Blob Storage — Containers, Access Tiers, Lifecycle and Blob Types

Azure Basics · Azure Storage – Accounts, Replication, Blobs, Security and Files · Lesson 3 of 5

Blobs live in containers; the Hot, Cool, Cold and Archive tiers trade storage cost for access cost; lifecycle policies move or delete blobs automatically; the blob type (block, append, page) cannot change after creation.

Blob is object storage for unstructured data: images and documents for the web, streaming, backup/DR/archive, analytics data. Every blob lives in a container (an account holds unlimited containers, a container unlimited blobs).

Container access level	Meaning
Private (`off`)	No anonymous access (default; new accounts also disable anonymous access entirely)
Blob	Anonymous read of individual blobs, no container listing
Container	Anonymous read and listing of the whole container

Access tiers

Tier	Use when	Minimum retention
Hot	Accessed often	—
Cool	Rarely accessed	30 days
Cold	Very rarely accessed	90 days
Archive	Almost never read, hours of latency acceptable	180 days

flowchart LR
  Hot["Hot"] -- "lifecycle: 30 days unmodified" --> Cool["Cool"]
  Cool -- "90 days" --> Cold["Cold"]
  Cold -- "180 days" --> Arc["Archive (offline)"]
  Arc -- "rehydrate: hours" --> Hot

Archive blobs are offline: reading them needs a rehydrate to Hot/Cool/Cold (up to ~15 hours, faster with High priority).
Lifecycle management: rules move tiers or delete by age, filtered by prefix. Object replication copies blobs asynchronously to another account.
Blob types: Block (default, regular files), Append (append-only — logs), Page (random read/write — VM disks). The type cannot change after creation.
Costs include capacity, transactions, data reads, tier changes, geo-replication and outbound transfer.

Command	Meaning
`az storage container create --account-name stdevopslab01 -n backups --auth-mode login`	Create a private container
`az storage blob upload --account-name stdevopslab01 -c backups -f ./db.bak -n db.bak --auth-mode login`	Upload
`az storage blob set-tier --account-name stdevopslab01 -c backups -n db.bak --tier Cool --auth-mode login`	Change the tier

Data protection features

Feature	Protects against
Blob soft delete	Accidental delete or overwrite of a blob, recoverable for a set number of days
Container soft delete	Deleting a whole container
Versioning	Keeps every previous version automatically on each write
Point-in-time restore	Rolls block blobs in an account back to an earlier time
Immutability (WORM)	Time-based retention or legal hold, so nobody can change or delete data, not even an admin

Turn soft delete and versioning on for important accounts; they cost only the extra data kept. Immutability is used for compliance records and to protect backups from ransomware.

Other things Blob can do

Static website hosting serves files from a special $web container over HTTPS, a cheap host for a single-page app or documentation.
Data Lake Storage enables a hierarchical namespace on the account, giving real directories and POSIX-like ACLs for analytics engines such as Spark and Databricks.
Change feed records every create, update, and delete in order, so other systems can react.
Blob index tags let you find blobs by key/value without listing everything.
SFTP and NFS 3.0 access can be enabled for tools that cannot speak REST.

Addressing and serving

Every blob has a URL of the form https://<account>.blob.core.windows.net/<container>/<path/name>. Slashes in the name look like folders but are only part of the name unless the hierarchical namespace is on. For public content at scale, put Azure Front Door in front of the account to cache files near users.

Uploading large files

SDKs and AzCopy split large files into blocks uploaded in parallel and then committed, which is faster and lets an interrupted upload resume. Set --content-type correctly when uploading web assets, or browsers may download them instead of displaying them.