Storage accounts — kinds, SKUs and redundancy, names and endpoints, TLS, hierarchical namespace, tiers and lifecycle
What to choose when creating a storage account and what can't change later — kinds and the October 2026 GPv1 and legacy Blob retirement, SKUs and the CLI's RA-GRS default, changing redundancy, names, endpoints and the 2027 DNS-zone endpoint retirement, TLS 1.2 enforcement since February 2026, the one-way hierarchical namespace upgrade, access tiers, smart tier, lifecycle timing, and which limits are fixed.
markdownreferencev1NRJE-DTGQstage: designtrust: officialservice: storageinterface: iacinterface: clistorage account kind StorageV2general-purpose v1 retirement October 2026legacy BlobStorage account retirementkind StorageBlockBlobStorageFileStorageStandard_LRSStandard_ZRSStandard_GZRSStandard_RAGRS default CLIPremiumV2_LRSStandardV2_LRSprovisioned v2change redundancy conversionstorage account name rules3 to 24 lowercase letters and numbersStorageAccountAlreadyTakenblob.core.windows.netdfs.core.windows.netAzure DNS zone endpoints retirement March 2027dnsEndpointType AzureDNSZoneminimumTlsVersion TLS1_2TLS 1.0 1.1 retired February 3 2026isHnsEnabledupgrade to Data Lake one-wayaccess tier hot cool cold archiveearly deletion 30 90 180 daysrehydrate 15 hourssmart tierlifecycle management 24 hours
Storage accounts — kinds, SKUs, names, endpoints, TLS, tiers
Kind and SKU
| Kind | Use | SKUs |
|---|---|---|
StorageV2 (general-purpose v2) | The default for everything: Blob, Data Lake, Queue, Table, Files | Standard_LRS, Standard_ZRS, Standard_GRS, Standard_RAGRS, Standard_GZRS, Standard_RAGZRS |
BlockBlobStorage | Premium block and append blobs (low latency, high transaction rate) | Premium_LRS, Premium_ZRS |
FileStorage | Premium file shares, and provisioned v2 file shares | Premium_LRS, Premium_ZRS; PremiumV2_LRS/_ZRS (SSD) and StandardV2_LRS/_ZRS/_GRS/_GZRS (HDD) |
Storage (GPv1), BlobStorage (legacy) | Retired. Creation disabled September 2026; full retirement October 2026, with remaining accounts migrated to GPv2 by Microsoft (and billed as GPv2) | — |
- Find remaining legacy accounts: in Azure Resource Graph,
resources | where type == "microsoft.storage/storageaccounts" | where kind != "StorageV2"(also returns premium kinds; filter bykind in ("Storage","BlobStorage")). az storage account createdefaults to--sku Standard_RAGRS, a geo-redundant SKU with read access to the secondary. In templatessku,kindandlocationare all required.- ZRS, GZRS and RA-GZRS aren't available in every region. Read live:
az storage sku list --query "[?name=='Standard_ZRS'].locations" -o tsv.
Changing redundancy later: geo-redundancy and read access change in place; adding or removing zone redundancy is a conversion (no downtime from the portal) or a manual migration, done as a separate step. An account with archived blobs must rehydrate them first.
Names and endpoints
- 3–24 characters, lowercase letters and numbers only, unique across Azure. A taken name fails at create (ARM:
reference/arm/errors.md). Check:az storage account check-name -n <name>. - Standard endpoints:
https://<acct>.blob.core.windows.net,.dfs.(Data Lake),.file.,.queue.,.table.,.web.(static website). Build them from the account name; with private endpoints the same names resolve privately. - Azure DNS zone endpoints (
dnsEndpointType: AzureDNSZone, preview) put endpoints in a dynamically chosen zone, so code must read the endpoint from the account's properties. They enter retirement in March 2027; use standard endpoints for new accounts.
TLS and transport
- TLS 1.0 and 1.1 stopped working on February 3, 2026, enforced per account, so Files, Queue and Table on that account need TLS 1.2 too. A client below the minimum gets 400 naming the TLS version.
- The REST spec still says
minimumTlsVersion's "default interpretation is TLS 1.0". SetminimumTlsVersion: 'TLS1_2'explicitly;TLS1_3can't be set as the minimum yet (TLS 1.3 connections are accepted). supportsHttpsTrafficOnly(secure transfer) defaults to true; keep it, except for NFS shares secured by the network.
Hierarchical namespace (ADLS Gen2)
isHnsEnabled: true at create gives directories, atomic renames and POSIX ACLs. Upgrading an existing account is one-way: there's no revert. Some Blob features and APIs differ on HNS accounts: reference/storage/adls-gen2.md.
Access tiers and lifecycle
| Tier | Minimum retention (early deletion charge before it) | Read |
|---|---|---|
| Hot | — | Online |
| Cool | 30 days | Online |
| Cold | 90 days | Online |
| Archive | 180 days | Offline: rehydrate first (up to 15 hours), by Copy Blob (recommended) or Set Blob Tier |
- The account's default tier (
accessTier) isHot,Cool,Cold,Premiumor, in the 2026-06-01 API,Smart. Smart tier moves blobs between hot, cool and cold on its own, on GPv2 accounts only; it adds dependencies to redundancy conversions and failover. - Lifecycle management: a new or changed policy takes up to 24 hours to take effect and start its first run. It can't rehydrate from archive.
- Moving to a cooler tier is instant; any rewrite (Put Blob, Put Block List, Copy Blob) inside the minimum period also incurs the early-deletion charge.
Limits: fixed vs adjustable
Fixed: 400 IP rules, 400 VNet rules, 200 resource instance rules per account; 50,000 committed blocks per blob. Adjustable (never typed here): accounts per region per subscription, request rate, ingress and egress per account, capacity. They vary by region and grow on request through Support; read them on the scalability targets page.
Soft delete, versioning, point-in-time restore, immutability and object replication: reference/storage/blob-data-protection.md.