How blob storage is organised
Blob storage keeps unstructured data: documents, images, backups, logs and anything else that is a file rather than a database row. It has three levels:
- The storage account, which you created yesterday.
- Containers, which group blobs inside the account, much like top-level folders. An account can hold any number of containers.
- Blobs, the files themselves.
Blob storage has no real folders. A name such as reports/2026/october.pdf is one blob whose name contains slashes. Tools show it as folders to make it easier to browse. If you need true directories, with permissions on each folder, turn on the hierarchical namespace when you create the account, which makes it a Data Lake Storage account.
Three kinds of blob
- Block blobs hold files and most everyday data. They are what you will use almost all the time.
- Append blobs are built for data that is only ever added to, such as logs.
- Page blobs store random-access data, such as the disks of virtual machines. You rarely create these yourself, because managed disks handle them for you.
Access tiers in brief
Block blobs can be stored in one of four access tiers. You pay less to store data in the cooler tiers and more to read it.
- Hot for data in regular use.
- Cool for data kept at least 30 days and read occasionally.
- Cold for data kept at least 90 days and read rarely.
- Archive for data kept at least 180 days that can wait hours to be read. An archived blob must be rehydrated to an online tier before you can read it, which can take up to 15 hours.
The account has a default tier of hot, cool or cold, which new blobs use unless you set one. Archive can only be set on individual blobs. Moving or deleting a blob before its minimum period ends incurs an early deletion charge. Tomorrow's lesson goes deeper into choosing tiers.
Access to containers
Each container can allow anonymous public read access or none. Keep it off. Since day 4 your account blocks anonymous access, so containers stay private and every request must be authorised, with Entra ID or a shared access signature. Days 14 and 15 cover both.
Try it
az storage container create --account-name stportfoliodemo01 --name reports --auth-mode login
az storage blob upload --account-name stportfoliodemo01 --container-name reports \
--name 2026/october.txt --file ./october.txt --auth-mode login
az storage blob list --account-name stportfoliodemo01 --container-name reports \
--auth-mode login --output table
--auth-mode login uses your Entra ID sign-in instead of the account key. You need a data role such as Storage Blob Data Contributor on the account for these commands to work, even if you own the subscription.
Today's task
Create a container, upload two files into it with names that look like folders, list them, then change one blob to the cool tier in the portal. Day 27 looks at what each tier costs in detail.