Lessons Learned from a 15TB QNAP-to-Azure Storage Migration
The SID mapping problem that cost us three days. The RoboCopy flags that preserve everything. The phase-by-phase architecture drawn out. And the six things I would do differently next time.
By Francis Avorgbedor | Azure Engineer · July 8, 2026 · 16 min read · Azure Files · QNAP · Migration
FA
Francis Avorgbedor
Azure Engineer · SEVENAI · Azure Field Notes
15TB
Data migrated across 8 SMB shares
6
Migration phases over 6 weeks
4hrs
Total user-facing downtime at cutover
$474
Monthly Azure Files cost post-migration
Ipreviously published the case study version of this migration — the what and the why and the overall outcome. This post is the engineering version: step-by-step processes with architecture diagrams, the exact commands that ran in production, the specific problems I did not anticipate and how I worked through them, and the six concrete things I would do differently if I ran this project again tomorrow. If you are planning a NAS-to-Azure-Files migration, start here before you open the Azure portal.
Step 1 — Understand the full migration architecture before touching anything
The most important investment in any NAS migration is the architectural planning session before a single command runs. This is the topology we were migrating from and to — every decision downstream followed from understanding this picture clearly.
Figure 1 — Source to target: full migration architecture
Step 2 — Discovery and inventory (do not skip this)
We spent two full days on discovery before touching a single tool. This is where we found the SID problem, the illegal filenames, and the archive shares that should have used a different migration method. Every hour spent here saved two hours downstream.
Figure 2 — Discovery checklist: what to audit before the first RoboCopy
Step 3 — The SID mapping problem: why QNAP's local accounts break Azure Files permissions
The QNAP was not domain-joined. It used a local LDAP bridge to map QNAP-local users to Active Directory accounts. When RoboCopy copies ACLs with /COPY:DATSO, it faithfully copies the SIDs from the source — including QNAP-local SIDs that do not exist in Active Directory. Files arrive in Azure Files with broken permission entries that look correct in Windows Explorer but silently deny access to users who should have it.
Figure 3 — The SID mapping problem and how to resolve it
Step 4 — The six-phase migration, step by step
Here is the precise sequence we followed. Each phase has a dependency on the previous one. Do not skip phases or re-order them — the sequence exists for good reasons.
Figure 4 — Six-phase timeline: 40 days from start to cutover
1
Azure infrastructure provisioning
Create storage accounts (Premium SSD, Standard HDD, Cool tier), Azure file shares, Storage Sync Service, and Sync Groups. Domain-join the storage accounts via Azure AD Connect. Configure Private Endpoints — do this before registering the AFS agent, not after. Enable AD authentication on each storage account.
Days 1–3 · No user impact
2
Windows Server provisioning and SID mapping
Provision and domain-join Windows Server 2022 (on-premises or Azure VM). Install Azure File Sync agent. Run the SID mapping exercise for all QNAP-local users. For Finance and HR shares with complex ACLs, budget 3–6x more time than you estimate — calculate by file count, not share count.
Days 4–8 · No user impact
3
Initial RoboCopy: QNAP → Windows Server (LAN)
Copy all 15TB over local 10GbE network. Run parallel jobs for large shares. Users continue working on QNAP — no disruption. Expect 8–10 days at 300MB/s sustained. Check error counts in the RoboCopy log daily.
Days 9–16 · No user impact
4
Azure File Sync initial upload (WAN)
AFS agent begins uploading from Windows Server to Azure Files over 500Mbps WAN. Configure bandwidth schedule to match client's traffic shaping. Monitor sync health dashboard daily. Resolve file errors (illegal chars, path length) as they appear — do not wait until cutover.
Days 17–28 · No user impact
5
Delta RoboCopy and cutover preparation
Run second RoboCopy pass with /XO (exclude older) to capture changes. Test DFS-N redirect in staging. Notify users of Saturday maintenance window. Verify AFS sync health shows zero errors and zero pending files.
Days 29–35 · No user impact
6
Cutover weekend
Saturday 22:00 — final RoboCopy with /MIR (47 minutes). Redirect DFS-N targets from QNAP to Windows Server AFS endpoints. Disconnect QNAP shares at 23:15. Verify mapped drives reconnect on test machines. Total user downtime: 4 hours. Keep QNAP live (read-only) for 2 weeks as fallback.
Day 40 — Saturday night · 4hrs user downtime
Step 5 — The exact RoboCopy commands for each phase
The flags matter more than most guides admit. The wrong combination produces a copy that looks complete but is missing ACLs, timestamps, or ownership — and you only discover this after the QNAP is decommissioned.
