Two bullets in the AZ-900 skills outline sit at the very end of the “Describe Azure storage services” section, and they are the ones most study plans compress into a single table row each:
- Identify options for moving files, including AzCopy, Azure Storage Explorer, and Azure File Sync
- Describe migration options, including Azure Migrate and Azure Data Box
Our AZ-900 storage services guide does exactly that: a four-row table and one AzCopy command, because that post is about storage accounts, tiers and redundancy. This article is the deep dive those two bullets deserve. The exam does not ask you to run any of these tools, but it does ask scenario questions where the only way to pick the right answer is to know what each one is for, how big a job it handles, and what it is not for. “A company needs to move 400 TB from a datacenter with a 100 Mbps internet connection” is a different question from “an administrator wants a graphical tool to upload a few files”, and both are different again from “branch offices need the same file share with local performance”.
By the end you will be able to place every tool on two axes, data volume and online versus offline, and explain the one thing that makes each tool unique.
The Mental Model: Two Axes and One Question
Every data-movement question on AZ-900 reduces to a small decision tree:
- Is this about files and objects, or about whole workloads? Servers, databases and web apps are migration (Azure Migrate). Files, folders and blobs are data movement (everything else).
- Does the data go over the network, or does it travel in a box? Terabytes over a slow link take weeks; shipping a device takes days. That is the Data Box line.
- Is it a one-time copy or an ongoing relationship? A one-time copy is AzCopy or Storage Explorer. An ongoing relationship between on-premises file servers and Azure Files is Azure File Sync.
Hold that tree in your head and most of the questions answer themselves. The rest of this article fills in the details that distinguish near-miss answers.
| Tool | Category | Online or offline | Typical scale | One-liner |
|---|---|---|---|---|
| AzCopy | File/object movement | Online | GBs to many TBs, scriptable | Command-line copy and sync to Blob Storage and Azure Files |
| Azure Storage Explorer | File/object management | Online | Ad hoc, interactive | Desktop GUI for browsing and managing storage data |
| Azure File Sync | Hybrid file services | Online, continuous | Branch and file-server scale | Keeps Windows file servers in sync with an Azure file share, with cloud tiering |
| Azure Data Box | Offline bulk transfer | Offline (shipped device) | Tens of TBs to over 500 TB per device | Microsoft ships you an encrypted appliance; you fill it and ship it back |
| Azure Migrate | Workload migration | Online (appliance + replication) | Whole datacenters | Discover, assess and migrate servers, databases, web apps and VDI |
The two tools not in the skills outline but worth one paragraph each, Azure Import/Export and Azure Storage Mover, are covered near the end, because they show up as distractors.
AzCopy: The Command-Line Workhorse
AzCopy is a command-line utility for copying data to, from, or between Azure storage accounts. Version 10 is the only supported version and it runs on Windows, Linux and macOS as a single portable binary (Linux also has package-manager installs). There is nothing to deploy in Azure; you download it, authorize it, and point it at a URL.
What it moves
AzCopy works with Azure Blob Storage (block, page and append blobs, including Data Lake Storage Gen2 hierarchical namespaces) and Azure Files. It can copy between the two, for example from a blob container into a file share. It can also pull data into Azure from Amazon S3 and from Google Cloud Storage (the latter in preview), which is the detail that makes it the answer to “migrate objects from another cloud provider’s object storage to Blob Storage with a script”.
How it authenticates
Two options, and the exam likes the distinction:
- Microsoft Entra ID: run
azcopy loginonce (as a user, managed identity or service principal) and every subsequent command is authorized by Azure RBAC on the storage account. This is the recommended path and the one that fits “without embedding secrets in scripts”. - Shared access signature (SAS) tokens: append a SAS to the source or destination URL. No sign-in, but the token is a credential and has to be rotated.
A useful exam nuance: being the owner of a storage account at the management plane does not automatically grant data-plane access. AzCopy needs a data role such as Storage Blob Data Contributor, or a SAS.
