TopolearnBlob Storage is Azure's object store for uploads, backups, static content and data lakes.
Blobs live in containers inside a storage account: https://<account>.blob.core.windows.net/<container>/<path/name>. Most blobs are block blobs (files of any kind); append blobs suit logs, page blobs back VM disks. "Folders" are just / in names, unless you enable the hierarchical namespace (Data Lake Storage), which gives real directories and atomic renames.
Access tiers trade storage cost against access cost:
- Hot: frequent access.
- Cool: infrequent, 30-day minimum retention.
- Cold: rarely accessed, 90-day minimum.
- Archive: offline, 180-day minimum; reading needs rehydration, which can take hours.
Lifecycle management policies move or delete blobs automatically by age, e.g. cool after 30 days, archive after 180.
To let a client upload or download without your credentials, issue a shared access signature (SAS): a URL with signed, time-limited permissions. Prefer a user delegation SAS, signed with an Entra ID key rather than the account key, so it can be revoked and audited. Keep expiry short and permissions minimal.
Protect data with soft delete for blobs and containers, versioning, and immutability policies for compliance.
Example
az storage container create --account-name stordersprod01 -n invoices --auth-mode login
az storage blob upload --account-name stordersprod01 -c invoices \
-n 2026/10/inv-1001.pdf -f ./inv-1001.pdf --tier Cool --auth-mode login
# Read-only user delegation SAS valid for one hour
END=$(date -u -d "+1 hour" +%Y-%m-%dT%H:%MZ)
az storage blob generate-sas --account-name stordersprod01 -c invoices \
-n 2026/10/inv-1001.pdf --permissions r --expiry "$END" \
--auth-mode login --as-user --full-uri
# https://stordersprod01.blob.core.windows.net/invoices/2026/10/inv-1001.pdf?skoid=...&sig=...Remember
- Container + blob name = object; folders are name prefixes
- Hot, Cool, Cold, Archive: cheaper storage, costlier and slower access
- Use lifecycle rules to tier and expire automatically
- Prefer short-lived user delegation SAS over account-key SAS
Watch out for
- Putting blobs in Archive and expecting to read them immediately.
- Issuing long-lived account-key SAS tokens that can only be revoked by rotating the key.