Work with blobs, file shares and data tools

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Configure blob storage, Azure Files and data tools

Use containers and blobs

Blobs live in containers (like folders at the top level). Most files are block blobs.

$az storage container create --account-name stshop2026 --name backups --auth-mode login
$az storage blob upload --account-name stshop2026 -c backups -f db-2026-10-27.sql.gz -n db/db-2026-10-27.sql.gz --auth-mode login
$az storage blob list --account-name stshop2026 -c backups --prefix db/ --auth-mode login -o table
$az storage blob download --account-name stshop2026 -c backups -n db/db-2026-10-27.sql.gz -f restore.sql.gz --auth-mode login

Blob type	Used for
Block blob	Files, images, backups, logs
Append blob	Logs that only grow
Page blob	Virtual disks

5.2

Choose access tiers

Hot data costs more to store and less to read. Archive data is cheap to store but must be rehydrated (hours) before reading.

Tier	Use	Minimum days
Hot	Used often	—
Cool	Used rarely	30
Cold	Used very rarely	90
Archive	Long-term, offline	180

$az storage blob set-tier --account-name stshop2026 -c backups -n db/old.sql.gz --tier Archive --auth-mode login

5.3

Automate tiers with lifecycle rules

Lifecycle management moves blobs to cheaper tiers and deletes them after a number of days — automatically.

lifecycle.json

{"rules":[{"name":"backups","enabled":true,"type":"Lifecycle",
  "definition":{"filters":{"blobTypes":["blockBlob"],"prefixMatch":["backups/db/"]},
  "actions":{"baseBlob":{"tierToCool":{"daysAfterModificationGreaterThan":30},
    "tierToArchive":{"daysAfterModificationGreaterThan":90},
    "delete":{"daysAfterModificationGreaterThan":365}}}}}]}

$az storage account management-policy create --account-name stshop2026 -g rg-data --policy @lifecycle.json

5.4

Protect data from deletion

Turn on the safety nets before you need them.

Feature	Protects against
Blob soft delete	Deleted or overwritten blobs (kept N days)
Container soft delete	Deleted containers
Versioning	Overwrites: every change keeps the old version
Point-in-time restore	Mistakes on many blobs (needs versioning and change feed)
Immutability (WORM)	Any change or delete for a time, or under legal hold

$az storage account blob-service-properties update --account-name stshop2026 -g rg-data \
    --enable-delete-retention true --delete-retention-days 14 --enable-versioning true \
    --enable-container-delete-retention true --container-delete-retention-days 14

At work

Backups in blob storage with an immutability policy cannot be deleted by ransomware — not even by an admin account that was taken over.

5.5

Create Azure Files shares

Azure Files gives SMB shares (Windows, Linux, macOS) or NFS shares (Linux) in the cloud.

$az storage share-rm create --storage-account stshop2026 -g rg-data --name team --quota 100
#mkdir -p /mnt/team
#mount -t cifs //stshop2026.file.core.windows.net/team /mnt/team -o vers=3.1.1,credentials=/etc/smbcredentials/stshop2026.cred,dir_mode=0770,file_mode=0660,serverino
$az storage share snapshot --account-name stshop2026 --name team

SMB needs outbound port 445 — many home and office networks block it.
Share snapshots and soft delete protect against mistakes.
Azure File Sync keeps a cache of a share on Windows file servers.

5.6

Move data with AzCopy

AzCopy is a fast command-line tool to copy and sync data to and from storage.

$azcopy login
$azcopy copy '/srv/www/*' 'https://stshop2026.blob.core.windows.net/site' --recursive
$azcopy sync '/srv/www' 'https://stshop2026.blob.core.windows.net/site' --delete-destination true
$azcopy copy 'https://src.blob.core.windows.net/data?SAS' 'https://dst.blob.core.windows.net/data?SAS' --recursive
$azcopy jobs list

Other tools: Azure Storage Explorer (desktop app), the portal's Storage browser, and Azure Import/Export or Data Box for very large data on physical disks.

5.7

Copy data between regions

Object replication copies new and changed block blobs from one account to another (for example in another region), asynchronously.

Needs versioning on both accounts and the change feed on the source.
Rules choose the containers and an optional prefix.

All commands in this chapter