The commands you should recognise
# Sign in once with Microsoft Entra ID
azcopy login
# Upload a local folder recursively into a container
azcopy copy "./exports" "https://contoso.blob.core.windows.net/backups" --recursive
# Mirror a local folder to a container (only changed files move)
azcopy sync "./site" "https://contoso.blob.core.windows.net/web-assets" --recursive
# Copy an entire container between two storage accounts, server-side
azcopy copy "https://src.blob.core.windows.net/data" \
"https://dst.blob.core.windows.net/data" --recursive
# Resume a job that was interrupted
azcopy jobs list
azcopy jobs resume <job-id>The commands worth memorising are copy, sync, list, make (create a container or share), remove and jobs. Two behaviours matter for scenario questions:
copyversussync:copymoves what you point it at;synccompares source and destination and transfers only what differs. “Keep a local folder mirrored to a container on a schedule” issync.- Resumable jobs: every transfer is a job with a plan file and a log. If a 2 TB upload drops at 1.9 TB,
azcopy jobs resumepicks it up. That is why AzCopy is the right answer for large scripted transfers and a desktop GUI is not.
One honest caveat straight from Microsoft’s own documentation: for migrations of more than about 1 TB, Microsoft now points you at Azure Storage Mover, a managed service that handles planning and monitoring at scale. AzCopy remains the tool for scripted and ad hoc transfers and is still the answer the AZ-900 skills outline names.
Azure Storage Explorer: The Graphical Alternative
Azure Storage Explorer is a free standalone desktop application for Windows, macOS and Linux that lets you browse and manage the data inside storage accounts visually: blob containers, file shares, queues, tables, Data Lake Storage containers and even managed disks. You can upload and download, create containers, set access tiers, edit metadata, generate SAS tokens, and connect to a local storage emulator (Azurite) for development.
How it connects
Storage Explorer offers two broad modes. Sign in to Azure shows every subscription and storage account your identity can see, which needs both management-plane and data-plane permissions. Attach to an individual resource connects to a single storage account, container, share, queue or table using Microsoft Entra ID, an account name and key, a SAS connection string, or a SAS URL. The second mode is what you use when someone gives you a SAS URL to one container and nothing else.
How it relates to AzCopy
Under the hood, Storage Explorer uses AzCopy for its larger blob transfers, so throughput is comparable. The difference is the interaction model, and that is what the exam tests:
| Need | Pick |
|---|---|
| Browse, inspect, fix a few blobs or files interactively | Storage Explorer |
| Scripted, scheduled, repeatable or very large transfers | AzCopy |
| Generate a SAS for a container without writing code | Storage Explorer |
| Resume a multi-terabyte interrupted upload from a CI pipeline | AzCopy |
If a question says “a user who is not comfortable with the command line” or “visually manage”, it is Storage Explorer. If it says “automate”, “script” or “pipeline”, it is AzCopy.
Azure File Sync: Hybrid File Servers, Not a Copy Tool
Azure File Sync is the one tool in this list that is not primarily about moving data once. It centralises an organisation’s file shares in Azure Files while keeping on-premises Windows Servers as fast local caches. Every registered server syncs with a central Azure file share, and because all servers sync through that share, changes made on one server appear on every other server without any direct server-to-server connectivity.
The moving parts
You deploy a Storage Sync Service resource in Azure, install the Azure File Sync agent on each Windows Server and register the server. Then you create a sync group that links one cloud endpoint (an Azure file share) with one or more server endpoints (a folder on a registered server). Files flow automatically between every endpoint in the group.
Cloud tiering: the feature the exam actually cares about
With cloud tiering enabled, only frequently accessed files are kept in full on the local disk. Cooler files are split: the namespace (the file and folder structure, names, attributes) stays on the server so users still see every file, but the content lives only in the Azure file share. When someone opens a tiered file it is recalled transparently. On disk a tiered file is a reparse point with size-on-disk of zero and the offline attribute set.
Two policies drive tiering:
- Volume free space policy: “always keep at least 20% of this volume free”, tiering the coolest files when space runs short.
- Date policy: “tier anything not accessed in 30 days”.
The result is a 2 TB file server presenting a 20 TB namespace. That is the scenario sentence to look for: “branch office with limited local storage needs access to the full corporate file share”.
What File Sync gives you beyond caching
- Multi-site sync: every office sees the same files, with local performance.
- Disaster recovery: if a server dies, install the agent on a new one and the namespace downloads from Azure.
- Cloud-side backup: back up the Azure file share with Azure Backup instead of each branch server.
- Migration path: Microsoft’s own guidance notes you can use File Sync purely as a zero-downtime migration tool to Azure Files and remove the server endpoint afterwards.
The exam trap is picking File Sync for a one-time blob upload, or picking AzCopy for “keep branch offices in sync”. File Sync is Windows Server plus Azure Files plus an ongoing relationship. AzCopy is a copy.
