Storage Accounts, Tiers and Redundancy

One account, four services

An Azure storage account provides Blob storage (objects such as images, backups and data-lake files), Azure Files (SMB/NFS file shares), Queue storage (simple message queues) and Table storage (a key-value store). Blobs have access tiers: Hot for frequent access, Cool and Cold for less frequent access at lower storage cost but higher read cost and minimum retention periods, and Archive, which is offline and must be rehydrated (taking hours) before reading. Lifecycle management rules move blobs between tiers automatically. Redundancy decides how many copies exist and where: LRS (three copies in one datacentre), ZRS (across three zones), GRS (LRS plus an asynchronous copy in the paired region), GZRS (ZRS plus the secondary region), with RA- variants that allow reads from the secondary.

Copies across zones and regions

Each redundancy option adds copies further away: inside a datacentre, across zones, then to a second region.

A lifecycle policy that ages logs to cheaper tiers

Saved as policy.json and applied with az storage account management-policy create.

{
  "rules": [
    {
      "name": "age-logs",
      "enabled": true,
      "type": "Lifecycle",
      "definition": {
        "filters": { "blobTypes": ["blockBlob"], "prefixMatch": ["logs/"] },
        "actions": {
          "baseBlob": {
            "tierToCool":    { "daysAfterModificationGreaterThan": 30 },
            "tierToArchive": { "daysAfterModificationGreaterThan": 180 },
            "delete":        { "daysAfterModificationGreaterThan": 730 }
          }
        }
      }
    }
  ]
}

Keep blobs private

Disable anonymous blob access on the account and share files with user delegation SAS tokens (signed with Entra credentials and short-lived) or through a CDN with private origin access. Long-lived account-key SAS URLs pasted into chats are a common leak.

Quick check: A storage account must survive the loss of one availability zone but data must stay in one region. Which redundancy option fits?

• ZRS
• LRS
• GRS
• RA-GRS