafe and often blocked; SMB over QUIC uses UDP 443 with TLS 1.3.

    Clue to watch for Remote users without VPN.

  5. S2D on a single server

    What candidates pick
    Deploy Storage Spaces Direct to one server with local disks.
    Why it looks right
    Direct suggests local disks.
    Why it's wrong
    S2D requires a failover cluster; a single server uses Storage Spaces.

    Clue to watch for Only one server is available.

  6. Storage account key for users

    What candidates pick
    Give users the storage account key to map the Azure share.
    Why it looks right
    It always works.
    Why it's wrong
    Keys grant full control and bypass identity; use identity-based authentication with RBAC and ACLs.

    Clue to watch for Per-user permissions or auditing.

Answer framework

Use this framework to match a storage requirement to the right Windows Server or Azure feature.

  1. Classify the requirement as capacity, resilience, replication, access, efficiency or protection before considering any product names, because several features sound similar but solve different problems.
  2. For replication decide between block or file level, synchronous or asynchronous, and on-premises or cloud as the hub.
  3. For access choose SMB shares, DFS Namespaces, Azure Files or SMB over QUIC, then layer share, NTFS and RBAC permissions.
  4. For capacity and efficiency choose Storage Spaces, S2D, deduplication, tiering or Storage QoS based on server count and workload.
  5. For protection apply BitLocker with key escrow, FSRM screens and quotas, and plan recovery steps for encrypted volumes before an outage forces them.

Practice question

A company has four branch file servers that each hold a full copy of shared data using DFS Replication. Management wants one central copy in Azure, faster branch access to recent files and less local disk use. What should you implement?

Want more like this? The AZ-802 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Divide study time across the three groups in proportion to their length, giving the storage group the most. In a lab, create a share with conflicting share and NTFS permissions and test effective access. Install FSRM and test a hard quota and an active file screen. Build a domain-based DFS namespace with two folder targets and enable replication. Create a Storage Spaces pool with mirror and parity virtual disks, enable deduplication on a data volume, and format test volumes with NTFS and ReFS to compare options. Configure an iSCSI target and connect an initiator.

For hybrid topics, create an Azure storage account and file share, deploy a Storage Sync Service, install the agent on a lab server, and add a server endpoint with cloud tiering. Watch which files become tiered. If you can build a two-node cluster, try Storage Spaces Direct and Storage Replica, or at least run Test-SRTopology. Finish by encrypting a data volume with BitLocker, backing up the key to AD DS, and recovering it.

FAQ

What is the weight of Domain 5, Manage storage and file services, on AZ-802?

Manage storage and file services is weighted at 15–20%, about eight to ten questions. It has three functional groups and the longest list of individual objectives in the study guide.

Do I need to know NFS on Azure Files?

The outline focuses on SMB scenarios for Windows Server. Know that NFS shares exist on premium file shares, but study SMB identity-based access and File Sync in more depth.

Can one server sync to several Azure file shares?

Yes, a server can have endpoints in several sync groups, but each sync group has exactly one cloud endpoint, and a server path can belong to only one sync group.

Is SMB over QUIC available on all Windows Server editions?

SMB over QUIC server was first limited to Windows Server 2022 Datacenter: Azure Edition. Windows Server 2025 makes it available across editions. Verify edition requirements in current documentation before relying on them.

What is the difference between SMB Direct and SMB Multichannel?

SMB Direct uses RDMA adapters to move data with low CPU use. SMB Multichannel uses several network connections at once for throughput and fault tolerance. They can work together.

Where should BitLocker recovery keys be stored?

Back up recovery information to AD DS for domain-joined servers or to Microsoft Entra ID where supported, using Group Policy to require backup before encryption completes.

Does Storage Replica need a cluster?

No. Storage Replica supports server-to-server, cluster-to-cluster and stretch cluster configurations. It needs matching data and log volumes on each side.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

Test how well you match storage requirements to Azure File Sync, DFS, Storage Spaces Direct, Storage Replica and BitLocker with AZ-802 practice questions.

Take the AZ-802 practice test Check your AZ-802 readiness

Keep going