Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
Yes—scan-to-folder can target an Azure Files SMB share directly only if the printer supports encrypted SMB 3.x, a supported authentication method, and network connectivity to Azure Files over TCP 445; otherwise, scan to a local SMB server and synchronize that folder with Azure Files.
Option 1: Connect the printer directly to Azure Files
First check the printer’s scan-to-SMB documentation or configuration page for these capabilities:
- SMB 3.0 or SMB 3.1.1 with SMB encryption.
- NTLMv2 or Kerberos authentication.
- A UNC path and DNS host name, rather than requiring a fixed server IP.
- Connectivity through your site-to-site VPN, or outbound TCP 445 if using the public endpoint.
Azure Files supports SMB 3.1.1, 3.0, and 2.1, but on-premises SMB 2.1 clients cannot access the share. When encryption in transit is required, only SMB 3.x connections with encryption are accepted. Supported authentication methods are Kerberos and NTLMv2, with NTLMv2 applying to storage-account-key authentication.^1^
If the printer meets those requirements:
- Create an SMB Azure file share
- Azure portal → Storage accounts → your storage account → Data storage → File shares.
- Create or select the destination share and folder.
- Configure network access
- Preferred on-premises design: create a private endpoint for the file share and connect the local network to its virtual network using a site-to-site VPN or ExpressRoute.
- Configure DNS so the storage account’s file-share host name resolves to the private endpoint.
- Configure authentication
- Prefer identity-based authentication when the printer supports an applicable Kerberos configuration.
- If it supports only NTLMv2, storage-account-key authentication may work:
- Username: storage account name
- Password: storage account key
- Configure the printer’s scan destination
- Protocol: SMB
- Server:
<storage-account>.file.core.windows.net - Share/path:
<share-name>\<scan-folder> - Port:
445 - Enable SMB encryption if the printer exposes that setting.
- Enter the selected credentials and perform a test scan.
If the direct connection fails
Test TCP 445 from a computer on the same network path as the printer:
Test-NetConnection `
-ComputerName "<storage-account>.file.core.windows.net" `
-Port 445
TcpTestSucceeded : True confirms that the network permits TCP 445; it does not validate the printer’s SMB version, encryption, or credentials. If it is false, use a private endpoint with VPN/ExpressRoute rather than exposing inbound SMB or weakening firewall controls.^4^
Do not disable encryption merely to accommodate an older printer: an on-premises SMB 2.1 client still cannot access Azure Files, even when encryption is disabled.^1^
Option 2: Local SMB folder with Azure File Sync
Use this design when the printer lacks SMB 3 encryption, cannot use the required credentials, or cannot reach TCP 445:
- Provide a Windows file server on the printer’s local network.
- Create a restricted local SMB share, such as
\\scanserver\scans. - Configure the printer to scan to that local share using credentials limited to the scan folder.
- Deploy Azure File Sync so the local server acts as a cache of the Azure file share.
Azure Files supports caching shares on-premises with Azure File Sync. This keeps the printer on a compatible local SMB endpoint while synchronizing its scans to Azure Files.^1^
References