--- cuppy_hub: azure cuppy_path: changelog/2026-10-20-storage-family.md cuppy_section: docs cuppy_doc: 6Z06-4ZAQ cuppy_doc_uuid: a752f251-8d32-4427-98b3-b0bfb0f5ab78 cuppy_permalink: https://cuppy.io/azure/d/6Z06-4ZAQ cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/changelog/2026-10-20-storage-family cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 7d0436b7626e36cd45bfe214ec564b71a3f7e2ea989654c2fc1ffa5125c39cd8 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Azure hub — Storage family (2026-10-20) ## What's in it 12 documents including this note, bringing the hub to 47: - **Error catalogues:** `reference/storage/access-errors.md` (401, 403, 409 for Entra ID callers and at the TLS, network and account gates), `reference/storage/sas-and-key-errors.md` (Shared Key and SAS) and `reference/storage/data-errors.md` (404, 409, 412, 416, 503 after authorization, including the Data Lake codes). - **References:** access models; SAS; network access and private endpoints; accounts, SKUs, endpoints, TLS and tiers; ADLS Gen2 authorization and API differences. - **Guides:** reading and writing Blob and Data Lake storage from TypeScript with Entra ID; creating a keyless, firewalled account in Bicep or the CLI. - **Pattern:** an app to Blob Storage with a managed identity. ## 2026 changes captured - **TLS 1.0 and 1.1 ended on February 3, 2026**, per account (Files, Queue and Table too). The 2026-06-01 REST spec still calls TLS 1.0 the default for `minimumTlsVersion`, so examples set `TLS1_2`. - **General-purpose v1 and legacy Blob Storage accounts** can't be created since September 2026 and retire in October 2026, with remaining accounts migrated to GPv2. - **Azure DNS zone endpoints** (preview) enter retirement in March 2027. - **API 2026-06-01** adds per-service shared key settings (`allowSharedKeyAccessForServices`), user-bound user delegation SAS requirements (`requireUserBoundUserDelegationSas`), the `Smart` access tier and `SecuredByPerimeter` public network access. Storage `2026-09-01` exists in the specs but has no Bicep 0.48.1 types. - **User delegation SAS beyond Blob:** Queue, Table and File Delegator roles, and `getUserDelegationKey` in `@azure/storage-queue` 12.32.0 and `@azure/storage-file-share` 12.33.0. User-bound SAS (`delegatedUserObjectId`) from service version 2025-07-05. - **Azure CLI 2.91** defaults `az storage account create` to `Standard_RAGRS` and has no flag for `defaultToOAuthAuthentication`. ## How it was verified - Sources were read from `azure-docs@dd032389` (storage, RBAC built-in roles, Files billing) and `azure-rest-api-specs@c783b658` (storage resource manager 2026-06-01 and data-plane specs). Microsoft's REST error-code tables and its 403 troubleshooting page, which have no public repository in this checkout, were read from Learn. - SDK behaviour came from the installed packages' code: `@azure/storage-blob` 12.34.0 reads `e.details?.errorCode` (the `x-ms-error-code` header), `@azure/core-client` 1.11.1 sets `error.code` from the XML body, and `@azure/storage-common` retries 500, 503 and network errors with 4 tries by default. - The Bicep example compiles and lints clean with Bicep 0.48.1, and its `.bicepparam` builds. Every TypeScript block type-checks under `tsc --strict`. Every `az` command was checked against Azure CLI 2.91.0 help. ## Learn contradictions recorded - The same page gives role propagation as both "up to 10 minutes" and "up to 30 minutes". - The shared-key page labels user delegation SAS "Blob Storage only"; the SAS overview, the delegator roles and the SDKs support Queue, Table and Files. The documents say to test before relying on it. - The troubleshooting page uses "isn't" where the service returns "is not"; both wordings are indexed. ## Known gaps - `allowSharedKeyAccessForServices` is in the spec but not documented on Learn; its interaction with `allowSharedKeyAccess` isn't tested. - No message text is published for `AuthorizationResourceTypeMismatch`, `AuthorizationSourceIPMismatch` and `AuthorizationProtocolMismatch`; their rows are the hub's reading of the SAS fields. - Azure Files identity-based SMB access (Kerberos, Entra Kerberos) and NFS, Table storage design, and object replication aren't covered yet. Storage queues are covered with messaging (family 8); private DNS diagnosis with networking (family 5). --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.