Azure Blob StorageAuthorCloudBrum editorial teamLast reviewed27 Oct 2026Reading time~12 minLevelBeginner to advanced

• Three kinds of blobBlock blobs hold files and are what you’ll use most. Append blobs suit logs that only grow. Page blobs back virtual machine disks. A block blob can reach about 190.7 TiB.
• Four access tiersHot for active data, Cool for data you touch now and then, Cold for rarer access, and Archive for data you almost never read. Cool, Cold and Archive have minimum storage periods.
• You choose the redundancyLocally redundant (three copies in one data centre), zone-redundant, geo-redundant, or geo-zone-redundant, with read access to the second Region as an option.
• Sign in with Entra IDGive people and apps a role such as Storage Blob Data Reader instead of a shared key. Time-limited SAS links are available when someone outside your tenant needs a file.
• Ways to undo a mistakeSoft delete keeps deleted blobs and containers for a set time, versioning keeps older copies, and point-in-time restore can roll block blobs back.
• Immutable storageTime-based retention and legal holds make blobs write-once-read-many, for records that must not be changed or deleted.
• Lifecycle managementA policy can move blobs to cooler tiers as they age, delete them, and clean up old versions and snapshots on a schedule.
• Data lake and file protocolsTurn on a hierarchical namespace to get Azure Data Lake Storage Gen2, with real folders and POSIX-style permissions. SFTP and NFS access are available on suitable accounts.

Storage account

The top-level resource that holds your data and sets its redundancy, networking and encryption. Its name is unique across Azure.

Container

A group of blobs inside a storage account, a bit like a bucket. Access control and policies often apply at this level.

Blob

One stored object: the data, its name and its metadata. Names can contain slashes, which the portal shows as folders.

Block blob

The standard blob type, built from blocks that upload in parallel. Up to 50,000 blocks of up to 4,000 MiB each.

Append blob

A blob you can only add to at the end, so it fits log files.

Page blob

A blob made of 512-byte pages for random reads and writes, used mostly for virtual machine disks.

Access tier

Hot, Cool, Cold or Archive. It sets the price of storing the blob and of reading it, and the tier can be changed per blob.

Redundancy

How many copies Azure holds and where: LRS, ZRS, GRS, GZRS, and the read-access versions of the geo options.

Soft delete

A deleted blob or container is kept, hidden, for a retention period so you can restore it.

Blob versioning

Each change to a blob keeps the earlier state as a version you can read or promote.

Immutable storage

WORM protection with a retention period or a legal hold, applied to a container or to individual versions.

Shared access signature (SAS)

A signed link or token that grants limited access to blobs for a limited time. A user delegation SAS is signed with Entra ID credentials and is the safer kind.

Hierarchical namespace

An option that makes folders real and renames fast, and turns the account into Azure Data Lake Storage Gen2. It has to be chosen when the account is created or upgraded.

Lifecycle management policy

Rules on the storage account that move or delete blobs based on age or last access.

Create a storage account and a container in the Azure portal

1. Start a storage accountSearch for Storage accounts, choose Create, then pick the subscription and resource group. Choose a region near your users or your compute.
2. Name it and set the basicsThe name is 3 to 24 characters, lower-case letters and numbers only, and unique across Azure. Choose Standard performance unless you know you need Premium block blobs.
3. Choose redundancyLocally redundant is cheapest. Zone-redundant protects against the loss of a data centre. Geo-redundant options add a copy in a paired region. Match the choice to how much you’d mind losing a day of data.
4. Close the doorsOn the advanced settings, keep Require secure transfer on, set the minimum TLS version to 1.2, and turn off anonymous access. Disable shared key access if your applications can use Entra ID.
5. Set the default tierHot suits most new data, and Cool suits backups and older files. You can still change individual blobs afterwards.
6. Limit the networkUnder Networking use selected networks or a private endpoint if the data shouldn’t be reachable from the whole internet.
7. Turn on data protectionEnable soft delete for blobs and containers, and versioning. They cost a little for the extra copies and rescue you from the usual mistakes.
8. Create a container and uploadOpen the account, choose Containers, add a private container, and upload a test file. Assign yourself or an app the Storage Blob Data Contributor role first, otherwise the portal may deny you.
9. Add a lifecycle rule and a budgetUnder Lifecycle management move blobs to Cool after the number of days that matches your reads, and set a cost alert on the resource group.

