Skip to content

Commit f70a905

Browse files
ttorblettorble
authored
Merge pull request #303702 from fauhse/release-storage-discovery-2025
Deployment planning re-work
2 parents e26c7d7 + f608734 commit f70a905

File tree

4 files changed

+170
-108
lines changed

4 files changed

+170
-108
lines changed

‎articles/storage-discovery/deployment-planning.md

Lines changed: 110 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,62 +1,138 @@
11
---
22
title: Planning for an Azure Storage Discovery deployment
33
titleSuffix: Azure Storage Discovery
4-
description: Considerations and best-practices while deploying Azure Storage Discovery service
5-
author: pthippeswamy
4+
description: Considerations and best-practices for deploying the Azure Storage Discovery service
5+
author: fauhse
66
ms.service: azure-storage-mover
77
ms.topic: overview
88
ms.date: 08/01/2025
9-
ms.author: shaas
9+
ms.author: fauhse
1010
---
1111

12-
# Azure Storage Discovery: Regional availability and planning guide
12+
# Planning for an Azure Storage Discovery deployment
1313

14-
Azure Storage Discovery empowers organizations to gain deep, actionable insights into their storage estate—across subscriptions, regions, and scopes. This article outlines the regional availability of Azure Storage Discovery, explains how to select regions for your workspace, and clarifies how regional aggregation of insights work.
14+
Before you continue, be sure to get an [overview of the Storage Discovery service](overview.md) and the value it can provide to you.
1515

16-
## Workspace Region Availability
16+
## Make sure the service works for your scenario
1717

18-
Azure Storage Discovery Workspaces (ASDW) are the foundational resource for configuring and visualizing your storage insights.
19-
[!INCLUDE [control-plane-regions](includes/control-plane-regions.md)]
18+
Azure Storage Discovery currently surfaces insights for resources of the Azure Blob Storage service.
19+
Coverage also includes storage accounts configured with the [hierarchical namespace feature](../storage/blobs/data-lake-storage-namespace.md) to enable [Azure Data Lake Storage](../storage/blobs/data-lake-storage-introduction.md).
20+
21+
Discovery currently doesn't work for [Azure Files](../storage/files/storage-files-introduction.md) or other storage types.
22+
23+
## Deployment basics
24+
25+
Your Azure Storage resources (like storage accounts) experience no transactions or performance impact when analyzing them with Azure Storage Discovery.
26+
27+
Deploying the service means deploying and configuring a *Storage Discovery workspace resource* into a resource group in one of your subscriptions.
28+
The Discovery service works to compute and store insights about your Azure Blob Storage estate. These computed insights are stored in the region of the workspace you created. Other than the Storage Discovery workspace, no other infrastructure needs to be deployed.
29+
30+
The workspace can be configured to aggregate insights across any subscriptions in the Azure tenant the workspace is deployed in.
31+
To generate insights about Azure Storage resources, such as storage accounts, you need to be a member of the RBAC (Role Based Access Control) Reader role for every storage resource.
32+
33+
> [!IMPORTANT]
34+
> To get accurate insights, you need to configure your workspace for resources you have permissions to.<br> The [permissions section](#permissions) in this article has important details you should review.
35+
36+
## Getting your subscription ready
37+
38+
You need to choose a subscription governed by the same Azure tenant as the Azure Storage resources (such as storage accounts) you want to receive insights for. When you decided on an Azure subscription and resource group for your Storage Discovery workspace, review the following sections to ensure your subscription is prepared.
39+
40+
### Resource provider namespace
41+
42+
Before a service is used for the first time in an Azure subscription, its resource provider namespace must be registered once with the chosen subscription. Azure Storage Discovery has the same requirement. A subscription *Owner* or *Contributor* can perform this action. Performing this registration action before the actual Storage Discovery workspace deployment enables admins with fewer rights to deploy and use the Storage Discovery service.
43+
44+
> [!IMPORTANT]
45+
> The subscription must be registered with the resource provider namespaces *Microsoft.StorageDiscovery*.
46+
47+
Register a resource provider:
48+
49+
- [via the Azure portal](../azure-resource-manager/management/resource-providers-and-types.md#azure-portal)
50+
- [via Azure PowerShell](../azure-resource-manager/management/resource-providers-and-types.md#azure-powershell)
51+
- [via Azure CLI](../azure-resource-manager/management/resource-providers-and-types.md#azure-cli)
52+
53+
> [!TIP]
54+
> When you deploy a Storage Discovery workspace as a subscription *Owner* or *Contributor* through the Azure portal, your subscription is automatically registered with this resource provider namespace. You only need to perform the registration manually when using Azure PowerShell or CLI.
2055
21-
### What This Means for You
56+
Once a subscription is enabled for this resource provider namespace, it remains enabled until manually unregistered. You can even delete the last Storage Discovery workspace and your subscription still remains enabled. Subsequent Storage Discovery workspace deployments then require reduced permissions from an admin. The following section contains a breakdown of different management scenarios and their required permissions.
2257

