--- cuppy_hub: azure cuppy_path: reference/storage/accounts-and-redundancy.md cuppy_section: docs cuppy_doc: NRJE-DTGQ cuppy_doc_uuid: 92d5ea9f-1f3b-43b7-a7f0-66bdf5c11d4e cuppy_permalink: https://cuppy.io/azure/d/NRJE-DTGQ cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/storage/accounts-and-redundancy cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: bfc8985b2fe79d4aeb233ad69d6f40de60bd79717193f880ecb76ada2dab548d # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Storage accounts — kinds, SKUs, names, endpoints, TLS, tiers ## Kind and SKU | Kind | Use | SKUs | |---|---|---| | `StorageV2` (general-purpose v2) | **The default for everything**: Blob, Data Lake, Queue, Table, Files | `Standard_LRS`, `Standard_ZRS`, `Standard_GRS`, `Standard_RAGRS`, `Standard_GZRS`, `Standard_RAGZRS` | | `BlockBlobStorage` | Premium block and append blobs (low latency, high transaction rate) | `Premium_LRS`, `Premium_ZRS` | | `FileStorage` | Premium file shares, and **provisioned v2** file shares | `Premium_LRS`, `Premium_ZRS`; `PremiumV2_LRS`/`_ZRS` (SSD) and `StandardV2_LRS`/`_ZRS`/`_GRS`/`_GZRS` (HDD) | | `Storage` (GPv1), `BlobStorage` (legacy) | **Retired.** Creation disabled September 2026; full retirement October 2026, with remaining accounts migrated to GPv2 by Microsoft (and billed as GPv2) | — | - Find remaining legacy accounts: in Azure Resource Graph, `resources | where type == "microsoft.storage/storageaccounts" | where kind != "StorageV2"` (also returns premium kinds; filter by `kind in ("Storage","BlobStorage")`). - **`az storage account create` defaults to `--sku Standard_RAGRS`**, a geo-redundant SKU with read access to the secondary. In templates `sku`, `kind` and `location` are all required. - ZRS, GZRS and RA-GZRS aren't available in every region. Read live: `az storage sku list --query "[?name=='Standard_ZRS'].locations" -o tsv`. **Changing redundancy later:** geo-redundancy and read access change in place; adding or removing **zone** redundancy is a **conversion** (no downtime from the portal) or a manual migration, done as a separate step. An account with archived blobs must rehydrate them first. ## Names and endpoints - **3–24 characters, lowercase letters and numbers only, unique across Azure.** A taken name fails at create (ARM: `reference/arm/errors.md`). Check: `az storage account check-name -n `. - Standard endpoints: `https://.blob.core.windows.net`, `.dfs.` (Data Lake), `.file.`, `.queue.`, `.table.`, `.web.` (static website). Build them from the account name; with private endpoints the same names resolve privately. - **Azure DNS zone endpoints** (`dnsEndpointType: AzureDNSZone`, preview) put endpoints in a dynamically chosen zone, so code must read the endpoint from the account's properties. They **enter retirement in March 2027**; use standard endpoints for new accounts. ## TLS and transport - **TLS 1.0 and 1.1 stopped working on February 3, 2026**, enforced per account, so Files, Queue and Table on that account need TLS 1.2 too. A client below the minimum gets **400** naming the TLS version. - The REST spec still says `minimumTlsVersion`'s "default interpretation is TLS 1.0". Set `minimumTlsVersion: 'TLS1_2'` explicitly; `TLS1_3` can't be set as the minimum yet (TLS 1.3 connections are accepted). - `supportsHttpsTrafficOnly` (secure transfer) defaults to true; keep it, except for NFS shares secured by the network. ## Hierarchical namespace (ADLS Gen2) `isHnsEnabled: true` at create gives directories, atomic renames and POSIX ACLs. Upgrading an existing account is **one-way**: there's no revert. Some Blob features and APIs differ on HNS accounts: `reference/storage/adls-gen2.md`. ## Access tiers and lifecycle | Tier | Minimum retention (early deletion charge before it) | Read | |---|---|---| | Hot | — | Online | | Cool | 30 days | Online | | Cold | 90 days | Online | | Archive | 180 days | **Offline**: rehydrate first (up to 15 hours), by Copy Blob (recommended) or Set Blob Tier | - The account's default tier (`accessTier`) is `Hot`, `Cool`, `Cold`, `Premium` or, in the 2026-06-01 API, **`Smart`**. Smart tier moves blobs between hot, cool and cold on its own, on GPv2 accounts only; it adds dependencies to redundancy conversions and failover. - **Lifecycle management:** a new or changed policy takes **up to 24 hours** to take effect and start its first run. It can't rehydrate from archive. - Moving to a cooler tier is instant; any rewrite (Put Blob, Put Block List, Copy Blob) inside the minimum period also incurs the early-deletion charge. ## Limits: fixed vs adjustable Fixed: 400 IP rules, 400 VNet rules, 200 resource instance rules per account; 50,000 committed blocks per blob. **Adjustable (never typed here):** accounts per region per subscription, request rate, ingress and egress per account, capacity. They vary by region and grow on request through Support; read them on the scalability targets page. Soft delete, versioning, point-in-time restore, immutability and object replication: `reference/storage/blob-data-protection.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.