Difference between regrate vs refresh vs rotate storage account key in Azure Portal?

Question

Difference between regrate vs refresh vs rotate storage account key in Azure Portal?

Karolina-7697 5

I need to change the key that is currently used on the Storage Account app in my company without anyone loosing the access in the process.

Here is what I found on Microsoft website:

To rotate your storage account access keys in the Azure portal:

Update the connection strings in your application code to reference the secondary access key for the storage account.
Navigate to your storage account in the Azure portal.
Under Security + networking, select Access keys.
To regenerate the primary access key for your storage account, select the Regenerate button next to the primary access key.
Update the connection strings in your code to reference the new primary access key.
Regenerate the secondary access key in the same manner.

How do I complete step 1?

Step 4 - there is no Regenerate button. Next to each key there is only a Rotate button, and above the refresh one.

Please help me with this issue.

Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-07T23:20:14.4033333+00:00

Hi Karolina-7697,

If you regenerate the keys, access to all resources using the current access keys or SAS tokens will be lost. This will impact all users or services relying on those keys for access.

Please note, regenerating your access keys can affect any applications or Azure services that are dependent on the storage account key. Any clients that use the account key to access the storage account must be updated to use the new key, including media services, cloud, desktop and mobile applications, and graphical user interface applications for Azure Storage, such as Azure Storage Explorer.

The steps outlined in Step 1 apply to applications that are connected using a connection string and access key. In the event that the primary key is regenerated, the application will automatically switch to using the secondary key, ensuring there is no disruption in service where secondary key would already have been updated in code. However, as you are using Azure storage explorer (ASE), so rotating the access keys will lose access to the application (ASE), you will need to sign in with the new keys to get access to the resource.

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#manually-rotate-access-keys

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Karolina-7697 5 Reputation points

2025-03-07T23:33:21.5633333+00:00

It seems that Microsoft Azure Storage Explorer app is using both access key and connection string, at least that is what I can see in properties. Wouldn't it make it an application that Step 1 applies to? If not which applications apply to step 1?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-10T18:02:40.6966667+00:00

Hi Karolina-7697,

Yes, you can connect to Azure storage from Azure Storage Explorer app using connection string option as well.

Azure Storage Explorer is a standalone application that enables users to manage their Azure cloud storage resources directly from their desktop. While it provides an intuitive interface for performing various tasks such as viewing, uploading, and managing files within Azure Storage, it does not provide the ability to control access programmatically or through code.

In the context of your specific requirement—changing the key associated with the Storage Account used by your company without interrupting access to the resources—a potential workaround can be employed. Instead of directly regenerating the primary key, you can also use the secondary key for accessing the same Storage Account. By doing this, you ensure that even if the primary key is regenerated or rotated, the resources remain accessible via the secondary key, thereby maintaining continuous access without impacting the users who rely on the storage who have access to storage Via the secondary key. This approach ensures a seamless transition during key rotation, allowing uninterrupted access to the resources without requiring additional changes or downtime.

Note: I would also recommend testing this approach in a test environment rather than directly in the production environment to ensure its effectiveness.
Karolina-7697 5 Reputation points

2025-03-11T16:20:19.14+00:00

Hi Syed,

Thank you very much for your reply. To avoid loosing access to the storage, I will first set up all the Storage Explorer apps with the second key and than rotate the first one. How can I test it in the test environment?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-11T17:09:05.4366667+00:00

Hello Karolina-7697,

You may want to test the solution on a non-production storage account, if available, or create a new test storage account specifically for this purpose. Once testing is complete, you can delete the test account. This approach will help you assess the effectiveness of the solution without impacting any production environment.
Karolina-7697 5 Reputation points

2025-03-11T17:49:29.0933333+00:00

Do you have any knowledge based articles and/or instructions on how to get it done? I don't know much about storge accounts or Azure in general.
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-11T18:03:32.0533333+00:00