• Upload in parallel. The SDKs and AzCopy split large files into blocks and send them together, so raise the concurrency for big transfers.
• A single blob has a request-rate target, so spread very hot objects over several names rather than hammering one.
• Keep the account in the same region as the compute that uses it. Cross-region reads are slower and cost more.
• Use a CDN, such as Azure Front Door or Azure CDN, in front of content many people download.
• Premium block blob accounts give low, steady latency for workloads with many small operations, at a higher storage price.
• Avoid millions of tiny blobs where you can. Batch them into larger files for analytics, and use a hierarchical namespace when you rename or list folders heavily.
• Use private endpoints in the same virtual network as the workload, so traffic stays on Microsoft’s own network.
• Retry with exponential backoff on 500 and 503 responses; the SDKs have retry policies you can tune.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Azure Blob Storage.

• Match the tier to real access. Look at access patterns before moving data, because reading from Cool, Cold or Archive costs more than from Hot.
• Write lifecycle rules: tier by age or last access, delete old versions and snapshots, and remove expired data.
• Remember the minimum periods: 30 days for Cool, 90 for Cold and 180 for Archive. Early deletion or a tier change is billed for the rest of the period.
• Choose redundancy with intent. ZRS and geo options cost more than LRS, so use them where the data justifies it, and not everywhere.
• Watch operations. Many small reads and writes, and listing huge containers, add up faster than the capacity charge.
• Keep data and compute in one region, and use private networking, to avoid transfer charges.
• Soft-deleted data and old versions are billed like live data, so trim how long they stay.
• Delete test accounts, old snapshots and orphaned containers.
• Consider reservations for capacity you know you’ll hold for one or three years.
• Tag storage accounts by team and product, and set a budget alert on the resource group.

• Disable anonymous access at the account level.
• Use Entra ID and managed identities for applications, with the narrowest data role (for example Storage Blob Data Reader).
• Turn off shared key access once your clients can use Entra ID, and rotate keys if you must keep them.
• Prefer user delegation SAS over account SAS, keep it short-lived, and scope it to one container or blob.
• Require secure transfer and a minimum TLS 1.2.
• Use the storage firewall and private endpoints so the account isn’t open to the whole internet.
• Encrypt with customer-managed keys in Key Vault where policy requires them, and consider infrastructure encryption for extra assurance.
• Enable soft delete, versioning and, for records, immutable storage. Add a resource lock on important accounts.
• Send diagnostic logs to Log Analytics and alert on deletes, failed authentications and changes to account settings.
• Use Microsoft Defender for Storage to detect unusual access and malware uploads.

Use the Activity log and storage resource logs to see who changed an account or read a blob, Azure Policy to enforce settings, Microsoft Defender for Cloud for recommendations and alerts, and the Service Trust Portal for compliance reports. Azure Storage is in scope for many assurance programmes, but responsibility is shared: Microsoft runs the service, and you own the identities, network rules, encryption choices and data.

• Delete data nobody needs. Every byte you keep sits on powered hardware, and removing it is the cheapest saving.
• Compress files and pick compact formats, which leaves less to hold, move and process.
• Use lifecycle rules so cold data moves to cooler tiers, and choose LRS when the data truly doesn’t need extra copies.
• A CDN in front of busy content means the storage account serves each file once and the edge does the rest.
• Place accounts in the region of the compute that reads them, which also trims long-distance transfer.
• Pick a region on a lower-carbon grid for large archives that have no latency needs.
• The Microsoft Emissions Impact Dashboard reports estimated emissions for your Azure usage. Find out how it treats storage before quoting a figure.

Purchase options

What you actually pay for

• Capacity, by tier, redundancy and region
• Operations, per ten thousand
• Data retrieval for Cool, Cold and Archive, and early-deletion charges
• Outbound data transfer, and geo-replication data transfer
• Features: premium performance, hierarchical namespace transactions, point-in-time restore, Defender for Storage and others

A private storage account for user uploads, set up as you’d want it in production: no anonymous access, no account keys, TLS 1.2, versioning, soft delete and a lifecycle rule. The CLI and Terraform tabs create it. The Python and C# tabs upload an invoice and return a read-only link that lapses after 15 minutes, signed with Entra ID instead of a key. Use your own account name, region and blob names.

