Blob Storage: Object Storage for the Cloud

Azure Blob Storage (Binary Large Object) is Azure's object storage solution for storing massive amounts of unstructured data — data that does not fit into a relational database schema. Examples include images, videos, audio files, PDF documents, log files, backups, and application binaries. Blob Storage is accessed via HTTP/HTTPS REST APIs, the Azure SDK, or the Azure CLI. It is one of the most widely used Azure services and the foundation for many data lake, media, and backup architectures.

Blob Storage is organised in a three-level hierarchy: Storage Account → Container → Blob. A container is like a folder at the top level — it groups related blobs and defines the access policy for everything inside it. A blob is an individual object (file) stored within a container. Blob names can include forward slashes (/) to simulate a folder hierarchy (e.g., images/2024/photo.jpg), but Blob Storage is fundamentally flat — those slashes are part of the blob name, not real directories.

Azure Blob Storage supports three blob types: Block blobs — the most common type, ideal for storing documents, images, and videos. Data is split into blocks and uploaded in parallel; maximum size is ~190 TB. Append blobs — optimised for append-only operations such as writing log files; new data is always added to the end. Page blobs — collections of 512-byte pages optimised for random read/write access; used by Azure VM managed disks as the underlying storage mechanism. When in doubt, use block blobs — they are the default for general-purpose object storage.

Blob Storage offers three access tiers that balance storage cost against access cost: Hot tier — highest storage cost, lowest access cost; for frequently accessed data. Cool tier — lower storage cost, higher access cost, minimum 30-day storage commitment; for infrequently accessed data like monthly reports. Archive tier — lowest storage cost (~95% cheaper than hot), but requires hours of rehydration before data can be accessed; for long-term compliance archives rarely accessed. You can set a default tier at the account level and override it per blob.

Manually managing blob tiers across millions of blobs is impractical. Lifecycle Management policies automate this: you define rules that move blobs to cooler tiers or delete them based on age or last-accessed date. For example: move blobs to Cool after 30 days of no modification, move to Archive after 180 days, and delete after 365 days. This ensures your storage automatically optimises for cost over time without manual intervention. Lifecycle policies are defined in JSON and applied at the storage account level, affecting all blobs in the account.

By default, all blobs in a container are private — accessible only to authenticated users with appropriate permissions. You can make containers and blobs public by setting the container's access level to Blob (individual blobs readable) or Container (container listing and all blobs readable). For finer-grained, time-limited access, use Shared Access Signatures (SAS) — URLs containing a cryptographic token that grants specific permissions (read, write, delete) for a specific resource and time window, without sharing your account keys.

Azure Blob Storage can host static websites — HTML, CSS, JavaScript, and image files served directly from a storage account over HTTP/HTTPS without any server-side code. Enable static website hosting on a storage account, designate an index document (e.g., index.html) and an error document, and upload your static files to the special $web container. The storage account URL becomes your website URL. Pair with Azure CDN for custom domain support, HTTPS, and global edge caching to make the site fast for users worldwide.

Blob Storage is a natural home for application and database backups: it is durable (11 nines durability with LRS, even higher with GRS), highly available, and very cost-effective for large data volumes — especially on the Cool or Archive tiers. Many Azure backup services (Azure Backup for VMs, SQL Database automated backups) store their data in Blob Storage under the hood. You can also write backup scripts that dump a database to a blob directly using the Azure CLI or SDK as part of a scheduled job.

Azure Data Lake Storage Gen2 (ADLS Gen2) is built on top of Blob Storage with an added hierarchical namespace feature that makes directory operations (rename, delete) atomic and efficient — critical for big data analytics workloads. Enabling hierarchical namespace on a storage account transforms it into ADLS Gen2, which integrates natively with Azure Synapse Analytics, Azure Databricks, and HDInsight. It supports both the Blob Storage API and the HDFS protocol, making it compatible with existing Hadoop-based tools and frameworks.

Blob Storage pricing has three components: Storage cost — per GB per month, varying by tier (hot ~$0.018/GB, cool ~$0.01/GB, archive ~$0.001/GB in East US). Operations cost — per 10,000 read and write operations, higher for cooler tiers. Data transfer cost — free for inbound (upload), charged for outbound (download to internet). For large datasets, the tier selection has a dramatic impact on total cost — moving infrequently accessed data from Hot to Cool typically halves the storage bill, while Archive can cut costs by 95%.

Regulated industries like finance and healthcare require data to be stored in a write-once, read-many (WORM) format for compliance with regulations like SEC Rule 17a-4 and HIPAA. Azure Blob Storage's immutability policies let you lock blobs so they cannot be modified or deleted for a specified retention period. Two policy types are available: Time-based retention (blob locked until a date) and legal hold (blob locked indefinitely until the hold is removed). Once locked, even storage account administrators cannot delete the blobs during the retention period.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Blob Storage is an object store for unstructured data organised in the hierarchy of storage account, container, and blob, the three access tiers — hot, cool, and archive — balance storage cost against access cost for different usage patterns, and lifecycle management policies automatically move blobs to cheaper tiers or delete them based on age. Next up we explore Azure Files and Queue Storage for file sharing and message decoupling.