Azure Blob

---
name: azure-blob
description: "Azure Blob Storage service administration and design: storage accounts, access tiers (Hot/Cool/Cold/Archive), ADLS Gen2, lifecycle management, object replication, immutability (WORM), private endpoints, NFS 3.0, SFTP, and Microsoft Defender for Storage. Use for \"Azure Blob\", \"Blob Storage\", \"storage account\", \"access tier\", \"ADLS Gen2\", \"Data Lake Storage\", \"hierarchical namespace\", \"Azure archive\", \"blob lifecycle\", \"object replication\", \"immutability\", \"WORM Azure\", \"private endpoint storage\", \"NFS Azure\", \"SFTP Azure\", \"BlobFuse\", \"Smart Tier\". Do NOT use for general Azure subscription/VNet/multi-service architecture — that's the `cloud-platforms` plugin."
license: MIT
---

# Azure Blob Storage

This skill covers Azure Blob Storage, including:

- Storage account types (GPv2, Premium block blob, Premium page blob) and redundancy options (LRS through RA-GZRS)
- Blob types (block, append, page) and access tiers (Hot, Cool, Cold, Archive)
- Azure Data Lake Storage Gen2 (hierarchical namespace, POSIX ACLs, DFS endpoint)
- Lifecycle management policies with last access time tracking and Smart Tier
- Object replication (cross-region, cross-subscription, priority replication)
- Immutability policies (WORM): time-based retention, legal hold, container vs version level
- Multi-protocol access: HTTPS/REST, NFS 3.0, SFTP, BlobFuse2
- Security: Microsoft Entra ID, SAS tokens, Block Public Access, CMK encryption, Defender for Storage
- Networking: private endpoints, VNet service endpoints, firewall rules, NSP
- Versioning, soft delete, point-in-time restore, change feed, blob index tags
- Cost management: reserved capacity, tier optimization, egress reduction
- Monitoring: Azure Monitor metrics, diagnostic logging, KQL queries, Storage Insights

For cross-platform storage comparisons, see the `overview` skill.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for 403/404 errors, throttling, replication status, cost analysis, KQL queries, alerts
   - **Architecture / design** -- Load `references/architecture.md` for account types, blob types, tiers, redundancy, ADLS Gen2, lifecycle, replication, immutability, private endpoints
   - **Best practices** -- Load `references/best-practices.md` for account design, tier optimization, security hardening, networking, cost management, data lifecycle patterns

2. **Load context** -- Read the relevant reference file.

3. **Analyze** -- Consider account type, redundancy needs, access patterns, compliance requirements, Microsoft ecosystem integration.

4. **Recommend** -- Provide actionable guidance with Azure CLI commands, PowerShell, ARM/Bicep, or portal steps.

## Core Concepts

### Resource Hierarchy

```
Azure Subscription
  -> Storage Account (namespace, billing, auth, network boundary)
    -> Container (logical grouping)
      -> Blob (individual object)
```

### Access Tiers

| Tier | Type | Availability | Min Retention | Retrieval |
|---|---|---|---|---|
| Hot | Online | 99.9% | None | ms |
| Cool | Online | 99% | 30 days | ms |
| Cold | Online | 99% | 90 days | ms |
| Archive | Offline | 99% | 180 days | Up to 15 hours |

Cost direction: storage cost decreases Hot -> Cool -> Cold -> Archive; access cost increases.

### Redundancy

| Option | Copies | Scope | Secondary Reads |
|---|---|---|---|
| LRS | 3 | Single datacenter | No |
| ZRS | 3 | 3 availability zones | No |
| GRS | 6 | Primary + paired region | No |
| RA-GRS | 6 | Primary + paired region | Yes |
| GZRS | 6 | 3 zones + paired region | No |
| RA-GZRS | 6 | 3 zones + paired region | Yes |

### ADLS Gen2

Enabled by hierarchical namespace (HNS) on GPv2 or Premium block blob account. Atomic directory operations, POSIX ACLs, DFS endpoint. Required for NFS 3.0 and SFTP.

### Key Security Defaults

- Microsoft Entra ID preferred over Shared Key
- Block Public Access at account level
- SSE with Microsoft-managed keys (default); CMK for compliance
- Minimum TLS 1.2
- Soft delete for blobs and containers

## Reference Files

- `references/architecture.md` -- Account types, blob types, access tiers, redundancy, ADLS Gen2, NFS/SFTP, lifecycle, object replication, immutability, private endpoints, scalability
- `references/best-practices.md` -- Account design, tier optimization, security hardening, networking, cost management, data lifecycle patterns, operational practices
- `references/diagnostics.md` -- Azure Monitor metrics, diagnostic logging, KQL queries, connectivity issues, throttling, replication status, cost analysis, alerts, Defender for Storage