23-
The region where your discovery workspace is deployed determines where the control plane for your discovery experience resides. This includes:
58+
### Decide on the number of workspaces you need
2459

25-
- **Latency**: Choosing a region close to your operational base can improve dashboard responsiveness.
26-
- **Compliance**: Some organizations may have regulatory requirements that dictate where data must reside.
60+
A Storage Discovery workspace needs to be configured with *scopes*. The management components article shares [details about workspace scopes](management-components.md).
61+
Scopes are logical groups of storage resources. For instance, a scope can refer to all the storage resources of a specific workload or department that you want to get insights for separately.
2762

28-
### Planning Guidance
63+
Since you can only configure a limited number of scopes in a workspace, you may need more than one workspace to cover your insights reporting needs.
2964

30-
When selecting a region for your workspace:
65+
If a workspace is to be used for higher-level insights, you can create one with one scope for your entire Azure Storage estate and then add scopes for each department.
66+
If a workspace is designated to provide insights for specific workloads, then you can create a workspace containing a scope for each workload.
3167

32-
- **Proximity**: Choose a region geographically close to your primary operations or data sources.
33-
- **Compliance**: Ensure the region aligns with your data residency and compliance policies.
34-
- **Preview Availability**: Confirm that the region is supported in the current release phase (e.g., public preview).
68+
> [!IMPORTANT]
69+
> During the Azure Storage Discovery preview period, the Discovery service covers only storage accounts located in select regions. <br>The [Understand region limitations](#understand-region-limitations) section in this article has details.
3570
36-
## Regions for Storage Insights Aggregation
71+
### Review your Azure resource tags
3772

38-
While the workspace defines where your Discovery resource resides, the actual data being analyzed comes from storage accounts across multiple regions.
73+
You can select which storage resources are included in a [workspace scope](management-components.md) by first selecting specific subscriptions or resource groups, and then filtering the storage resources within them by [Azure resource tags](../azure-resource-manager/management/tag-resources.md).
74+
It's important that you familiarize yourself with the available resource tags on your storage resources. Ensure they're consistently applied and then catalog them for building the scopes in your workspace. Plan the scopes you need in order to have insights available per department, workload, or other grouping you have a use for.
75+
76+
## Select an Azure region for your deployment
77+
78+
When you deploy a Storage Discovery workspace, you need to choose a region. The region you select determines where the computed insights about your Azure Storage resources are stored. You can still capture insights for Azure Storage resources that are located in other regions. A general best practice is to choose the region for your workspace according to metadata residency requirements that apply to you and in closer proximity to your location. Visualizing your insights from a workspace closer to you can have a slight performance advantage.
79+
80+
Storage Discovery workspaces can be created in the following regions. More regions are added throughout the preview period.
81+
82+
[!INCLUDE [control-plane-regions](includes/control-plane-regions.md)]
83+
84+
## Understand region limitations
85+
86+
While a Storage Discovery workspace can cover storage accounts from other subscriptions and resource groups, and even other regions, there's an important region limitation you need to be aware of for a successful Storage Discovery deployment.
87+
88+
The Discovery service covers only storage accounts located in the following regions:
89+
<br><br>
3990
[!INCLUDE [data-plane-regions](includes/data-plane-regions.md)]
91+
<br>
92+
93+
> [!WARNING]
94+
> The Discovery service currently can't consider storage accounts located in regions not included in the previously listed locations. Including storage accounts from unsupported regions in a scope can lead to an incomplete set of insights. A short-term limitation of the preview period.
95+
96+
## Permissions
97+
98+
Permissions are managed via the familiar Azure [Role Based Access Control](../role-based-access-control/overview.md) (RBAC).
99+
This sections covers:
100+
* Permission to the storage resources you want to get insights for from the Discovery service.
101+
* Permission considerations for a workspace resource.
102+
103+
### Permissions to your storage resources
104+
105+
During the creation of a Storage Discovery workspace, you configure the [workspace root](management-components.md). The [management components](management-components.md) article provides more details for this configuration.
106+
In the workspace root, you list at least one and at most 100 Azure resources of different types:
107+
- subscriptions
108+
- resource groups
109+
- storage accounts
110+
111+
The person deploying the workspace must have at least the RBAC role assignment *Reader* for every resource in the workspace root.
112+
*Reader* is the minimum permission level required. *Contributor* and *Owner* are also supported.
113+
114+
It's possible that you see a subscription listed in the Azure portal, for which you don't have this direct *Reader* role assignment. When you can see a resource you don't have a role assignment to, then most likely you have permissions to a sub resource in this subscription. In this case, the existence of this "parent" was revealed to you, but you have no rights on the subscription resource itself. This example can be extended to resource groups as well. Missing a *Reader* or higher direct role assignment disqualifies an Azure resource from being the basis (root) of a workspace.
40115