Figure 5 — RoboCopy flag anatomy: what each flag does and why it matters
Step 6 — Monitoring Azure File Sync throughout the upload phase
Azure File Sync does not fail a sync job because of individual file errors. It logs them silently and continues. You must actively monitor the error log throughout Phase 4 or you will discover missing files on cutover day.
Figure 6 — Azure File Sync monitoring: three places to check daily during Phase 4
Step 7 — The cutover: DFS-N redirect is the right mechanism
Do not change DNS, do not remap drives manually, do not ask users to reconnect. DFS Namespace redirect is transparent — mapped drives reconnect automatically without any client-side action.
Figure 7 — DFS-N cutover: before and after redirect
The six lessons I would apply immediately if I ran this project again
Lesson 01
Estimate SID remap time by file count, not share count
8 shares suggests 8 units of work. Wrong. Finance had 1.4M files with 847 unique ACL entries — the icacls script ran for 11 hours on that share alone. Calculate: unique ACL entries × files affected ÷ 2,000 entries/min = hours. Not "one day per share."
Lesson 02
Scan for illegal filenames on day one
Run the PowerShell filename scan on day one of discovery — before anything else. We ran it in Phase 4 and found 23 files silently skipped by AFS. Had they not been caught, they would have been missing from Azure Files on cutover. This scan takes 20 minutes. Do it first.
Lesson 03
Use Storage Mover for archive shares, not AFS
Archive shares needed no cloud tiering, no hybrid access, and would never be synced back. Azure Storage Mover is designed exactly for this — one-time migration, no continuous sync infrastructure. We used AFS for everything out of consistency. That was wrong for archives.
Lesson 04
Configure Private Endpoints before the AFS agent
We added Private Endpoints after the AFS agent was already syncing. This required a sync pause and agent re-registration. The correct order is: Private Endpoints → verify connectivity → AFS agent registration. Azure Files should never traverse the public internet in production.
Lesson 05
Consider provisioning Windows Server in Azure, not on-prem
An Azure VM as the intermediate server eliminates the WAN upload bottleneck. RoboCopy from QNAP to the Azure VM still uses the internet link — but subsequent AFS sync from Azure VM to Azure Files is intra-Azure at effectively unlimited speed, cutting Phase 4 from 11 days to potentially 2–3.
Lesson 06
Keep QNAP live for 2 weeks — never decommission immediately
Two weeks of parallel operation is your safety net. We found no issues, but we had 3 user queries about specific files in week one that we were able to verify against the QNAP source. The cost of keeping it powered on is negligible. The cost of a failed cutover without rollback is not.
"The migration that looks clean in the planning diagram will have at least one SID problem, at least one illegal filename, and at least one monitoring gap you did not anticipate. Budget for all three."
— Francis Avorgbedor | Azure Field Notes, July 2026
Quick reference takeaways
✓Audit first, migrate second. Spend two days on discovery before opening any migration tool. Every hard problem in this project was visible in the discovery data before any migration work began.
✓QNAP not domain-joined = SID remap required before copying ACLs. Run icacls remap on the Windows Server intermediate after RoboCopy Phase 3 and before the AFS upload in Phase 4.
✓The mandatory RoboCopy flags are /COPY:DATSO /DCOPY:DAT /B /MIR /IT. Any combination that omits Security or Owner from the COPY parameter will produce a copy with broken permissions.
✓Check the AFS error log daily during Phase 4. AFS does not fail for individual file errors. Silently skipped files only appear in Event Viewer logs — not in the portal health dashboard.
✓DFS-N is the only acceptable cutover mechanism. DNS changes, manual remapping, and user-directed reconnection all cause disruption. DFS-N redirect is transparent and immediate for all users simultaneously.
✓Only cut over when AFS SyncStatus = Healthy AND PendingFileCount = 0. Both conditions must be true simultaneously. SyncStatus Healthy with PendingFileCount > 0 means upload is still in progress.
The one-liner you need before any cutover — confirm AFS is fully synced# Run on Windows Server — must show Healthy AND 0 pending before DFS-N redirect Get-StorageSyncServerEndpoint | Select-Object ` @{N="Share";E={$_.ServerEndpointName}}, @{N="Status";E={$_.SyncStatus.UploadStatus.HealthState}}, @{N="PendingFiles";E={$_.SyncStatus.UploadStatus.PerItemErrorCount}}, @{N="LastSync";E={$_.SyncStatus.UploadStatus.LastSyncResult}}
# Output you need to see before cutover:# Share Status PendingFiles LastSync# Finance Healthy 0 Success# Projects Healthy 0 Success# If ANY share shows PendingFiles > 0: DO NOT PROCEED
Get the Azure field notes — every week
Real migrations, real mistakes, real fixes. Written by Francis Avorgbedor.
