Techie BabajiLearn to Code. Build Real Skills.
Microsoft Azure · Data

Azure Storage

An Azure Storage account is one resource that offers four storage services: Blob, Files, Queue and Table.

Intermediate 5 min Lesson 9 of 28
Before you start:Subscriptions and Resource Groups
0/28 in Microsoft Azure
On this page · 5 min · Intermediate

On this page

  1. Learning objectives
  2. Explanation
  3. Code example
  4. Step by step
  5. Real-world use
  6. Common mistakes
  7. Best practices
  8. Remember this
  9. Practice exercise
  10. Mini quiz
  11. Related topics
  12. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 29, 2026

Related tutorials

Interview questions

Learning objectives#

  • Name the four storage services
  • Choose a redundancy option
  • Create a secure storage account
  • Prefer identity-based access over keys

Explanation#

Blob storage holds files of any kind (images, backups, videos). Azure Files offers SMB/NFS file shares. Queue storage holds simple messages. Table storage is a key–value NoSQL store.

Redundancy: LRS (three copies in one data centre), ZRS (three zones), GRS (plus a copy in the paired region) and GZRS (zones plus a paired region).

Every account has access keys that grant full control. Treat them like root passwords — better still, disable shared-key access and use Microsoft Entra ID with role assignments.

Code example: A secure storage account#

ShellA secure storage account Illustrative
az storage account create -n stshop12345 -g rg-shop-dev -l centralindia \
  --sku Standard_ZRS --kind StorageV2 \
  --min-tls-version TLS1_2 --allow-blob-public-access false


# Give the signed-in user data access through Entra ID (no keys)
az role assignment create --assignee $(az ad signed-in-user show --query id -o tsv) \
  --role "Storage Blob Data Contributor" \
  --scope $(az storage account show -n stshop12345 -g rg-shop-dev --query id -o tsv)
Expected output
"provisioningState": "Succeeded" — the account is created with zone redundancy, TLS 1.2 and public blob access disabled.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. StorageV2 is the general-purpose account type.
  2. ZRS protects against a zone failure.
  3. Public blob access is disabled so nothing becomes public by accident.
  4. The role assignment grants data access via your identity instead of account keys.

Real-world use case#

A shop stores product images in Blob, sends “order placed” messages through Queue storage, and shares reports via Azure Files.

Common mistakes#

Committing connection strings with account keys

Anyone with the key controls the whole account. Use managed identity or rotate keys immediately if leaked.

Enabling public access for convenience

Serve public files through a CDN or short-lived SAS instead.

Best practices#

  • Disable public blob access by default
  • Use Entra ID and RBAC for data access
  • Choose redundancy based on recovery needs
  • Enable soft delete for blobs and containers

Remember this#

One account, four services: Blob, Files, Queue, Table.

LRS < ZRS < GRS < GZRS (more copies, more protection).

Account key = master key. Avoid using it.

Practice exercise#

Your task: Enable 7-day soft delete for blobs on stshop12345.

Show solution
Shell Illustrative
az storage account blob-service-properties update -n stshop12345 -g rg-shop-dev --enable-delete-retention true --delete-retention-days 7

Mini quiz#

Azure Storage quizMultiple choice Question 1 of 1

Which service stores unstructured files such as images?

Score so far: 0/0

Want more? Practise all Microsoft Azure MCQs · Microsoft Azure interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.