41-
### What This Means for You
116+
Permissions are only validated when a workspace is created. Any change to permissions of the Azure account that created the workspace, including its deletion, has no effect on the workspace or the Discovery service functionality.
42117

43-
This means that even if your workspace is deployed in a limited set of regions, you can still gain visibility into storage accounts located in a broader set of Azure regions. The service collects and aggregates metrics such as:
118+
### Permission considerations for a workspace resource
44119

45-
- **Capacity trends**
46-
- **Activity and transaction volumes**
47-
- **Configuration and security settings**
48-
- **Cost and consumption breakdowns**
120+
The Azure Storage Discovery workspace stores the computed insights for your storage estate. You can access reports in the Azure portal, or use these insights via the Azure Copilot. In order to access insights stored in a workspace, a user must have at least the RBAC role *Reader* on the workspace. *Contributor* and *Owner* role assignments also work. You can provide insights-access to another user by assigning them one of the three previously listed roles on the workspace.
49121

50-
These insights are then visualized in your Discovery reports, enabling centralized visualization of a globally distributed storage estate.
51122

52-
## Best Practices for Regional Planning
123+
|Scenario |Minimal RBAC role assignments needed |
124+
|:--------|--------------------------------------------------------------------------------:|
125+
|Register a resource provider namespace with a subscription| Subscription: `Contributor` |
126+
|Deploy a Storage Discovery workspace <br>*([Resource provider namespace already registered](#resource-provider-namespace))*| Resource group: `Contributor` |
127+
|Share the Storage Discovery insights with another person | Storage Discovery workspace: `Reader`|
128+
|Enable a person to make changes to the workspace configuration| Storage Discovery workspace: `Contributor`|
129+
|Enable a person to share these insights with others | Storage Discovery workspace: `Owner`|
53130

54-
To maximize the value of Azure Storage Discovery:
131+
> [!CAUTION]
132+
> When you provide other users access to a workspace, you're disclosing all insights of the workspace. Other users might not be privileged to know about the existence of the Azure resources or insights about the data they store. Providing access to a workspace doesn't provide access to an individual storage account, resource group, or subscription. Individual resources remain governed by RBAC.
55133
56-
1. **Deploy your workspace in a supported region**: Ensure your chosen region is enabled for workspace creation.
57-
2. **Define scopes strategically**: Use tenant, subscription, or resource group levels to group storage accounts logically.
58-
3. **Use tags for filtering**: Apply Azure tags to storage accounts to selectively include them in your discovery scope.
59-
4. **Verify access**: Ensure users have Reader access to the ASDW resource to view reports.
60-
5. **Allow time for data to populate**: Metrics typically begin appearing within 24 hours of scope configuration.
134+
## Next steps
61135

62-
For questions or feedback, contact the team at [[email protected]](mailto:[email protected]).
136+
- [Review the Storage Discovery management components](management-components.md)
137+
- [Understand Storage Discovery pricing](pricing.md)
138+
- [Create a Storage Discovery workspace](create-workspace.md)

‎articles/storage-discovery/includes/control-plane-regions.md

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,9 @@ ms.date: 08/01/2025
66
ms.service: azure-storage-discovery
77
ms.custom: references_regions
88
---
9-
109
<!--
11-
!########################################################
12-
STATUS: DRAFT
13-
14-
CONTENT: IN PROGRESS
15-
16-
REVIEW Stephen/Fabian: IN PROGRESS
17-
EDIT PASS: IN PROGRESS
18-
19-
Document score: 100 - 20/0 (words, issues)
20-
21-
!########################################################
22-
-->
23-
2410
Storage Discovery workspaces can be created in the following regions:
25-
11+
-->
2612
- France Central
2713
- Canada Central
2814
- East US2

