Quick Diagnosis Cards¶

Use these cards when you have less than a minute to decide which storage playbook to open first.

mermaid flowchart LR A[Symptom] --> B[First check] B --> C[Likely category] C --> D[Playbook]

Card 1: Cannot reach storage endpoint¶

Step	Action
Symptom	Endpoint unreachable, timeout, or connection failure
First check	`nslookup` result and storage firewall rule set
What to look for	wrong public/private IP, firewall default deny, unapproved private endpoint
Playbook	Cannot Access Storage Account

Step	Action
Symptom	Private endpoint configured, but client still hits public route or fails name resolution
First check	private DNS zone, VNet link, returned IP
What to look for	public IP returned for a private access expectation
Playbook	Private Endpoint and DNS Issues

Step	Action
Symptom	403, AuthorizationFailure, authentication mismatch
First check	auth method, RBAC scope, shared-key policy
What to look for	control-plane role mistaken for data-plane role
Playbook	Authorization Failures

Step	Action
Symptom	SAS token seems valid but request fails
First check	`st`, `se`, `sp`, scope, protocol, IP restriction
What to look for	expired or not-yet-valid SAS, wrong permissions, wrong resource scope
Playbook	SAS and Token Issues

Step	Action
Symptom	Low throughput without obvious auth or DNS errors
First check	transfer concurrency, object size mix, regional RTT
What to look for	small-file penalty, single-thread transfer, distant client
Playbook	Slow Upload / Download

Step	Action
Symptom	throttling, server busy, latency spikes under load
First check	Transactions, SuccessServerLatency, availability trend
What to look for	bursts beyond account or partition tolerance
Playbook	Throttling and Performance Issues

Step	Action
Symptom	missing blob/file or need to roll back state
First check	soft delete, versioning, backup, retention window
What to look for	recovery feature existed before incident
Playbook	Data Protection and Recovery Issues