After this lesson, you will be able to: Use Azure Blob Storage: containers, access tiers (Hot / Cool / Archive), SAS tokens, static website hosting.
Blob Storage is Azure's S3. Same purpose; different names + pricing model.
A Storage Account is the top-level resource. It contains containers (= S3 buckets). Containers hold blobs (= S3 objects). Storage Account performance tiers: Standard (HDD / SSD) and Premium (low-latency SSD; for VHDs / file shares). Replication: LRS (local, cheap), ZRS (zone-redundant), GRS (geo-redundant). Pick based on durability + budget. Default for most projects: Standard + LRS. Upgrade when needed.
Hot: default; cheap reads / expensive storage. For data accessed often. Cool: cheaper storage / pricier reads. For data accessed monthly-ish. 30-day min. Cold: even cheaper. 90-day min. Archive: cheapest. 180-day min. Retrieval takes hours. For long-term backups / compliance. Lifecycle rules: 'move to Cool after 30 days; Archive after 180; delete after 7 years'.
Same shape as aws s3 commands.
# Create a container in an existing storage accountaz storage container create -n mycontainer --account-name mystorage# Uploadaz storage blob upload --account-name mystorage -c mycontainer -n file.txt -f ./file.txt# Downloadaz storage blob download --account-name mystorage -c mycontainer -n file.txt -f ./file.txt# Sync (rsync-like)az storage blob sync -s ./local-dir --account-name mystorage -c mycontainer# Listaz storage blob list --account-name mystorage -c mycontainer --output table# Generate a SAS token (temporary signed URL)az storage blob generate-sas --account-name mystorage -c mycontainer -n file.txt \--permissions r --expiry 2026-12-31T23:59Z --https-only
SAS = Shared Access Signature. The Azure equivalent of S3 presigned URLs. Three flavors: User Delegation SAS (preferred, signed by Entra ID identity, audit-logged), Service SAS (signed by storage account key), Account SAS (full account access, avoid). Set expiry + permissions + IP restrictions. Pattern: server generates SAS; client uploads / downloads directly without proxying through your server.
Built into Blob Storage. Enable 'Static website' on a Storage Account; upload your dist/ to $web container; get a public URL. Cheaper than S3 + CloudFront for tiny sites. For real production: pair with Azure Front Door (CDN + WAF). Custom domains via Front Door or directly on the storage account.
Storage account keys committed to code. Always use Managed Identity or SAS instead. No lifecycle rules. Old data accrues in Hot tier forever; bill grows. Public container access enabled by default. Block at the storage account level unless intentional. GRS replication on dev-only data. 2x cost for no real benefit. LRS is fine for non-prod. Mixing storage tiers without tagging. Cost reports become useless without tags.
Pick the right pattern.
Sign in and purchase access to unlock this lesson.