Azure NetApp Files: from delegated subnet to day-2 operations

Service and ONTAP-core architecture

The hierarchy is subscription → NetApp account → capacity pool → volume. A volume receives an IP address in an ANF-delegated subnet and exposes NAS to reachable clients. ONTAP concepts such as snapshots and changed-block replication remain visible as service capabilities; low-level ONTAP objects remain hidden.

Capacity pools and service levels

A capacity pool is the regional billing and performance envelope from which volumes receive quota. With automatic QoS, a volume’s throughput ceiling scales with assigned quota—not used bytes. Manual QoS separates assigned throughput from quota within the pool budget.

Pool capacity is provisioned and billed whether volumes are full or empty. Do not solve a throughput deficit by blindly buying unused TiB: evaluate manual QoS or Flexible where supported, tune the workload, and confirm client/network ceilings.

Volumes, protocols, and export policies

NFS export rules define client CIDRs, read/write access, protocol versions, and root-squash behavior. Start narrow, order rules deliberately, and test as an ordinary user and root. Export rules are admission control; POSIX permissions still govern files.

# Illustrative pattern — verify against the installed Azure CLI extension
az netappfiles volume export-policy add \
  --resource-group RG --account-name ACCOUNT --pool-name POOL \
  --volume-name VOL --rule-index 1 --allowed-clients 10.20.4.0/24 \
  --nfsv3-enabled true --unix-read-write true

showmount -e <volume-ip>
mount -t nfs -o vers=3 <volume-ip>:/<volume-path> /mnt/anf
findmnt /mnt/anf

CLI extension syntax changes. Check az netappfiles volume export-policy add --help locally before use.

Azure networking: VNets, delegated subnet, NSGs, and peering

1. Delegate a dedicated subnet to Microsoft.NetApp/volumes. Do not place VMs in it; plan address space for volumes and growth.
2. Use Standard network features for new designs. They support NSGs, UDRs, higher IP limits, and broader connectivity. Existing Basic deployments have a different matrix.
3. Build reachability: local clients connect through the VNet; other VNets use peering; on-premises clients use ExpressRoute or VPN gateway. ANF has no public data endpoint.
4. Keep routing symmetric. If an NVA/firewall inspects traffic, validate the supported topology and UDR behavior. A TCP handshake alone does not prove NFS/SMB health.
5. Apply NSGs intentionally. Allow protocol and identity dependencies among clients, ANF, DNS, and AD; log denies.

# Linux client evidence
ip route get <volume-ip>
nc -vz <volume-ip> 2049
rpcinfo -p <volume-ip>   # NFSv3, where permitted

# Windows client evidence
Test-NetConnection <volume-ip> -Port 445

Snapshots and cross-region replication

ANF snapshots are space-efficient point-in-time copies inside a volume. They support fast file or volume recovery, but share the service failure domain and are not an independent backup. Set frequency and retention from application RPO, change rate, and recovery needs; rehearse restores.

Cross-region replication (CRR) asynchronously transfers changed blocks from a source volume to a read-only destination in a supported region. Microsoft currently documents 10-minute, hourly, and daily schedules, subject to constraints. Replication uses Azure backend infrastructure and does not require customer VNet peering.

1. Create a compatible destination volume and client network access.
2. Establish and authorize replication.
3. Monitor health and lag against RPO.
4. For disaster, break/fail over, expose the destination, and update mounts, DNS, or application configuration.
5. After recovery, plan reverse replication and failback; neither is application orchestration.

Performance sizing

Measure peak read/write throughput, IOPS, I/O size, latency percentiles, concurrency, working-set capacity, and growth. For linear automatic-QoS tiers:

volume throughput ceiling = volume quota (TiB) × service-level MiB/s per TiB
required quota = required throughput ÷ service-level MiB/s per TiB

Example: 300 MiB/s on Premium → 300 ÷ 64 = 4.6875 TiB minimum quota
(before headroom and other client/platform limits)

The result is a ceiling, not a guarantee for one client. Validate VM NIC limits, hybrid-link bandwidth, protocol concurrency, I/O size, application serialization, and regional limits. Benchmark with the production protocol, mount options, file sizes, client count, and I/O mix.

Deployment checklist

1. Confirm regional availability, quota, service levels, feature status, CRR region pairing, and limits.
2. Register the provider and establish least-privilege Azure RBAC.
3. Choose VNet topology; delegate the ANF subnet; validate DNS, AD, peering, routes, NSGs, and hybrid gateways.
4. Create account and capacity pool with the selected service level and QoS type.
5. Create the volume with protocol, quota, network features, zone placement where applicable, and security settings.
6. Build least-privilege exports or SMB permissions; mount from representative clients.
7. Benchmark against SLOs and record a baseline.
8. Apply snapshot and backup policy plus CRR where required; execute recovery.
9. Alert on capacity, throughput, latency, replication health, and control-plane changes.

Day-2 operations runbook

Fast triage order

1. Scope: one path, volume, subnet, VNet, region, or all clients?
2. Check service/resource health and recent activity-log changes.
3. Prove route and port reachability from an affected client.
4. Test protocol, export/share admission, then file permissions and identity.
5. Compare ANF and client metrics with the baseline.
6. Change one variable at a time; escalate with resource IDs, timestamps, metrics, traces, and a minimal reproduction.

Azure NetApp Files vs Amazon FSx for NetApp ONTAP

Choose by workload location, protocol, administrative boundary, resilience, measured performance, and total cost—not an assumption that both expose identical ONTAP features. See FSx for ONTAP and the cloud decision guide.

Primary sources and currency

Reviewed 3 September 2026. Preview status, regional availability, quotas, limits, network matrices, and CLI syntax change; validate the target subscription and region.

• Microsoft: service levels and throughput
• Microsoft: network planning
• Microsoft: NAS protocols
• Microsoft: data protection and DR
• Microsoft: volume replication