Azure Storage

Azure Storage Services

Services

CLI commands

# List storage accounts
az storage account list --output table

# List containers
az storage container list --account-name ACCOUNT --output table

# List blobs
az storage blob list --account-name ACCOUNT --container-name CONTAINER --output table

# Download blob
az storage blob download --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH

# Upload blob
az storage blob upload --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH

For deeper service docs and patterns, call mcp_azure-mcp_documentation with command: "microsoft_docs_search" and the relevant Azure Storage topic, or follow the links in Service Details.

Storage Account Tiers

Blob Access Tiers

Redundancy Options

Rules

• Use Managed Identity over shared keys — connect via DefaultAzureCredential (or equivalent SDK helper) instead of account keys or SAS where possible
• Disable public blob access by default; use private endpoints + Entra-only access for prod data
• Match the access tier to the access pattern — Hot for active, Cool for 30+ days, Cold for 90+ days, Archive for 180+ days (rehydration required to read)
• Pick redundancy by RPO/RTO — LRS for dev, ZRS for regional HA, GRS/GZRS for DR
• Apply lifecycle management to auto-tier blobs based on age and last access
• Premium tier is for sub-millisecond latency / high-IOPS workloads; default is Standard
• Security baseline is non-negotiable — see iac-security-baseline.md (TLS 1.2 minimum, HTTPS-only, public blob disabled, Managed Identity)
• Out of scope: SQL / Cosmos DB (use azure-prepare), messaging via Event Hubs / Service Bus

Steps

1. Identify the storage service for the workload — see Services (Blob / File / Queue / Table / Data Lake)
2. Choose redundancy — LRS / ZRS / GRS / GZRS based on RPO/RTO requirements
3. Choose access tier — Hot / Cool / Cold / Archive based on expected access frequency
4. Apply security baseline — see iac-security-baseline.md (HTTPS-only, TLS 1.2, public blob disabled, Managed Identity)
5. Run routine operations via az storage CLI — see CLI commands
6. Wire lifecycle management for long-lived data to auto-tier and reduce cost

Service Details

For deep documentation on specific services:

• Blob storage patterns and lifecycle -> Blob Storage documentation
• File shares and Azure File Sync -> Azure Files documentation
• Queue patterns and poison handling -> Queue Storage documentation

SDK Quick References

For building applications with Azure Storage SDKs, see the condensed guides:

• Blob Storage: Python | TypeScript | Java | Rust
• Queue Storage: Python | TypeScript
• File Shares: Python | TypeScript
• Data Lake: Python
• Tables: Python | Java

For full package listing across all languages, see SDK Usage Guide.

Azure SDKs

For building applications that interact with Azure Storage programmatically, Azure provides SDK packages in multiple languages (.NET, Java, JavaScript, Python, Go, Rust). See SDK Usage Guide for package names, installation commands, and quick start examples.

Reference Index

Load these on demand — do NOT read all at once: