Skip to main content
rightsizing · azure

Storage accounts defaulting to the Hot tier while their blobs are almost never read or written

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags an Azure Storage account whose default access tier is Hot when its blob service averages fewer than 0.05 transactions a day over 30 days, roughly one transaction a month or less. The saving is the Hot to Cool storage rate difference applied to the account's stored gigabytes, and nothing is reported without that measured figure.

Signal and threshold

How ZopNight evaluates Storage accounts defaulting to the Hot tier while their blobs are almost never read or written.
Field Value
Rule IDsRC-1325
Categoryrightsizing
Severitymedium
MetricTransactions (blob service, daily rate)
Threshold< 0.05 transactions per day
Evaluation window30d
SourceZopNight
Permissions usedMicrosoft.Storage/storageAccounts/read · Microsoft.Insights/Metrics/Read

Hot-tier storage rates on data nobody touches

A general-purpose v2 account sets a default access tier that every blob without an explicit tier inherits. The access tiers overview says a new account defaults to Hot, and that Cool has lower storage costs and higher access costs, for data kept at least 30 days. When access is close to zero, the higher per-operation price barely matters and the lower storage rate is pure saving.

Accounts created for exports, one-off migrations and archives of old projects tend to stay Hot forever, because nobody revisits the default once the data has landed.

Measuring access on Hot accounts

Terminal window
az storage account list \
--query "[?accessTier=='Hot'].{name:name, rg:resourceGroup, kind:kind, sku:sku.name}" -o table
az monitor metrics list \
--resource <storage-account-resource-id>/blobServices/default \
--metric Transactions --aggregation Total --interval PT24H --offset 30d

Add up the daily totals. Under 0.05 a day means fewer than 1.5 transactions across 30 days, so a month with at most one transaction is the pattern this rule targets.

Access-rate test and data requirements

  1. The account’s default access tier, as Azure reports it, is Hot.
  2. Azure Monitor has blob transaction data for the account. Without it the account is not assumed to be cold.
  3. The average daily transaction rate over 30 days is strictly below 0.05.
  4. A measured Hot to Cool saving exists for the account, and the account has a monthly cost.

Overlap with other storage findings

An account quiet enough for this rule is often picked up by Idle Azure Storage Account too. When both propose the same Hot to Cool change, ZopNight keeps one recommendation (the idle account one on a tie) and marks the other as covered, so the saving is not counted twice. If the idle rule proposes deleting the account instead, that larger saving wins. Azure Storage Account Missing Lifecycle Policy is a different lever, tiering individual blobs by age, and can appear on the same account.

Hot to Cool storage delta

Terminal window
monthly saving = (Hot rate per GB-hour - Cool rate per GB-hour) x stored GB x 730
capped at the account's monthly cost

ZopNight does not fall back to a fixed fraction of the bill. If the rate difference or the stored volume is unknown, the account gets no recommendation.

Switching the account to Cool

  1. Confirm the low access pattern in Azure Monitor under the account’s Insights, Transactions.
  2. Check whether any application reads the data on a calendar you have not seen yet.
  3. Change the default tier: az storage account update --resource-group my-rg --name mystorageacct --access-tier Cool.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·