AZ-900 Storage Redundancy and Access Tiers — the copy that is not a backup

Six copies in two regions. One delete. Six deletes.

<!-- hal:authoritative:yaml -->

Six copies in two regions. One delete. Six deletes.

§I — Frame: third Microsoft visit, storage door

08-11 opened the hierarchy. Management groups, subscriptions, resource groups, RBAC, Policy, locks, and the composite SLA arithmetic. That lesson is the governance spine. Leave it.

08-23 opened identity. Entra ID, AuthN before AuthZ, SSO, MFA, passwordless, Conditional Access, Zero Trust, Defender. That lesson is the credential that is not a key. Leave it.

Today the Cloud rotation counter reads 7. Seven mod 4 is 3. Seat 3 is AZ-900 again, and the leftover is the storage skill area inside the largest domain. The study guide's storage bullets are six lines long: compare the services, describe the tiers, describe the redundancy options, describe account options and storage types, identify options for moving files, describe migration options. Fundamentals exams do not ask you to configure any of it. They ask you which word means which thing, and the one trap they set every time is a candidate who hears "geo-redundant" and answers "backed up."

Coin it: the copy that is not a backup.

The az-900 clone prints the tiers and stops. It has no line on LRS, ZRS, GRS, or GZRS, and it does not know the Cold tier exists. Read the clone for the shape of the tier question and this lesson for the rest.

§I.B — Exam facts, currency first

Verified 2026-09-04 against the public study guide.

Skills measured as of 2026-07-20. Pass 700. Three domains: cloud concepts 25-30 percent, architecture and services 35-40 percent, management and governance 30-35 percent. No change to the weights since 08-11 and 08-23 read them. The change log marks compute and networking, managing and deploying, and monitoring as Minor revisions; the storage bullets are unchanged. Most questions cover GA features.

The storage bullets, verbatim in spirit: compare Azure Storage services; describe storage tiers; describe redundancy options; describe storage account options and storage types; identify options for moving files including AzCopy, Azure Storage Explorer, and Azure File Sync; describe migration options including Azure Migrate and Azure Data Box.

That is the whole examinable surface for today. Six bullets, one of which is today's center.

§II — Domain foundations: the five services and the four account kinds

Azure Storage is one account with several services inside it. The cheatsheet table has the right four rows; the exam adds a fifth.

Blob Storage is object storage for unstructured data: files, images, logs, backups, anything addressed by URL. It has block blobs (most things), append blobs (logs), and page blobs (VM disks under the hood). Only block blobs have access tiers.

Azure Files is managed file shares over SMB and NFS. Mount it like a network drive. Azure File Sync caches a share on a Windows Server on-premises so the branch office reads locally and the cloud holds the truth.

Azure Disks are block storage attached to virtual machines. Managed disks, one VM at a time.

Queue Storage holds messages for asynchronous work. Table Storage is a key-attribute NoSQL store. Both are small on the exam; know they exist inside the same account.

Data Lake Storage Gen2 is Blob Storage with a hierarchical namespace switched on, for analytics workloads.

Account kinds, which the guide calls storage account options: Standard general-purpose v2 holds all five services and supports every redundancy option. Premium block blobs, premium file shares, and premium page blobs run on SSD, cost more, and support fewer redundancy options; premium page blobs are LRS only. If a question names a workload that needs single-digit-millisecond latency, the answer has "premium" in it. If it names anything else, the answer is general-purpose v2.

§III — Access tiers: the clone's half

The clone says Cool is at least 30 days, Hot is frequent access, Archive is at least 180 days and blob-level with high retrieval latency, and Premium is single-digit millisecond. Three of those four are right. Corrections and additions follow.

Hot is the online tier for frequent access: highest storage cost, lowest access cost. Cool is online, for data stored at least 30 days: lower storage cost, higher access cost. Cold is online, for data stored at least 90 days: lower storage cost again, higher access cost again. The clone does not have Cold; the exam might. Archive is offline, for data stored at least 180 days: lowest storage cost, highest access cost, and you cannot read the blob until you rehydrate it to an online tier, which takes up to 15 hours at standard priority.

Tiers are set per blob. The account has a default access tier, Hot, Cool, or Cold, that a blob inherits if it does not set its own. The clone says Hot and Cool "operate at the account level"; the truer sentence is that the account carries a default and the blob can override it. Archive can never be the account default.

Early deletion: delete or re-tier a Cool blob before 30 days, a Cold blob before 90, or an Archive blob before 180, and you pay the remaining days. A soft-deleted blob is not yet deleted for this purpose.

One interaction the exam may not ask and the on-call will: archive is only supported on LRS, GRS, and RA-GRS accounts. ZRS and GZRS accounts cannot hold archived blobs. Changing an account's redundancy while it holds archived blobs requires rehydrating all of them first.

§IV — Redundancy: the half the clone does not have

Every redundancy option is a count of synchronous copies in the primary region, plus an optional asynchronous copy set in a second region.

Read the table as two questions. First, what does the primary survive? LRS survives a disk or rack. ZRS survives a datacenter, because the three copies are in three zones. Second, is there a second region? GRS and GZRS say yes, and the secondary is the paired region Azure assigns, not one you pick. The RA prefix answers a third question: can an application read from the secondary before a failover? Without RA, the copies are there and unreachable until you or Microsoft fail over.

The exam sentence for each: LRS is the cheapest and protects against hardware failure within a datacenter. ZRS protects against a datacenter or zone outage. GRS protects against a regional outage. RA-GRS lets you read during one.

Now the coin. Every one of these six options replicates every write. A delete is a write. A blob you remove from a Standard_RAGZRS account is removed from three zones and a second region within seconds. Sixteen nines of durability describe how unlikely Azure is to lose your data. They say nothing about how likely you are to lose it yourself.

The features that answer that second question are on the blob service, not the SKU: soft delete for blobs (retain deleted blobs 1 to 365 days) and for containers, blob versioning (keep prior versions on overwrite), snapshots, and point-in-time restore (which needs versioning, change feed, and soft delete together). At the account level, 08-11's resource lock stops the account itself from being deleted. Azure Backup can protect blobs as a separate service. None of these are redundancy. All of them are what a candidate means when they say "backup."

If a question asks which option protects data from a regional disaster, answer GRS or GZRS. If a question asks which feature lets you recover a blob an administrator deleted by mistake, answer soft delete. If a question offers GRS as the answer to the second question, that is the trap, and it is the whole reason today's lesson exists.

§IV.B — Moving files and migrating

Four names, four jobs.

AzCopy is a command-line tool for copying blobs and files into, out of, and between storage accounts. Scriptable, resumable, the answer when the question says "command line" or "automate."

Azure Storage Explorer is a desktop GUI for the same operations. The answer when the question says "graphical."

Azure File Sync keeps an on-premises Windows Server share in sync with an Azure Files share, with cloud tiering so the server holds only hot files locally. The answer when the question says "branch office" or "on-premises file server."

Azure Migrate is the hub for discovering, assessing, and migrating servers, databases, web apps, and data to Azure. The answer when the question says "assess" or "datacenter."

Azure Data Box is a physical appliance Microsoft ships to you; you fill it and ship it back. The answer when the question names tens of terabytes and a slow or absent network link.

§V — Currency corrections, and the three-cloud map

Three corpus findings recorded this cycle.

First, the az-900 clone lists Hot, Cool, and Archive and omits Cold. Cold is GA, sits between Cool and Archive at a 90-day minimum, and appears in the official access-tiers table alongside the other three. Study four online-and-offline tiers, not three.

Second, the clone says Hot and Cool operate at the account level and Archive at the blob level. The account carries a default tier; every tier including Hot and Cool can be set per blob. Archive is the one that cannot be the account default.

Third, neither the clone nor the two cheatsheets carry a line on redundancy at all, and the guide names "describe redundancy options" as a bullet. That is the same class of gap 08-11 logged for Entra versus Azure AD and 09-01 logged for retired PCA case studies: the clone is a map of an older exam.

The three-cloud map for reach, since the rotation will return to AWS in three days. S3 stores every object across at least three availability zones by default, so the S3 baseline is closer to ZRS than to LRS; S3 Cross-Region Replication is the GRS analogue and it too replicates deletes unless you tell it not to; S3 Versioning and Object Lock are soft delete's cousins. GCS has regional, dual-region, and multi-region location types with the same shape, and Object Versioning plus soft delete on the bucket. The coin is the same in all three vendors. The copy is not a backup.

§VI — Connection to today's Ops and Dev lessons

Ops prints the SKU beside the blob service flags and names every account whose SKU has a G in it and whose delete_retention_policy is None. That is this lesson's trap question, executed against a subscription. The Python client is not on AZ-900. The two columns are.

Dev prints the same coin with no cloud in it. dict(config) copies the outer dict and shares the nested one; copy.deepcopy copies both. Ramalho's Chapter 6 heading, copies are shallow by default, is the storage-account sentence rewritten for a language. GRS is a shallow copy across regions. Soft delete is the deep one.

09-01's BigQuery lesson was a different vendor's leftover: a filter that looked like a prune and was not. Today's is a copy that looks like a backup and is not. Cross-vendor reach stops at that rhyme. Do not import partition keys into a storage account.

§VII — Practice questions

A. LRS B. ZRS C. GRS D. RA-GZRS

C. Regional loss requires a second region, so LRS and ZRS are out. GRS is the cheapest option with a secondary region. RA-GZRS also survives it but adds zone redundancy and a readable secondary the question did not ask for.

A. The invoices can be read from the secondary region because GRS keeps a copy there. B. The delete replicated to the secondary region; recovery depends on whether container soft delete was enabled. C. GRS retains deleted data for 30 days by default. D. A resource lock on the account would have prevented the container deletion.

B. Redundancy replicates writes, and a delete is a write. Container soft delete is the feature that retains the container. GRS has no retention window of its own. A lock at the account scope prevents deleting the account, not a container inside it.

A. Hot B. Cool C. Cold D. Archive

D. Rarely accessed, hours of latency acceptable, longest retention. Archive is offline and rehydrates in up to 15 hours. Cold would be correct only if the question required immediate reads.

A. AzCopy B. Azure Storage Explorer C. Azure File Sync D. Azure Data Box

C. File Sync with cloud tiering. AzCopy and Storage Explorer copy; they do not synchronize an on-premises server. Data Box is a shipped appliance for bulk transfer.

A. Its data is replicated to a paired region. B. It cannot hold blobs in the Archive tier. C. Applications can read from a secondary endpoint. D. It has lower durability than LRS.

B. Archive is supported only on LRS, GRS, and RA-GRS. ZRS has no secondary region and no secondary endpoint, and its three zone copies give it higher durability than LRS, not lower.

§VIII — Closing

Five services in one account. Four account kinds. Four tiers, one of them offline. Six redundancy options, three of them with a second region, two of those readable. Five tools for moving and migrating. That is the storage skill area, and none of it is hard once the words are attached to the right objects.

The one thing worth keeping past the exam: redundancy is a promise about Azure's hardware. Soft delete and versioning are promises about your own hands. When a question, or a colleague, says "it's geo-redundant so we're fine," ask which promise they mean.

The copy is not a backup.

Related

• Prior arc: the credential that is not a key (2026-08-23)
• Domain hub: Cross-References/domains/01-Earth-DevOps
• Grounding: AZ-900 clone — Azure Storage and Databases · Azure Core Services — Storage