Move Portal Content Directory to Azure Blob Storage container

danbecker

We have Enterprise 12.1 installed on separate VMs in Azure. The Portal VM has a managed disk (Premium SSD) for the content, db, index and temp folders. 

We're looking to migrate the Portal content directory to an Azure Blob storage container (Standard performance tier). Why?

• This would save cost
• Give us must more storage capacity.
  • Every time we upgrade Portal, we have to increase the managed disk size to accommodate 2.5 times the storage space as is currently being used.
  • Then after the upgrade, who wants to go through the process of decreasing the size of the managed disk, copying over all data to new disk, detaching, ect. It's a pain, so the end result is constantly paying more for allocated disk space. 

Anyway, can we follow these steps to migrate the content from managed disk to blob container? 

https://doc.esri.com/en/arcgis-enterprise/latest/administer/changing-the-portal-content-directory.html?pivots=os-windows

Basically, copy /content directory into our new storage container, then edit the path for content directory to this JSON format. 

{
 "type": "cloudStore",
 "provider": "Azure",
 "connectionString": {
   "accountName": "saexample",
   "accountEndpoint": "blob.core.usgovcloudapi.net",
   "accountKey": "abc123%%^key~",
   "credentialType": "accessKey"
 },
 "objectStore": "https://saexample.blob.core.usgovcloudapi.net/portalcontainer"
}

 

Questions about that JSON string: 

1) is objectStore correct (refers to the URL of the portal content blob storage container)? Or, does this actually refer to the URL we have registered as an object store in Server Manager, for cache query storage?

2) Can we use an azure private endpoint connection for this blob storage container?  

 

thanks!

 

 

ArchitSrivastava

Hello @danbecker .

I have not done this exact migration in Azure recently, but based on the Enterprise documentation, your approach looks generally aligned with the workflow Esri describes for changing the Portal content directory to a cloud store.

A few things I would be careful about:

1. The "objectStore" value should point to the Azure Blob container that will be used for the Portal content directory. In your case, the format seems to be along these lines:

{
  "type": "cloudStore",
  "provider": "Azure",
  "connectionString": {
    "accountName": "saexample",
    "accountEndpoint": "blob.core.usgovcloudapi.net",
    "accountKey": "<key>",
    "credentialType": "accessKey"
  },
  "objectStore": "https://saexample.blob.core.usgovcloudapi.net/portalcontainer"
}

1. I would only move the Portal content directory using this approach. The other Portal directories, such as db, index, and temp, should remain local to the Portal machine.

2. For the private endpoint question, I would expect this to work as long as the Portal VM can resolve and reach the Blob endpoint privately, and the storage firewall, private endpoint, and private DNS configuration are all set correctly.

   I would pay close attention to:

   • DNS resolution for the storage account
   • Outbound access from the Portal VM
   • Storage firewall rules
   • Private endpoint configuration
   • Private DNS zone configuration
   • Whether the endpoint in the JSON matches the Azure cloud environment you are using, especially since your example uses the US Gov endpoint
3. Before making the change, I would still take a full WebGIS DR backup and test the workflow in a lower environment if possible.

For validation, I would split the checks into before and after the move.

Before changing the Portal content directory, I would check:

• The Portal VM can resolve the storage account endpoint through DNS
• If using a private endpoint, the storage account resolves to the private IP
• The Portal VM can reach the Blob endpoint over HTTPS
• The storage firewall allows access from the Portal VM or subnet
• The access key or credential being used is valid
• The Blob container exists
• The objectStore path points to the correct Blob container
• There are no proxy, firewall, or Network Security Group (NSG) rules blocking outbound communication
• The endpoint matches the correct Azure cloud environment, especially for US Gov cloud
• A full WebGIS DR backup is available before making the change

After changing the Portal content directory, I would check:

• Portal starts normally
• Portal logs do not show content directory or cloud store access errors
• Existing item thumbnails load correctly
• Uploaded files and documents open and download correctly
• Hosted layer item pages open as expected
• Attachments still open from existing items or layers
• StoryMaps, dashboards, and Experience Builder apps load correctly
• Map packages, layer packages, and other downloadable items still download correctly
• New item uploads work
• New hosted layer publishing works
• Editing or adding attachments to a hosted feature layer works
• Portal is reading from and writing to the new Blob-based content directory as expected

The main thing I would validate is not just whether Portal starts after the change, but whether existing content, new uploads, downloads, thumbnails, attachments, and application dependencies continue to work normally afterward.

Hope it helps!