Making a storage account zone redundant made accessing objects with SAS token fail

Question

I recently migrated an Azure storage account from being Locally redundant (LRS) to being Zone redundant (ZRS). I also allowed access to objects on the storage through a proxy server, that routed traffic from a public URL to the blob storage, appending a SAS token as a query parameter as per usual.

This used to work as expected, but after migrating to ZRS, accessing the blob storage using the existing SAS token stopped working. I generated a new SAS token, and then accessing the objects through the public URLs started working again.

In tried recreating the issue by creating a new LRS storage account, adding a container and blob, and then migrating the storage to be ZRS. I was not able to reproduce the issue: accessing the objects using the original SAS tokens still worked.

According to documentation, making a LRS storage ZRS should not affect accessibility to objects.

My question is: Now that I want to migrate another blob storage to be ZRS from being LRS, can I count on the existing SAS tokens working? I want to prevent the migration from influencing users.

I unfortunately cannot exclude that the original SAS token expired at the time of the migration: I don't have the old SAS token stored anywhere. But I find that unlikely.

Answer 1

Hello @Karl Hans Mikael Nyman,,

Yes, existing SAS tokens should continue working after migrating your blob storage from LRS to ZRS. Microsoft documentation confirms that redundancy migrations do not invalidate SAS tokens, access keys, or service endpoints, as the process is in-place with no data movement or key regeneration. Your test recreating the migration successfully supports this, indicating the original issue was probably token expiration or a timing coincidence rather than the redundancy change.

Reference: https://learn.microsoft.com/en-us/azure/storage/common/redundancy-migration?tabs=portal

Kindly let us know if the above helps or you need further assistance on this issue. If need further assistance please check the private message and share us the requested details there.

Pleaseand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.