Azure Data Box: When the Network Is the Bottleneck
The Data Box family exists because physics wins. Pushing 100 TB over a 100 Mbps link takes roughly three months at full saturation, and nobody gets full saturation. Microsoft’s guidance is that Data Box suits transfers larger than about 40 TB where network connectivity is limited or absent, and the Data Box Disk option covers smaller offline jobs.
How a Data Box order works
Every device follows the same five steps, which are worth knowing because the exam sometimes describes the workflow rather than naming the product:
- Order in the Azure portal, choosing the destination storage account and shipping details.
- Receive the device, cable it, and configure it through a local web UI.
- Copy data to the device’s shares over SMB or NFS from your servers.
- Return the device to the Azure datacenter via the regional carrier.
- Upload happens automatically into your storage account, after which the device is wiped to NIST 800-88r1 standards.
Data on every device is encrypted at rest (AES 256-bit on the appliances, BitLocker AES 128-bit or hardware encryption on the disks), the device unlocks only with a key from the portal, and the whole job is tracked in the portal with email notifications at each status change.
The family today
The line-up changed in 2025, and older study notes are wrong about it:
| Device | Usable capacity | Form factor | Import / export | Notes |
|---|---|---|---|---|
| Data Box Disk | Up to 5 disks x 8 TB, about 35 TB usable per order | 2.5-inch SSDs, USB 3 (or SATA for hardware-encrypted drives) | Import only | Smallest offline option; drag-and-drop copy from a laptop or server |
| Data Box (80 TB) | 80 TB | Ruggedised appliance, 1/10 GbE | Import and export | Being retired region by region as next-gen devices roll out |
| Data Box next-gen 120 | 120 TB | Ruggedised appliance, 2 x 100 GbE + 10 GbE | Import and export | NVMe, up to about 7 GB/s with SMB Direct over RDMA |
| Data Box next-gen 525 | 525 TB | Same chassis class | Import and export | Largest single device |
| Data Box Heavy | Formerly 1 PB | Pallet-sized | Retired | No longer orderable; do not pick it as a current answer |
Three facts separate right answers from wrong ones:
- Data Box Disk is import only. If the scenario says “export a large dataset out of Azure to on-premises for disaster recovery or regulatory reasons”, the answer is the Data Box appliance, not Data Box Disk.
- Data Box is not a network connectivity service. ExpressRoute is a private circuit; Data Box is a shipped device. A question that lists both is testing whether you know the difference.
- Data Box can be a seed. A very common real pattern, and a common exam scenario, is an initial bulk transfer by Data Box followed by incremental transfers over the network with AzCopy, File Sync or Storage Mover.
Data Box also integrates with other services. Azure File Sync can replicate data landed by a Data Box into an Azure file share, Azure Backup can ingest large initial backups shipped offline, and the Azure Migrate hub lists Data Box as its answer for large-scale offline data migration.
Azure Migrate: Workloads, Not Files
Azure Migrate is a free, unified hub in the Azure portal for planning and executing the migration of servers (VMware, Hyper-V, physical, and VMs on other clouds), databases (SQL Server to Azure SQL Database, SQL Managed Instance or SQL Server on Azure VMs), web apps (to App Service or AKS) and virtual desktops, plus large-scale offline data via Data Box. It is the only tool in this article that reasons about workloads rather than bytes.
The three phases
Microsoft describes the journey as decide, plan, execute, and most study material calls the same thing discover, assess, migrate:
- Discover. You deploy the lightweight Azure Migrate appliance as a VM in your datacenter. It inventories your servers and continuously streams configuration and performance data to Azure. For air-gapped or restricted networks there is an Azure Migrate Collector that takes a point-in-time snapshot without continuous connectivity, and you can also import inventory from a CSV.
- Assess. Assessments report Azure readiness (will this server run in Azure and what blocks it), right-sizing (which VM SKU or SQL configuration), cost estimation, and dependency analysis, which maps the network conversations between servers so that you migrate an application’s tiers together. Azure Migrate can also produce a business case: total cost of ownership on-premises versus Azure, cash-flow comparison and the CapEx-to-OpEx shift, which ties straight back to the cloud-concepts domain covered in our cloud concepts guide.
- Migrate. The integrated Migration and Modernization tool replicates servers to Azure. VMware migrations can be agentless (the same appliance does discovery and replication) or agent-based (a replication appliance plus agents on each server). Hyper-V uses provider agents on the hosts; physical servers and other-cloud VMs use the agent-based replication appliance. Databases go through Azure Database Migration Service, and ASP.NET web apps can be moved agentlessly to App Service.