# The account name must be 3-24 lower-case letters and numbers, unique across Azure
RG=rg-uploads
ACCOUNT=acmeuploads123456
LOCATION=centralindia

az group create --name $RG --location $LOCATION

# Zone-redundant, no anonymous access, no account keys, TLS 1.2 or later
az storage account create --name $ACCOUNT --resource-group $RG --location $LOCATION \
  --sku Standard_ZRS --kind StorageV2 --access-tier Hot \
  --min-tls-version TLS1_2 --https-only true \
  --allow-blob-public-access false --allow-shared-key-access false

# Let yourself use the data plane (keys are off, so the role is what lets you in; it can take a few minutes)
ACCOUNT_ID=$(az storage account show --name $ACCOUNT --resource-group $RG --query id --output tsv)
ME=$(az ad signed-in-user show --query id --output tsv)
az role assignment create --assignee $ME --role "Storage Blob Data Contributor" --scope $ACCOUNT_ID

# Keep older versions, and deleted blobs and containers for 14 days
az storage account blob-service-properties update --account-name $ACCOUNT --resource-group $RG \
  --enable-versioning true \
  --enable-delete-retention true --delete-retention-days 14 \
  --enable-container-delete-retention true --container-delete-retention-days 14

az storage container create --account-name $ACCOUNT --name uploads --auth-mode login

# Cool after 30 days, old versions removed after 90
cat > policy.json <<'JSON'
{
  "rules": [{
    "name": "age-out",
    "enabled": true,
    "type": "Lifecycle",
    "definition": {
      "filters": {"blobTypes": ["blockBlob"]},
      "actions": {
        "baseBlob": {"tierToCool": {"daysAfterModificationGreaterThan": 30}},
        "version": {"delete": {"daysAfterCreationGreaterThan": 90}}
      }
    }
  }]
}
JSON
az storage account management-policy create --account-name $ACCOUNT --resource-group $RG --policy @policy.json

# Upload, then make a read-only link that works for 15 minutes (signed with Entra ID, not a key)
az storage blob upload --account-name $ACCOUNT --container-name uploads \
  --name invoices/2026/10/invoice-1042.pdf --file ./invoice-1042.pdf --auth-mode login

az storage blob generate-sas --account-name $ACCOUNT --container-name uploads \
  --name invoices/2026/10/invoice-1042.pdf --permissions r \
  --expiry $(date -u -d "+15 minutes" "+%Y-%m-%dT%H:%MZ") \
  --auth-mode login --as-user --full-uri

# Assumes var.location and var.account_name (3-24 lower-case letters and numbers).
# With shared keys off, set storage_use_azuread = true in the azurerm provider block so Terraform signs in with Entra ID.
resource "azurerm_resource_group" "uploads" {
  name     = "rg-uploads"
  location = var.location
}

resource "azurerm_storage_account" "uploads" {
  name                     = var.account_name
  resource_group_name      = azurerm_resource_group.uploads.name
  location                 = azurerm_resource_group.uploads.location
  account_kind             = "StorageV2"
  account_tier             = "Standard"
  account_replication_type = "ZRS"
  access_tier              = "Hot"

  min_tls_version                 = "TLS1_2"
  https_traffic_only_enabled      = true
  allow_nested_items_to_be_public = false  # no anonymous access
  shared_access_key_enabled       = false  # Entra ID only

  blob_properties {
    versioning_enabled = true

    delete_retention_policy {
      days = 14
    }
    container_delete_retention_policy {
      days = 14
    }
  }
}

resource "azurerm_storage_container" "uploads" {
  name                  = "uploads"
  storage_account_id    = azurerm_storage_account.uploads.id
  container_access_type = "private"
}

resource "azurerm_storage_management_policy" "uploads" {
  storage_account_id = azurerm_storage_account.uploads.id

  rule {
    name    = "age-out"
    enabled = true

    filters {
      blob_types = ["blockBlob"]
    }

    actions {
      base_blob {
        tier_to_cool_after_days_since_modification_greater_than = 30
      }
      version {
        delete_after_days_since_creation = 90
      }
    }
  }
}

