In one sentence. Inside the Blob service you make containers (folders) and upload blobs (files). Each file sits on a price ladder: pay more to store it where it opens instantly, or pay less to store it in the basement where it takes hours to fetch. Rules can move files down the ladder as they age. Separate switches keep deleted or overwritten files around so you can undo.
You, the admin: first container and upload
- Storage account › Containers › + Container, name
invoices, anonymous access level Private. - Open it, Upload, choose files; under Advanced you can set the access tier per file and a folder path.
- From a PC with many files:
azcopy copy "C:\invoices\*" "https://contosoinvoices01.blob.core.windows.net/invoices?<SAS>" --recursive, or drag and drop in Storage Explorer.
The price ladder (access tiers)
1. HotFiles you open often. Highest storage price, lowest read price, no minimum stay.
Today's invoicesread many times a day
↓ as files age, move down
2. CoolOpened rarely. Cheaper to keep, dearer to read. Minimum stay 30 days.
Last quarteropened occasionally
↓ still instantly readable
3. ColdOpened very rarely. Cheaper again. Minimum stay 90 days.
Last yeara few reads a year
↓ still instantly readable
4. ArchiveOffline. Cheapest to keep. Must be rehydrated before reading (up to 15 h standard, under 1 h high priority). Minimum stay 180 days.
7-year compliance copiesalmost never opened
- Set a default tier for the account (Hot or Cool) and override per blob on upload or later via Change tier.
- Archive is offline. To open an archived file you click Change tier back to Hot or Cool (rehydration): up to 15 hours at Standard priority, under an hour at High priority, and it costs a read fee. Not available on ZRS accounts.
- Leaving a tier before its minimum stay (30/90/180 days) charges the remaining days.
Moving files automatically (lifecycle management)
Storage account › Lifecycle management › + Add rule. A rule says: for blobs (optionally only under prefix invoices/, or with a given index tag), if days since last modified / created / last accessed is more than N, then move to Cool / Cold / Archive or delete. Last-access rules need access tracking enabled on the account first. Rules run once a day, so expect up to 24 hours before anything moves.
Getting a file back
| Switch (Data protection blade) | Undoes | How it works |
|---|---|---|
| Soft delete for blobs | Delete or overwrite | Keeps the old data 1 to 365 days; Show deleted blobs then Undelete |
| Soft delete for containers | Whole container deleted | Same idea at container level |
| Versioning | Overwrite | Every save becomes a numbered version you can promote back |
| Snapshots | Overwrite | Manual, per blob, read-only copy at that moment |
| Point-in-time restore | A bad bulk change | Roll a container back to a time; needs soft delete + versioning + change feed |
| Immutable storage (WORM) | Tampering, even by admins | Time-based retention or legal hold on a container; nothing can change or delete until it lapses |
| Object replication | Regional loss, or needs a copy near users | Async copy of one container to a container in another account you choose (any region or subscription). Needs versioning on both accounts and change feed on the source. Different from GRS because you choose the target. |
Trap wording. "Lifecycle rule did not move the file yet" = wait 24 hours, or access tracking is off. "User needs an archived file now" = rehydrate with High priority; it is still not instant.