Storage account uses geo-redundant replication

Check ID: storage_geo_redundant_enabled
Provider: Azure
Service: storage
Severity: MEDIUM
Categories: resilience
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts configured for geo-redundant replication via Standard_GRS, Standard_GZRS, Standard_RAGRS, or Standard_RAGZRS. The setting indicates data is copied to a paired secondary region, with RA-* allowing read access during primary-region unavailability.

Risk

Absent geo-replication, data resides in one region, undermining availability and durability during regional failures. Disasters can cause prolonged downtime or unrecoverable loss. With geo-replication but without RA-*, the secondary is unreadable, increasing RTO and interrupting business continuity.

Recommendation

Adopt GRS/GZRS for critical workloads (prefer Standard_GZRS where supported) to achieve cross-region resilience. If read continuity is required, use Standard_RAGRS or Standard_RAGZRS. Define RPO/RTO, regularly test failover, and design for defense in depth across regions and zones.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az storage account update —name <storage-account-name> —resource-group <resource-group-name> —sku Standard_GRS

resource "azurerm_storage_account" "example" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_group_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "GRS" # Critical: enables geo-redundant replication to pass the check
}

// Storage account with geo-redundant replication enabled
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<example_location>'
  kind: 'StorageV2'
  sku: {
    name: 'Standard_GRS' // Critical: enables geo-redundant replication (GRS) to pass the check
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_geo_redundant_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Storage account has soft delete for containers enabled Storage account has infrastructure encryption enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires