How to configure On-Prem SMB-Share to be accessed by Azure Storage Mover

Hello Huppertz, Nikolai,

Greetings! Welcome to Microsoft Q&A Platform.

I understand that you are using Azure Storage Mover for migrating some files from on-prem environment to an Azure File Share and encountering issues with it while performing the migration with error code AZSM1001 stating permission is denied.

Prerequisites for the SMB Share:

1. Ensure you have an active Azure subscription and a resource group.
2. You need at least one SMB Azure file share in your storage account.
3. Your local network must allow the Storage Mover agent to communicate with Azure. Ensure that port 443 (TLS) is open outbound, and your firewall rules do not limit traffic to Azure.

Configuring SMB Share for Key Vault Secrets:

To configure your SMB share to permit access using Key Vault secrets, follow these steps:

1. Create and Store Secrets in Azure Key Vault, store the credentials (username and password) for your SMB share in Azure Key Vault as secrets.
2. Ensure the Storage Mover agent has the necessary permissions to access the Key Vault secrets. You can do this by assigning the appropriate roles (e.g., Key Vault Reader) to the managed identity of the Storage Mover agent.
3. When setting up your migration job, specify the Key Vault secrets for the SMB share credentials. The Storage Mover agent will use these secrets to authenticate and access the SMB share.

Setting Permissions on the SMB Share:

Even though you've assigned 'Full Control' to 'Everyone', it's essential to ensure that the specific user account (whose credentials are stored in Key Vault) has the necessary permissions on the SMB share.

1. Identify the User Account:
   • Determine the user account that will be used by the Storage Mover agent to access the SMB share.
2. Assign Permissions:
   • On your SMB share, explicitly assign the required permissions (e.g., Read, Write, Modify) to this user account.
3. Verify Permissions:
   • Double-check that the permissions are correctly set and that there are no conflicting permissions that might be causing the access issue.

Troubleshooting Error Code AZSM1001,

The error code AZSM1001 indicates a failure to mount the source path during your Azure file share migration and indicates a permission issue.

Please consider checking few additional steps to troubleshoot:

1. Check Key Vault Access:
   • Ensure that the Storage Mover agent can access the Key Vault and retrieve the secrets.
2. Review SMB Share Permissions:
   • Verify that the user account has the correct permissions on the SMB share.
3. Network Connectivity:
   • Confirm that there are no network issues preventing the Storage Mover agent from accessing the SMB share.

If you continue to face issues, reviewing the detailed logs from the Storage Mover agent might provide more insights into the specific cause of the permission denial.

Troubleshooting doc - https://video2.skills-academy.com/en-us/azure/storage-mover/status-code, https://video2.skills-academy.com/en-us/troubleshoot/azure/azure-storage/files/connectivity/files-troubleshoot-smb-connectivity?tabs=windows

reference docs: https://video2.skills-academy.com/en-us/azure/storage/files/migrate-files-storage-mover will help you with detailed guidance.

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Thanks for your response.

With these information I can narrow down the problem to this step:

Setting Permissions on the SMB Share: Even though you've assigned 'Full Control' to 'Everyone', it's essential to ensure that the specific user account (whose credentials are stored in Key Vault) has the necessary permissions on the SMB share.

1. Identify the User Account:
   • Determine the user account that will be used by the Storage Mover agent to access the SMB share.
2. Assign Permissions:
   • On your SMB share, explicitly assign the required permissions (e.g., Read, Write, Modify) to this user account.

As for my understanding, the Storage Mover agent uses a System-assigned managed identity within Azure, which was automatically created when registering the Agent. I've already assigned the necessary roles to this managed identity in the Key Vault, Storagemover and Azure File Share.
But as this is only a managed identity in Entra, but not in our On-Prem Active-Directory-Environment, I can not give it any permission to the On-Prem SMB-Share.

Is there a way to use a synchronized On-Prem User to be used by the Storage Mover agent instead of this default Managed-Identity or link an On-Prem-User with the necessary SMB permission to this SAMI?

I managed to get it working now.

What I've done to resolve it:

On our On-Prem Server on which the SMB-Share is located, I created a new local user, which has the same name, as is the value of the Key-Vault-User-Secret (had to shorten the secret to match the maximum allowed characters for user names), configured its password to be the same as the Key-Vault-Password-Secret and assigned SMB permissions to this newly created local useraccount.

I don't know, whether this is the intended way, but afterwards the migration project runs fine and all files are migrated as should be.