Karolina-7697, there is not any specific guide to follow for the solution proposed above its based on the repro I have performed from my end, moreover you can follow the document to view/generate the access keys and to attach the resource to Azure storage explorer you can check here.
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-12T20:35:42.25+00:00

Hello Karolina-7697,

Checking to see whether you have resolved the issue with the solution provided above, or if you need any further assistance, please let us know
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-13T18:27:52.19+00:00

Hi Karolina-7697,I wanted to follow up and see if the solution proposed helped (pointed you in the right direction) > please do not forget to “up-vote”. which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.
Karolina-7697 5 Reputation points

2025-03-21T16:19:47.7466667+00:00

Hi Syed,

I had to pose working on that, but I am planning to get it done in couple of weeks. I will update post once it done.

What do you think about doing it without trying first in the test environment?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-24T19:40:12.0033333+00:00

Hi Karolina-7697, as Amrinder mentioned Both the keys are exclusive i.e. If you are connecting via Secondary Key and rotate the primary key, it won't have affect on the connections that are being made using secondary key. I have reproduced the same from my end which is working as expected.

Where all the primary key was configured, only that section breaks, and you need to update the newer one in there.
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-25T21:35:01.94+00:00

Hello Karolina-7697,,

Checking, if the solution provided is helpful or require further assistance?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-26T17:22:28.06+00:00

Hi Karolina-7697,I wanted to follow up and see if the solution proposed helped (pointed you in the right direction) > please do not forget to “up-vote”. which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.

1 answer

Your answer

Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-07T23:20:14.4033333+00:00

Hi Karolina-7697,

If you regenerate the keys, access to all resources using the current access keys or SAS tokens will be lost. This will impact all users or services relying on those keys for access.

Please note, regenerating your access keys can affect any applications or Azure services that are dependent on the storage account key. Any clients that use the account key to access the storage account must be updated to use the new key, including media services, cloud, desktop and mobile applications, and graphical user interface applications for Azure Storage, such as Azure Storage Explorer.

The steps outlined in Step 1 apply to applications that are connected using a connection string and access key. In the event that the primary key is regenerated, the application will automatically switch to using the secondary key, ensuring there is no disruption in service where secondary key would already have been updated in code. However, as you are using Azure storage explorer (ASE), so rotating the access keys will lose access to the application (ASE), you will need to sign in with the new keys to get access to the resource.

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#manually-rotate-access-keys

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Karolina-7697 5 Reputation points

2025-03-07T23:33:21.5633333+00:00

It seems that Microsoft Azure Storage Explorer app is using both access key and connection string, at least that is what I can see in properties. Wouldn't it make it an application that Step 1 applies to? If not which applications apply to step 1?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-10T18:02:40.6966667+00:00

Hi Karolina-7697,

Yes, you can connect to Azure storage from Azure Storage Explorer app using connection string option as well.

Azure Storage Explorer is a standalone application that enables users to manage their Azure cloud storage resources directly from their desktop. While it provides an intuitive interface for performing various tasks such as viewing, uploading, and managing files within Azure Storage, it does not provide the ability to control access programmatically or through code.

In the context of your specific requirement—changing the key associated with the Storage Account used by your company without interrupting access to the resources—a potential workaround can be employed. Instead of directly regenerating the primary key, you can also use the secondary key for accessing the same Storage Account. By doing this, you ensure that even if the primary key is regenerated or rotated, the resources remain accessible via the secondary key, thereby maintaining continuous access without impacting the users who rely on the storage who have access to storage Via the secondary key. This approach ensures a seamless transition during key rotation, allowing uninterrupted access to the resources without requiring additional changes or downtime.