The Cloud Incumbent: AWS Bedrock Hosts Every Frontier Model and Amazon Is Betting on Neutrality AWS at $37.6 billion quarterly revenue, growing 28%. $13 billion invested in Anthropic. A $100 billion Anthropic-to-AWS commitment. Trainium with $225 billion in customer revenue commitments. The most quietly powerful AI strategy in the race. By Francis Avorgbedor | Azure Engineer · July 4, 2026 · 14 min read · Amazon · AWS · Cloud AI 74 SEVENAI Momentum Score — Rank #5 $37.6B AWS Q1 2026 revenue — 28% YoY growth ▲ Fastest in 15 quarters $13B Total Amazon investment in Anthropic to date ▲ Strategic anchor 100K+ Customers running Claude on AWS Bedrock ▲ Distribution moat Amazon's AI strategy is built on a thesis that every other Magnificent Seven company is testing against — and that Amazon is uniquely positioned to win regardless of the outcome. The thesis is neutrality. In a race where Microsoft has bet on OpenAI, Google has bet on Gemini, and Meta has bet...
Performance Fix Foundry Local 1.2 Linux ARM64 Embeddings Offline ASR The Edge Latency Drop: Fixing Latency Spikes by Offloading Embeddings to Foundry Local 1.2 You are paying a full cloud round trip — network, TLS, queue, throttle risk — to turn a twelve-word search query into a vector. That is the most expensive way possible to do one of the cheapest computations in your stack. Foundry Local 1.2 now runs on Linux ARM64, which means embeddings and speech recognition can happen on a Raspberry Pi, a Jetson, or a Graviton instance — offline, unmetered, and in single-digit milliseconds. The failure signature this guide resolves # Application Insights — the embedding call, not the LLM, is your tail latency: name p50 p95 p99 calls/day POST /embeddings (cloud) 89 ms 412 ms 3,847 ms 1,240,000 POST /chat/completions (cloud) 940 ms 1,720 ms 2,910 ms 38,000 ^^^^^^^^ ...
How to Reset an Azure Virtual Machine to Factory Settings Using a Managed Disk Azure does not have a single "factory reset" button. What it does have is something better: the OS Disk Swap — a method that swaps out the corrupted or misconfigured OS disk for a clean Windows Server managed disk without deleting the VM, its NICs, its IP addresses, or any attached data disks. Here is how it works, when to use it, and the exact steps to execute it safely. FA Francis Avorgbedor Azure Engineer July 16, 2026 15 min read Azure VMs · Windows Server · Real-World Fix 3 Methods to achieve a clean Windows Server installation on an existing Azure VM ~15min Typical OS Disk Swap duration — VM retains its NICs, IPs, and data disks throughout 0 Data disks affected by an OS Disk Swap — data disks remain attached and untouched 1 Snapshot of the original OS disk you must take before starting — no exceptions Introduction Why Azure Does Not Have a Simple Factory Reset — and What to Do Instead On a ph...
The 500GB System File That Eats Your Hard Drive Something on your Windows 10 drive is consuming hundreds of gigabytes and the normal tools cannot find it. This guide identifies every known culprit — from hibernation files and shadow copies to runaway backups and the Windows component store — and tells you exactly what is safe to delete, what to leave alone, and what the commands actually do.
Incident Playbook AKS Kubernetes kubectl 2026 AKS CrashLoopBackOff, Pending Pods, and NotReady Nodes — The Real Fixes Engineers Use Every AKS engineer eventually faces the same nightmare: CrashLoopBackOff at 2am, pods stuck Pending for no clear reason, or nodes flipping to NotReady mid-deployment. The difference between panic and control is knowing the exact diagnostic sequence — and the real fixes that work in production. This guide gives you both. 3 commands get pods, describe pod, and logs diagnose roughly 90% of AKS incidents before you touch anything else Exit 137 The code that means OOMKilled — the container hit its memory limit and was killed by the kernel (128 + SIGKILL 9) Events The bottom of kubectl describe is where the real cause lives — Pending, FailedScheduling, and image errors all surface there CoreDNS The single component behind most "intermittent" production failures — service discovery breaks quietly and looks like an app bug Table of Contents 01 The 3 Comm...