How Azure Migrate differs from everything else here
| Question | Azure Migrate? |
|---|---|
| ”Assess 300 VMware VMs for Azure readiness and estimated monthly cost” | Yes, assessment |
| ”Understand which servers talk to each other before moving an app” | Yes, dependency analysis |
| ”Move a SQL Server database to Azure SQL Managed Instance” | Yes, database migration tooling |
| ”Copy 5 TB of archive files into a blob container” | No, AzCopy or Storage Mover |
| ”Ship 300 TB from a site with poor connectivity” | No, Data Box (though Migrate’s hub links to it) |
If the question mentions assessment, readiness, dependency mapping, TCO comparison or replicating servers, it is Azure Migrate. If it only mentions files, it is not.
Two Distractors Worth Knowing: Import/Export and Storage Mover
Neither of these is named in the skills outline, but both appear in answer lists.
Azure Import/Export is the older offline service where you supply the drives: you prepare SSDs or HDDs with the WAImportExport tool (BitLocker-encrypted), ship up to 10 drives per job to an Azure datacenter, and Microsoft imports them into Blob Storage or Azure Files, or exports blobs onto your empty drives. Import/Export jobs are now created under the Data Box resource in the portal. The distinction to remember: Data Box means Microsoft-supplied devices; Import/Export means customer-supplied drives.
Azure Storage Mover is a fully managed migration service for files and folders from SMB and NFS shares (and from S3 buckets) into Azure Files and Blob Storage. You run a small agent VM near the source, define projects and job definitions in the portal, and the service orchestrates and reports. Microsoft positions it as the tool for migrations above roughly 1 TB and as the ideal “online catch-up” partner after a Data Box seed, because it transfers only the delta. On AZ-900, if Storage Mover appears alongside AzCopy, the sentence that favours Storage Mover is “managed”, “many shares across many sites”, or “minimal downtime cutover”.
Putting It All Together: The Decision Table
| Scenario | Correct tool | Why not the others |
|---|---|---|
| Upload a 50 GB folder to Blob Storage from a build server every night | AzCopy (sync) | Storage Explorer is interactive; File Sync needs Windows Server and Azure Files |
| An analyst wants to browse containers and download a few files | Storage Explorer | No scripting needed |
| 500 TB of video archives, 200 Mbps uplink, needed in Azure within two weeks | Data Box next-gen 525 | Network transfer would take months; Data Box Disk is too small |
| 20 TB from a remote site with a laptop and no datacenter rack | Data Box Disk | Appliance is overkill; disks ship in a small box and connect over USB |
| Export 100 TB from Azure to on-premises for a regulator | Data Box appliance | Data Box Disk is import only |
| Twelve branch offices need the same share with local performance and small local disks | Azure File Sync with cloud tiering | AzCopy copies; it does not keep anything in sync |
| Decide which of 400 on-premises VMs can move to Azure and what it will cost | Azure Migrate | Every other tool moves bytes, not workloads |
| Map dependencies between app and database servers before migrating | Azure Migrate dependency analysis | Nothing else does this |
| Copy objects from an S3 bucket into Blob Storage with a script | AzCopy | Data Box cannot read from another cloud |
| Customer already owns 8 encrypted drives and wants to ship them | Azure Import/Export | Data Box uses Microsoft-supplied devices |
| Initial 300 TB seed offline, then keep the shares updated until cutover | Data Box, then Storage Mover (or AzCopy) for the delta | A single tool rarely covers both halves |
If you can reproduce this table from memory the day before the exam, these two skills-outline bullets are done. The questions are rarely tricky; they are just easy to get wrong if you only know the tool names.
Common Mistakes to Avoid
- Treating Data Box as connectivity. It ships. ExpressRoute and VPN Gateway connect; see our AZ-900 networking guide for those.
- Choosing Data Box Disk for an export. Disks are import only. Exports require the appliance.
- Picking Data Box Heavy. It is retired. Current answers are Data Box Disk, Data Box, and the next-gen 120 TB and 525 TB devices.
- Confusing Azure Migrate with a file-copy tool. Migrate assesses and moves servers, databases, web apps and desktops. It links to Data Box for data but does not copy files itself.
- Picking File Sync for a one-time upload. File Sync is a hybrid, continuous relationship between Windows Server and Azure Files, with cloud tiering as its signature feature.
- Assuming the storage account owner can run AzCopy immediately. Management-plane ownership is not data-plane access; grant a data role or use a SAS.
