Storage Accounts & Redundancy | Guided by A Guide to Cloud

What is a storage account?

Simple explanation

A storage account is like renting a storage unit — except it can hold files, databases, queues, and more.

On-prem, you had file servers with NTFS shares. In Azure, a storage account is your general-purpose container for data. Inside one storage account, you can have blob containers (like folders for large files), file shares (like SMB network shares), tables (simple databases), and queues (message pipelines).

When you create a storage account, you choose: the name (globally unique), the region, the performance tier (Standard or Premium), and how many copies of your data Azure keeps (redundancy).

Storage account types

Account Kind	Supported Services	Performance	Use Case
StorageV2 (general-purpose v2)	Blob, Files, Table, Queue	Standard or Premium	Recommended for most scenarios
BlobStorage	Blob only	Standard	Legacy — use StorageV2 instead
BlockBlobStorage	Block blobs, append blobs	Premium	High-transaction blob workloads
FileStorage	Azure Files only	Premium	Enterprise file shares, high IOPS

Exam tip: Always pick StorageV2

Unless the question specifically asks for premium block blob or premium file performance, StorageV2 (general-purpose v2) is the correct answer. It supports all storage services and both Standard and Premium tiers. Microsoft recommends it for almost all scenarios.

Redundancy options

This is one of the most heavily tested topics. Azure stores multiple copies of your data to protect against failures.

Azure Storage redundancy options — from least to most resilient
Option	Copies	Region Scope	Read Access During Outage?
LRS (Locally Redundant)	3 copies in one datacenter	Single region	No
ZRS (Zone-Redundant)	3 copies across 3 availability zones	Single region	No
GRS (Geo-Redundant)	6 copies (3 local + 3 in paired region)	Two regions	No (secondary is not readable)
RA-GRS (Read-Access Geo)	6 copies (3 local + 3 in paired region)	Two regions	Yes — read from secondary
GZRS (Geo-Zone-Redundant)	6 copies (3 zones primary + 3 secondary)	Two regions	No
RA-GZRS (Read-Access Geo-Zone)	6 copies (3 zones primary + 3 secondary)	Two regions	Yes — read from secondary

Real-world: How to choose redundancy

CloudFirst Labs uses LRS for dev/test environments — cheapest, and data loss in dev is acceptable
TechCorp Solutions uses ZRS for production web assets — survives a datacenter failure within the region
Meridian Financial uses RA-GZRS for critical financial data — maximum resilience with read access during regional outage

The exam pattern: Match the business requirement (cost, availability, compliance) to the correct redundancy option. If they mention “regional disaster recovery,” think GRS/GZRS. If they mention “read access during outage,” think RA-GRS or RA-GZRS.

Encryption

All data in Azure Storage is encrypted at rest using 256-bit AES encryption. This is enabled by default and cannot be disabled.

Two key management options:

Microsoft-managed keys (default) — Azure handles key rotation automatically
Customer-managed keys (CMK) — you manage keys in Azure Key Vault

Infrastructure encryption adds a second layer of encryption at the infrastructure level (double encryption). This is for organisations with extreme compliance requirements.

Storage Explorer and AzCopy

Azure Storage Explorer is a desktop application (Windows, macOS, Linux) for managing storage accounts visually. Think of it as a file manager for Azure Storage — drag and drop blobs, browse containers, manage file shares.

AzCopy is a command-line tool for high-performance data transfer:

# Copy a local file to blob storage
azcopy copy "C:\data\report.csv" "https://mystorageaccount.blob.core.windows.net/mycontainer/report.csv?SAS_TOKEN"

# Sync a local folder to blob storage
azcopy sync "C:\data" "https://mystorageaccount.blob.core.windows.net/mycontainer?SAS_TOKEN"

Storage Explorer vs AzCopy
Feature	Storage Explorer	AzCopy
Interface	GUI (desktop app)	CLI (command line)
Best for	Browsing, small transfers, visual management	Large transfers, scripting, automation
Authentication	Entra ID, SAS, account key	Entra ID, SAS
Performance	Good for small to medium	Optimised for large-scale parallel transfers

Question

What is the difference between LRS and ZRS?

Click or press Enter to reveal answer

Answer

LRS stores 3 copies within a single datacenter (cheapest, protects against disk/rack failure). ZRS stores 3 copies across 3 different availability zones in the same region (costs more, protects against an entire datacenter failure).

Click to flip back

Question

What does the 'RA' in RA-GRS stand for, and what does it enable?

Click or press Enter to reveal answer

Answer

RA = Read Access. RA-GRS allows read-only access to data in the secondary (paired) region. Standard GRS replicates to the secondary but you can't read from it unless Microsoft initiates a failover. RA-GRS lets you read from the secondary endpoint at any time.

Click to flip back

Question

Is Azure Storage encryption at rest optional?

Click or press Enter to reveal answer

Answer

No. All data in Azure Storage is encrypted at rest with 256-bit AES by default. This cannot be disabled. The choice is only between Microsoft-managed keys (default) and customer-managed keys (via Key Vault).

Click to flip back

Knowledge check

Knowledge Check

Meridian Financial needs to store critical financial records that must remain accessible even if an entire Azure region goes down. They also need to read data from the secondary region for reporting during normal operations. Which redundancy option should Alex recommend?

Knowledge Check

CloudFirst Labs needs to copy 500 GB of log files from an on-premises server to Azure Blob Storage as part of a nightly automated job. Which tool should they use?

🎬 Video coming soon