# pip install azure-storage-blob azure-identity
from datetime import datetime, timedelta, timezone

from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobSasPermissions, BlobServiceClient, ContentSettings, generate_blob_sas

ACCOUNT = "acmeuploads123456"
CONTAINER = "uploads"

# DefaultAzureCredential finds a managed identity in Azure, or your own login (az login) on a laptop
service = BlobServiceClient(f"https://{ACCOUNT}.blob.core.windows.net", credential=DefaultAzureCredential())
container = service.get_container_client(CONTAINER)


def upload_invoice(path, name):
    """Upload one file. The SDK splits large files into blocks and sends them in parallel."""
    with open(path, "rb") as data:
        container.upload_blob(
            name,
            data,
            overwrite=True,
            content_settings=ContentSettings(content_type="application/pdf"),
            metadata={"origin": "billing-service"},
        )


def download_link(name, minutes=15):
    """A read-only link signed with a user delegation key, so no account key is involved."""
    now = datetime.now(timezone.utc)
    expiry = now + timedelta(minutes=minutes)
    key = service.get_user_delegation_key(now, expiry)
    token = generate_blob_sas(
        account_name=ACCOUNT,
        container_name=CONTAINER,
        blob_name=name,
        user_delegation_key=key,
        permission=BlobSasPermissions(read=True),
        expiry=expiry,
    )
    return f"https://{ACCOUNT}.blob.core.windows.net/{CONTAINER}/{name}?{token}"


def list_prefix(prefix):
    """All blob names under a prefix. The SDK handles paging."""
    return [blob.name for blob in container.list_blobs(name_starts_with=prefix)]


if __name__ == "__main__":
    name = "invoices/2026/10/invoice-1042.pdf"
    upload_invoice("invoice-1042.pdf", name)
    print(download_link(name))
    print(list_prefix("invoices/2026/10/"))

// Program.cs: upload a blob, then print a read-only link signed with Entra ID that lapses in 15 minutes
// NuGet packages: Azure.Storage.Blobs (a recent version), Azure.Identity
using Azure.Identity;
using Azure.Storage.Blobs;
using Azure.Storage.Blobs.Models;
using Azure.Storage.Sas;

const string account = "acmeuploads123456";
const string blobName = "invoices/2026/10/invoice-1042.pdf";

// DefaultAzureCredential finds a managed identity in Azure, or your own login on a laptop
var service = new BlobServiceClient(new Uri($"https://{account}.blob.core.windows.net"), new DefaultAzureCredential());
var container = service.GetBlobContainerClient("uploads");
var blob = container.GetBlobClient(blobName);

// Upload; the SDK sends large files in parallel blocks
await blob.UploadAsync("invoice-1042.pdf", new BlobUploadOptions
{
    HttpHeaders = new BlobHttpHeaders { ContentType = "application/pdf" },
    Metadata = new Dictionary<string, string> { ["origin"] = "billing-service" }
});

// A read-only link signed with a user delegation key, so no account key is involved
var starts = DateTimeOffset.UtcNow;
var expires = starts.AddMinutes(15);
var key = (await service.GetUserDelegationKeyAsync(new BlobGetUserDelegationKeyOptions(expires) { StartsOn = starts })).Value;

var sas = new BlobSasBuilder
{
    BlobContainerName = container.Name,
    BlobName = blobName,
    Resource = "b",
    StartsOn = starts,
    ExpiresOn = expires
};
sas.SetPermissions(BlobSasPermissions.Read);

var link = new BlobUriBuilder(blob.Uri) { Sas = sas.ToSasQueryParameters(key, account) }.ToUri();
Console.WriteLine(link);

// Walk the blobs under a prefix; the SDK pages for you
await foreach (var item in container.GetBlobsAsync(BlobTraits.None, BlobStates.None, "invoices/2026/10/", CancellationToken.None))
{
    Console.WriteLine($"{item.Name}  {item.Properties.ContentLength} bytes");
}

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

Blob Storage is one part of the storage account. Files that need a shared network share belong in Azure Files, disks for virtual machines are managed disks, and if you need queues or tables, the same account can hold those too. For serverless code that reacts to new blobs, see Azure Functions.