Series
Azure Storage: Accounts, Blobs, Files, and Disks
Almost every Azure design ends up leaning on a storage account. Virtual machine disks sit on one, App Service backups land in one, diagnostic logs drain into one, and any application that needs to keep a file somewhere durable eventually points at one. Which makes it worth understanding properly because a handful of decisions taken at creation time, in about ninety seconds of portal clicks, can't be undone later without building a new account and copying everything across.
This series works through that whole Azure platform. It starts with the account itself: the five services inside it, the four account kinds, and the performance tier and redundancy options that are fixed the moment you click create. It covers Blob Storage in depth, the three blob types and their very different size limits, what enabling the hierarchical namespace turns the service into, and the access tier and lifecycle rules that decide what the account actually costs to run. It works through the security model from account keys and shared access signatures to Microsoft Entra ID, then the data protection features underneath: soft delete, versioning, point-in-time restore, and the two flavours of WORM immutability. It covers Azure Files end to end. The newer management model, the media tiers and billing models that replaced the old four-tier framing, identity-based access, snapshots, and caching shares on-premises with File Sync. And it finishes with managed disks and the tooling that moves data in and out.
Throughout, the emphasis is on the constraints that decide designs rather than the feature lists that describe them: why the Archive tier and zone redundancy can't coexist on one account, why blob soft delete doesn't protect a deleted container, why a leaked SAS token can only be revoked by rotating the key that signed it, and why object replication blocks writes to its own destination.
It also covers several live changes worth knowing: Azure Disk Encryption's 2028 retirement and the reboot failure it produces on that date, the Azure Files tier model that most training material still describes incorrectly, and the shift from the Storage Emulator to Azurite.
14 parts
- 1 Azure Storage Account Types and Performance Tiers What an Azure storage account actually is: the five services it contains, the four account kinds, and why the performance tier and account kind are one-way doors you can't change after creation.
- 2 Azure Storage Redundancy: LRS, ZRS, GRS, and GZRS The six Azure Storage redundancy options and what each one actually survives — from a single drive failure to a region-wide outage — plus the paired-region, failover, and read-access constraints that decide between them.
- 3 Azure Blob Storage: Block, Page, and Append Blobs The three blob types and what each is for, how containers organise them, and what enabling the hierarchical namespace turns Blob Storage into — including how POSIX ACLs work there and why the Reader, Contributor, and Owner roles bypass them for read access.
- 4 Azure Blob Access Tiers: Hot, Cool, Cold, and Archive How the four blob access tiers trade storage cost against access cost, the minimum retention periods and prorated early deletion charges, and the two Archive constraints: no zone-redundant accounts, and it can't be an account's default tier.
- 5 Azure Blob Lifecycle Management Rules How to automate moving blobs between access tiers and deleting them on a schedule: rule scope and filters, last-modified versus last-accessed triggers, and why rules can't rehydrate archived blobs or tier data in premium block blob accounts.
- 6 Securing Azure Storage: Access Keys, SAS, and Entra ID The four ways to authorise a request against Azure Storage, why a leaked SAS token can only be revoked by rotating the account key, and how stored access policies fix that.
- 7🔒 Azure Blob Soft Delete, Versioning, and Immutability The in-account data protection features and how they depend on each other: soft delete's scope limits, why point-in-time restore needs soft delete, versioning, and change feed all enabled, and how container-level and version-level WORM immutability differ.
- 8🔒 Azure Storage Networking and Encryption Narrowing a storage account's network exposure from public internet to private endpoint and the encryption model underneath it. Customer-managed keys, infrastructure encryption and why encryption scopes only work for blobs.
- 9🔒 Azure Storage Object Replication Asynchronously copying block blobs between storage accounts, the versioning and change feed prerequisites, why writes to the destination are blocked, and how AllowCrossTenantReplication defaults for accounts created from 15 December 2023 onwards.
- 10 Azure Files: SMB, NFS, and Choosing a Share Tier The two Azure Files management models, the SSD and HDD media tiers with their three billing models, and the protocol and redundancy constraints that decide between them — including why Azure Files can't read from the secondary of an RA-GRS account.
- 11🔒 Azure Files Access Control and Snapshots The four ways to authenticate to an SMB file share and why the account key is effectively an admin credential, plus what share snapshots, soft delete, and Azure Backup each protect — and why deleting a share deletes its snapshots with it.
- 12 Azure File Sync and Cloud Tiering How Azure File Sync turns a Windows Server into a cache of an Azure file share, what cloud tiering replaces local files with, and the three components you need to set synchronisation up.
- 13 Azure Managed Disks: Ultra, Premium SSD v2, and Standard The five managed disk types and what separates them on size, IOPS, and OS-disk eligibility, plus the four encryption options — including Azure Disk Encryption's retirement on 15 September 2028, after which ADE disks fail to unlock on reboot.
- 14 Azure Storage Explorer and AzCopy The two tools for moving data in and out of Azure Storage: attaching Storage Explorer to accounts you don't own, AzCopy's command set, and which service endpoint each command needs.