Can I Update My Old Computer to Windows 11 — and How Much Will It Cost? Your i7, 16GB RAM, 512GB SSD machine is powerful enough to run Windows 11 comfortably. The TPM 2.0 and Secure Boot wall is a security checkbox, not a performance ceiling. Here are two proven ways to get past it, what each one costs, and what you are trading away by doing so. $0 Cost of the Windows 11 licence if your existing Windows 10 is genuine — the upgrade remains free in 2026 2 Proven methods to bypass TPM 2.0 and Secure Boot — Rufus (easy) and Registry edit (manual) 25H2 Current Windows 11 version — all known bypass methods tested and confirmed working as of July 2026 Oct 2025 Windows 10 end of life — no more security updates. Staying on Windows 10 now carries real risk. First — Check Your BIOS Before Anything Else You Might Not Actually Need a Bypass Before running any bypass, open your BIOS and look at two settings. Many computers that fail the Windows 11 compatibility check have TPM 2.0 present in the hard...
2026 Edition 100 Tools Software Engineering DevOps AIOps Top 100 Best AI Tools for Azure Engineers and DevOps Professionals in 2026 85% of developers now regularly use AI tools. Fully AI-generated code accounts for nearly 28% of all pull requests. The question is no longer whether to use AI tools — it is which ones, in which combination, for which part of the lifecycle. This guide cuts through the noise: 100 tools, 10 categories, honest pricing, real use cases, and a selection framework for building your stack without redundancy. 85% Percentage of developers who now regularly use AI tools, per JetBrains' 2025 State of Developer Ecosystem report — up from near zero three years ago 28% Share of all pull requests containing primarily AI-generated code in 2026 — the metric that signals AI coding assistants have moved from experiment to workflow $50B Cursor's reported valuation in April 2026 Series D talks — the number that signals investor confidence in the AI developer tools mark...
Azure Files vs Azure NetApp Files: Which One Should You Choose? Performance tiers, protocol support, dual-protocol capability, pricing models, SAP/Oracle/HPC suitability, data management features, and the decision framework that maps each workload type to the right service — with step-by-step setup procedures for both. FA Francis Avorgbedor Azure Engineer July 15, 2026 20 min read Azure Storage · Architecture 4 Azure Files tiers: Premium SSD, Standard Hot, Cool, Tx Optimized 3 ANF performance tiers: Standard, Premium, Ultra — all SSD-backed 4TiB ANF minimum provisioning — significant cost floor for small workloads Dual ANF serves the same data via SMB and NFS simultaneously — AF cannot Introduction Two Services, One Surface Area — Completely Different Purposes Microsoft offers two fully managed, enterprise-grade file storage services in Azure. They share a surface area — both serve file shares over standard protocols, both run on managed infrastructure, and both integrate with Microsof...
Troubleshooting Guide AKS Kubernetes Real Solutions kubectl Azure Kubernetes Service (AKS) Troubleshooting Guide: Real Solutions to Common Problems CrashLoopBackOff at 2am. Pods stuck Pending with no obvious cause. Nodes going NotReady mid-deployment. DNS resolution silently failing in production. Every AKS engineer encounters these — the difference between engineers who panic and engineers who stay calm is knowing the exact sequence of diagnostic commands to run. This guide gives you that sequence, the root cause analysis for each failure mode, and the fix. 3 commands 90% of AKS problems are diagnosed with the same three kubectl commands: describe pod, logs --previous, and get events — in that order, every time Exit 137 The exit code that tells you everything: container killed by SIGKILL — either the Linux OOM killer (memory limit exceeded) or kubelet after grace period expired 5 min The CrashLoopBackOff ceiling: Kubernetes applies exponential backoff (10s → 20s → 40s → 80s → 160s → 3...
Step-by-Step Guide Azure OpenAI App Service Production Python How to Deploy an AI Chatbot on Azure Using Azure OpenAI and App Service From zero to a production-grade AI chatbot: provision Azure OpenAI, write a streaming Flask API backend, deploy it on Azure App Service with Managed Identity, wire in conversation history and content safety, and instrument it with Application Insights — all with complete code and Terraform IaC. No API keys in environment variables. No hardcoded secrets. No half-finished PoC patterns. 7 phases This guide covers the full deployment lifecycle: architecture design → resource provisioning → backend code → App Service deployment → streaming → security → monitoring Zero keys The chatbot authenticates to Azure OpenAI using Managed Identity and DefaultAzureCredential — no API keys stored in environment variables, Key Vault, or code SSE Server-Sent Events stream GPT tokens to the browser as they generate — the same token-by-token typing effect users expect from pr...