Azure Storage Cheat Sheet
Overview of Azure Storage services including Blob, Table, Queue, and File storage with CLI commands and access tiers.
2 PagesBeginnerJan 28, 2026
Blob Storage CLI
Create containers and manage blobs.
bash
az storage container create \ --account-name mystorageacct --name mycontaineraz storage blob upload \ --account-name mystorageacct --container-name mycontainer \ --name file.txt --file ./file.txtaz storage blob download \ --account-name mystorageacct --container-name mycontainer \ --name file.txt --file ./file.txtaz storage blob list \ --account-name mystorageacct --container-name mycontainer --output table
Generate a SAS Token
Create a time-limited, scoped access token for a blob.
bash
az storage blob generate-sas \ --account-name mystorageacct \ --container-name mycontainer \ --name file.txt \ --permissions r \ --expiry 2026-12-31T00:00:00Z \ --output tsv
Python SDK: Upload Blob
Upload a file using the azure-storage-blob SDK.
python
from azure.storage.blob import BlobServiceClientclient = BlobServiceClient.from_connection_string(conn_str)container = client.get_container_client("mycontainer")with open("file.txt", "rb") as data: container.upload_blob(name="file.txt", data=data, overwrite=True)
Storage Service Types
The four main data services under a storage account.
- Blob Storage- Unstructured object storage for files, images, backups
- Table Storage- NoSQL key-value store for structured, schemaless data
- Queue Storage- Simple message queuing for decoupling application components
- File Storage- Fully managed SMB/NFS file shares mountable by VMs and on-prem
Blob Access Tiers & Redundancy
Key blob access tiers & redundancy to know.
- Hot Tier- Optimized for frequently accessed data, higher storage cost
- Cool Tier- Lower storage cost, higher access cost, for infrequent access
- Archive Tier- Cheapest, offline storage, requires rehydration before read
- LRS- Locally redundant storage: 3 copies in one datacenter
- GRS- Geo-redundant storage: replicates to a secondary paired region
Blob Lifecycle Management Policy
Automatically tier and delete blobs based on age to cut storage cost.
json
{ "rules": [ { "name": "archive-old-logs", "enabled": true, "type": "Lifecycle", "definition": { "filters": { "blobTypes": ["blockBlob"], "prefixMatch": ["logs/"] }, "actions": { "baseBlob": { "tierToCool": { "daysAfterModificationGreaterThan": 30 }, "tierToArchive": { "daysAfterModificationGreaterThan": 90 }, "delete": { "daysAfterModificationGreaterThan": 365 } } } } } ]}
Async Upload/Download with aio
Use the azure.storage.blob.aio client for non-blocking concurrent I/O.
python
import asynciofrom azure.storage.blob.aio import BlobServiceClientasync def upload_many(files: list[str]): async with BlobServiceClient.from_connection_string(conn_str) as client: container = client.get_container_client("mycontainer") async def upload(path): with open(path, "rb") as f: await container.upload_blob(name=path, data=f, overwrite=True) await asyncio.gather(*(upload(f) for f in files))asyncio.run(upload_many(["a.txt", "b.txt", "c.txt"]))
User Delegation SAS (Azure AD-backed)
Generate a SAS signed with Azure AD credentials instead of an account key for stronger auditability.
python
from datetime import datetime, timedelta, timezonefrom azure.identity import DefaultAzureCredentialfrom azure.storage.blob import BlobServiceClient, BlobSasPermissions, generate_blob_sascredential = DefaultAzureCredential()service_client = BlobServiceClient(account_url="https://mystorageacct.blob.core.windows.net", credential=credential)start = datetime.now(timezone.utc)key = service_client.get_user_delegation_key(start, start + timedelta(hours=1))sas = generate_blob_sas( account_name="mystorageacct", container_name="mycontainer", blob_name="file.txt", user_delegation_key=key, permission=BlobSasPermissions(read=True), expiry=start + timedelta(minutes=30),)
React to Blob Events with Event Grid
Subscribe to storage change events instead of polling for new blobs.
bash
az eventgrid event-subscription create \ --name blobCreatedSub \ --source-resource-id $(az storage account show -n mystorageacct -g myRG --query id -o tsv) \ --endpoint-type webhook \ --endpoint https://myapp.azurewebsites.net/api/blobHandler \ --included-event-types Microsoft.Storage.BlobCreated \ --subject-begins-with /blobServices/default/containers/mycontainer/
Concurrency & Consistency Controls
Mechanisms for safe concurrent writes and strong-consistency reads.
- ETag optimistic concurrency- Pass If-Match with a blob's ETag so an update fails if it changed since last read
- Lease- Acquire an exclusive write lock on a blob or container for up to 60s (renewable) or infinite
- Strong read-after-write- Single-region writes are immediately consistent for subsequent reads in that region
- RA-GRS secondary reads- Reads from the secondary region are eventually consistent, not guaranteed current
- Snapshot- Immutable point-in-time read-only version of a blob, useful for versioning without copies
- Immutability policy- Time-based or legal-hold WORM protection preventing deletion/modification
Pro Tip
Use a SAS token scoped to the minimum required permissions and a short expiry instead of sharing storage account keys — keys grant full account access and cannot be revoked individually.
Was this cheat sheet helpful?
Explore Topics
#AzureStorage#AzureStorageCheatSheet#CloudComputing#Beginner#BlobStorageCLI#GenerateASASToken#Python#SDK#DataStructures#CommandLine#CheatSheet#SkillVeris
