Azure hub — Storage family (2026-10-20)

What's in it

12 documents including this note, bringing the hub to 47:

• Error catalogues: reference/storage/access-errors.md (401, 403, 409 for Entra ID callers and at the TLS, network and account gates), reference/storage/sas-and-key-errors.md (Shared Key and SAS) and reference/storage/data-errors.md (404, 409, 412, 416, 503 after authorization, including the Data Lake codes).
• References: access models; SAS; network access and private endpoints; accounts, SKUs, endpoints, TLS and tiers; ADLS Gen2 authorization and API differences.
• Guides: reading and writing Blob and Data Lake storage from TypeScript with Entra ID; creating a keyless, firewalled account in Bicep or the CLI.
• Pattern: an app to Blob Storage with a managed identity.

2026 changes captured

• TLS 1.0 and 1.1 ended on February 3, 2026, per account (Files, Queue and Table too). The 2026-06-01 REST spec still calls TLS 1.0 the default for minimumTlsVersion, so examples set TLS1_2.
• General-purpose v1 and legacy Blob Storage accounts can't be created since September 2026 and retire in October 2026, with remaining accounts migrated to GPv2.
• Azure DNS zone endpoints (preview) enter retirement in March 2027.
• API 2026-06-01 adds per-service shared key settings (allowSharedKeyAccessForServices), user-bound user delegation SAS requirements (requireUserBoundUserDelegationSas), the Smart access tier and SecuredByPerimeter public network access. Storage 2026-09-01 exists in the specs but has no Bicep 0.48.1 types.
• User delegation SAS beyond Blob: Queue, Table and File Delegator roles, and getUserDelegationKey in @azure/storage-queue 12.32.0 and @azure/storage-file-share 12.33.0. User-bound SAS (delegatedUserObjectId) from service version 2025-07-05.
• Azure CLI 2.91 defaults az storage account create to Standard_RAGRS and has no flag for defaultToOAuthAuthentication.

How it was verified

• Sources were read from azure-docs@dd032389 (storage, RBAC built-in roles, Files billing) and azure-rest-api-specs@c783b658 (storage resource manager 2026-06-01 and data-plane specs). Microsoft's REST error-code tables and its 403 troubleshooting page, which have no public repository in this checkout, were read from Learn.
• SDK behaviour came from the installed packages' code: @azure/storage-blob 12.34.0 reads e.details?.errorCode (the x-ms-error-code header), @azure/core-client 1.11.1 sets error.code from the XML body, and @azure/storage-common retries 500, 503 and network errors with 4 tries by default.
• The Bicep example compiles and lints clean with Bicep 0.48.1, and its .bicepparam builds. Every TypeScript block type-checks under tsc --strict. Every az command was checked against Azure CLI 2.91.0 help.

Learn contradictions recorded

• The same page gives role propagation as both "up to 10 minutes" and "up to 30 minutes".
• The shared-key page labels user delegation SAS "Blob Storage only"; the SAS overview, the delegator roles and the SDKs support Queue, Table and Files. The documents say to test before relying on it.
• The troubleshooting page uses "isn't" where the service returns "is not"; both wordings are indexed.

Known gaps

• allowSharedKeyAccessForServices is in the spec but not documented on Learn; its interaction with allowSharedKeyAccess isn't tested.
• No message text is published for AuthorizationResourceTypeMismatch, AuthorizationSourceIPMismatch and AuthorizationProtocolMismatch; their rows are the hub's reading of the SAS fields.
• Azure Files identity-based SMB access (Kerberos, Entra Kerberos) and NFS, Table storage design, and object replication aren't covered yet. Storage queues are covered with messaging (family 8); private DNS diagnosis with networking (family 5).