‎articles/storage-discovery/includes/data-plane-regions.md

Lines changed: 53 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -6,61 +6,61 @@ ms.date: 08/01/2025
66
ms.service: azure-storage-discovery
77
ms.custom: references_regions
88
---
9-
109
<!--
11-
!########################################################
12-
STATUS: DRAFT
13-
14-
CONTENT: IN PROGRESS
15-
16-
REVIEW Stephen/Fabian: IN PROGRESS
17-
EDIT PASS: IN PROGRESS
18-
19-
Document score: 100 - 102/0 (words, issues)
20-
21-
!########################################################
10+
Storage Discovery insights aggregation is supported within the following regions.
11+
This is a short-term limitation during the preview period.
2212
-->
2313

24-
Storage Discovery insights aggregation is supported within the following regions. This list continues to expand as preview support continues to expand.
25-
26-
**Americas:**
27-
- Canada Central
28-
- Canada East
29-
- Mexico Central
30-
- US Central
31-
- US East
32-
- US East2
33-
- US North
34-
- US South
35-
- US South East
36-
- US West
37-
- US West2
38-
- US West3
39-
- US West Central
14+
<details>
15+
<summary>Americas</summary>
16+
<ul>
17+
<li>Canada Central</li>
18+
<li>Canada East</li>
19+
<li>Mexico Central</li>
20+
<li>US Central</li>
21+
<li>US East</li>
22+
<li>US East2</li>
23+
<li>US North</li>
24+
<li>US South</li>
25+
<li>US South East</li>
26+
<li>US West</li>
27+
<li>US West2</li>
28+
<li>US West3</li>
29+
<li>US West Central</li>
30+
</ul>
31+
</details>
4032

41-
**Europe:**
42-
- Europe North
43-
- Europe West
44-
- France Central
45-
- France South
46-
- Germany North
47-
- Germany West Central
48-
- Italy North
49-
- Israel Central
50-
- Norway East
51-
- Norway West
52-
- Poland Central
53-
- Spain Central
54-
- Sweden Central
55-
- Sweden South
56-
- Switzerland North
57-
- Switzerland West
58-
- UK South
59-
- UK West
33+
<details>
34+
<summary>Europe</summary>
35+
<ul>
36+
<li>Europe North</li>
37+
<li>Europe West</li>
38+
<li>France Central</li>
39+
<li>France South</li>
40+
<li>Germany North</li>
41+
<li>Germany West Central</li>
42+
<li>Italy North</li>
43+
<li>Israel Central</li>
44+
<li>Norway East</li>
45+
<li>Norway West</li>
46+
<li>Poland Central</li>
47+
<li>Spain Central</li>
48+
<li>Sweden Central</li>
49+
<li>Sweden South</li>
50+
<li>Switzerland North</li>
51+
<li>Switzerland West</li>
52+
<li>UK South</li>
53+
<li>UK West</li>
54+
</ul>
55+
</details>
6056

61-
**Asia Pacific:**
62-
- Australia Central
63-
- Australia Central2
64-
- Australia East
65-
- Australia South East
66-
- New Zealand North
57+
<details>
58+
<summary>Asia Pacific</summary>
59+
<ul>
60+
<li>Australia Central</li>
61+
<li>Australia Central2</li>
62+
<li>Australia East</li>
63+
<li>Australia South East</li>
64+
<li>New Zealand North</li>
65+
</ul>
66+
</details>

‎articles/storage-discovery/pricing.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ For each Discovery workspace, you can select from free or paid options. The numb
4747
<td><ul><li>N/A</li></ul></td>
4848
<td>
4949
<ul>
50-
<li>Backfill*: 15 days</li>
51-
<li>Retention**: 15 days</li>
50+
<li>Backfill<sup>1</sup>: 15 days</li>
51+
<li>Retention<sup>2</sup>: 15 days</li>
5252
</ul>
5353
</td>
5454
</tr>
@@ -76,16 +76,16 @@ For each Discovery workspace, you can select from free or paid options. The numb
7676
</td>
7777
<td>
7878
<ul>
79-
<li>Backfill*: 30 days</li>
80-
<li>Retention**: 18 months</li>
79+
<li>Backfill<sup>1</sup>: 30 days</li>
80+
<li>Retention<sup>2</sup>: 18 months</li>
8181
</ul>
8282
</td>
8383
</tr>
8484
</tbody>
8585
</table>
8686

87-
\* The backfill feature automatically adds historic data into a Storage Discovery workspace from before the workspace is created.<br>
88-
\*\* Every workspace retains insights for some time to allow for historical analysis.
87+
<sup>1</sup> The backfill feature automatically adds historic data into a Storage Discovery workspace from before the workspace is created.<br>
88+
<sup>2</sup> Every workspace retains insights for some time to allow for historical analysis.
8989

9090
## Understand billing
9191

0 commit comments

Comments
 (0)