Note: I would also recommend testing this approach in a test environment rather than directly in the production environment to ensure its effectiveness.
Karolina-7697 5 Reputation points

2025-03-11T16:20:19.14+00:00

Hi Syed,

Thank you very much for your reply. To avoid loosing access to the storage, I will first set up all the Storage Explorer apps with the second key and than rotate the first one. How can I test it in the test environment?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-11T17:09:05.4366667+00:00

Hello Karolina-7697,

You may want to test the solution on a non-production storage account, if available, or create a new test storage account specifically for this purpose. Once testing is complete, you can delete the test account. This approach will help you assess the effectiveness of the solution without impacting any production environment.
Karolina-7697 5 Reputation points

2025-03-11T17:49:29.0933333+00:00

Do you have any knowledge based articles and/or instructions on how to get it done? I don't know much about storge accounts or Azure in general.
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-11T18:03:32.0533333+00:00

Karolina-7697, there is not any specific guide to follow for the solution proposed above its based on the repro I have performed from my end, moreover you can follow the document to view/generate the access keys and to attach the resource to Azure storage explorer you can check here.
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-12T20:35:42.25+00:00

Hello Karolina-7697,

Checking to see whether you have resolved the issue with the solution provided above, or if you need any further assistance, please let us know
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-13T18:27:52.19+00:00

Hi Karolina-7697,I wanted to follow up and see if the solution proposed helped (pointed you in the right direction) > please do not forget to “up-vote”. which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.
Karolina-7697 5 Reputation points

2025-03-21T16:19:47.7466667+00:00

Hi Syed,

I had to pose working on that, but I am planning to get it done in couple of weeks. I will update post once it done.

What do you think about doing it without trying first in the test environment?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-24T19:40:12.0033333+00:00

Hi Karolina-7697, as Amrinder mentioned Both the keys are exclusive i.e. If you are connecting via Secondary Key and rotate the primary key, it won't have affect on the connections that are being made using secondary key. I have reproduced the same from my end which is working as expected.

Where all the primary key was configured, only that section breaks, and you need to update the newer one in there.
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-25T21:35:01.94+00:00

Hello Karolina-7697,,

Checking, if the solution provided is helpful or require further assistance?
Syed Aaqid Ali 580 Reputation points Microsoft External Staff Volunteer Moderator

2025-03-26T17:22:28.06+00:00

Hi Karolina-7697,I wanted to follow up and see if the solution proposed helped (pointed you in the right direction) > please do not forget to “up-vote”. which might be beneficial to other community members reading this thread. And, if you have any further queries do let us know.

Answer 1

Amrinder Singh 5,870 Microsoft Employee Volunteer Moderator

Hi Karolina-7697

Thanks for reaching out on Q&A Forum.

This is the button you will tend to see for rotation/re-generation of the keys and will provide you the new one.

User's image

This in turn will expire the older Keys/connection string that was created via the older access keys and also any SAS signature too that was signed using the older access keys.

There is no data loss as part of rotation/re-generation however the application will face connectivity/auth related failure as the older keys becomes invalid. You need to ensure you are updating the access keys / connection string / new SAS generated via new access keys for seamless connectivity.

You can refer to this link as well

https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal

Please let us know if you have any further queries. I’m happy to assist you further.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Karolina-7697 5 Reputation points

2025-03-11T16:23:33.9066667+00:00

But we won't loose connectivity if I set up the Explorer app with the second key and then rotate the first one. Just like Syed mentioned, right?
Karolina-7697 5 Reputation points

2025-03-21T16:23:37.25+00:00

Hi Amrinder,

I am sorry I didn't reply earlier. According to other replies I received, if I switch everyone to second key and then rotate the first there won't be any connectivity/auth related failure as the older keys becomes invalid". The second key will become our primary one and the new/rotated first one will be a back one, right?
Amrinder Singh 5,870 Reputation points Microsoft Employee Volunteer Moderator

2025-03-22T04:11:38.2333333+00:00

Hi Karolina-7697 - Both the keys are exclusive i.e. If you are connecting via Secondary Key and rotate the primary key, it won't have affect on the connections that are being made using secondary key.

Where all the primary key was configured, only that section breaks and you need to update the newer one in there.

Hope that helps!

Share via

Difference between regrate vs refresh vs rotate storage account key in Azure Portal?

1 answer

Your answer