- Forgetting
syncexists. “Only transfer what changed” isazcopy sync, notazcopy copy.
How to Lock This In Before Exam Day
Build a two-column table in your notes: the left column is the trigger phrase from a question (“limited bandwidth”, “interactive”, “branch offices”, “assess readiness”, “export from Azure”, “another cloud’s object storage”), and the right column is the tool. Then run the scenarios above against it without looking. If you have an Azure subscription, the highest-value fifteen minutes is installing Storage Explorer, generating a SAS for one container, and using that SAS with azcopy copy from the command line; seeing the same container through both tools makes the GUI-versus-CLI distinction permanent.
Finally, test yourself under exam conditions. Our free AZ-900 practice questions include storage-movement items, and the AZ-900 mock exam bundle drills these scenario patterns alongside every other objective in the outline, with explanations for each distractor so that you learn why Data Box Disk is wrong for an export rather than merely that it is. If you are following our 30-day AZ-900 study plan, this topic belongs in the storage week, right after storage tiers and redundancy, and the full objective map is in the AZ-900 exam guide.
Conclusion
The AZ-900 data-movement objectives are not about tooling depth; they are about placing five services correctly. AzCopy is the scriptable command-line copier and synchroniser for Blob Storage and Azure Files, with Entra ID or SAS authorization and resumable jobs. Azure Storage Explorer is the cross-platform desktop GUI for the same data. Azure File Sync turns Windows Servers into caches of an Azure file share, with cloud tiering, multi-site sync and cloud-side backup. Azure Data Box ships encrypted devices, from 35 TB disks to 525 TB appliances, for imports and exports when the network cannot cope. Azure Migrate discovers, assesses and migrates whole workloads, and hands bulk data to Data Box. Learn the axes, learn the one distinguishing fact per tool, and the scenario questions become pattern matching.
Frequently Asked Questions
Does AZ-900 expect me to know AzCopy commands?
No command syntax is required. You should know that AzCopy is a cross-platform command-line tool for copying and synchronising data to Blob Storage and Azure Files, that it supports Microsoft Entra ID sign-in and SAS tokens, and that it suits scripting and large, resumable transfers. Recognising copy versus sync is a bonus, not a requirement.
What is the difference between Azure Data Box and Azure Data Box Disk?
Data Box Disk is an order of one to five 8 TB SSDs (about 35 TB usable) that connect over USB, for import only. Data Box is a ruggedised appliance, now available as next-gen 120 TB and 525 TB devices, that connects to your network over high-speed Ethernet and supports both import and export. Data Box Heavy has been retired.
Is Azure Migrate free?
Yes. Azure Migrate itself is a free service for discovery, assessment, business-case analysis and migration using the integrated Microsoft tools. Partner tools surfaced in the hub may charge their own fees, and you pay for the Azure resources you create.
When should I use Azure File Sync instead of simply migrating to Azure Files?
Use File Sync when users still need local, low-latency access from on-premises Windows Servers, when multiple sites need the same namespace, or when local disks are too small for the whole share and cloud tiering can hold the cold data in Azure. If every user can work directly against the Azure file share, you may not need File Sync at all, though Microsoft notes you can still use it as a zero-downtime migration tool and remove the server endpoint afterwards.
Can Azure Storage Explorer move very large datasets?
It can, and it uses AzCopy under the hood for blob transfers, but it is an interactive desktop application. For multi-terabyte, scheduled or automated jobs, AzCopy or Azure Storage Mover are the better fit, and for tens or hundreds of terabytes over a slow link, Data Box is.
Where do Azure Import/Export and Azure Storage Mover fit if they are not in the skills outline?
They appear as distractors. Import/Export is the offline option using drives you supply (prepared with the WAImportExport tool, up to 10 per job), now managed under the Data Box resource. Storage Mover is a managed online migration service for SMB, NFS and S3 sources that Microsoft recommends for migrations above about 1 TB and as the online catch-up step after a Data Box seed.
How does this topic connect to the rest of the AZ-900 storage objectives?
Every destination here is a storage account: Blob Storage for AzCopy, Storage Explorer, Data Box and Import/Export; Azure Files for File Sync, AzCopy and Storage Mover. Understanding storage account types, access tiers and redundancy from our storage services guide tells you where the data lands; this article tells you how it gets there. The governance side, such as tagging migrated resources and controlling costs, is in the management and governance guide, and the next step after AZ-900 for anyone who will actually run these tools is the AZ-104 exam guide.