Storage Accounts, the Four Services and Account Kinds

Azure Basics · Azure Storage – Accounts, Replication, Blobs, Security and Files · Lesson 1 of 5

A storage account gives a unique namespace for Blob, Files, Queues and Tables; StorageV2 (Standard general-purpose v2) is the default choice, Premium is for low latency.

Azure Storage is a durable, secure, scalable and managed storage service. A storage account holds four services:

Service	Used for	Endpoint
Blob	Objects (images, video, backups, analytics data) in containers	`https://stdevopslab01.blob.core.windows.net`
Files	Managed SMB/NFS file shares	`…file.core.windows.net`
Queues	Messages between application components	`…queue.core.windows.net`
Tables	Structured NoSQL data (keys/attributes)	`…table.core.windows.net`

flowchart TB
  SA["Storage account stdevopslab01<br/>(StorageV2, Standard_LRS)"] --> B["Blob: container backups"]
  SA --> F["Files: share1"]
  SA --> Q["Queues"]
  SA --> T["Tables"]

Account kind	When to use
Standard general-purpose v2 (`StorageV2`)	Most cases: blob, file, queue, table, Data Lake
Premium block blobs (`BlockBlobStorage`)	High transaction rates, low latency
Premium file shares (`FileStorage`)	High-performance file shares, NFS
Premium page blobs	High-performance page blobs

Storage (GPv1) and BlobStorage are legacy kinds — use StorageV2.

Account names are globally unique, 3–24 characters, lowercase letters and digits only (they are part of the URL).
All data is encrypted at rest (SSE, AES-256).
az storage account create without --sku uses the default Standard_RAGRS (pricier than LRS); state it explicitly.

Command	Meaning
`az storage account create -n stdevopslab01 -g rg-devops-lab -l southeastasia --sku Standard_LRS --kind StorageV2`	Create a GPv2 account
`az storage account show -n stdevopslab01 -g rg-devops-lab --query primaryEndpoints`	Show the endpoints

Choices made at creation

Setting	Options	Can change later?
Performance	Standard (HDD-backed) or Premium (SSD)	No; create a new account
Redundancy	LRS, ZRS, GRS, GZRS and read-access variants	Often, with some conversions
Default access tier	Hot or Cool for new blobs	Yes
Hierarchical namespace	Off or on (Data Lake Storage)	Upgrade possible once, not back
Networking	Public, selected networks, or private only	Yes

Settings that cannot change are worth deciding carefully, because moving data to a new account takes time.

Queues and Tables compared

Queue storage is a simple, cheap message queue with messages up to 64 KiB; for ordering, sessions, topics, or larger messages, use Azure Service Bus. Table storage is a basic key/attribute store; Azure Cosmos DB for Table offers the same API with global distribution and lower latency at a higher price.

Limits and naming

A subscription can hold a limited number of storage accounts per region (250 by default, raisable on request), and each account has published scalability targets for requests per second and bandwidth. Spreading very heavy workloads across several accounts avoids throttling. A naming pattern such as st<app><env><nn> works within the 24-character, lowercase rule.

Keys and recovery

Each account has two access keys so you can rotate one while applications use the other. Better still, disable Shared Key access and use Entra ID. A deleted storage account can usually be recovered for up to 14 days from the portal, provided no new account with the same name was created, but its data protection settings matter more than relying on this.

az storage account list -g rg-devops-lab -o table gives a quick inventory with kind, SKU, and location.