Sections

9. Glossary and Cheatsheet

9 min read

The 10-second lookup.

Glossary

ABFS — the abfss:// driver Spark engines (Databricks, Synapse, Fabric) use to talk to an HNS-enabled account via the dfs endpoint.

Access key — one of two root credentials on a storage account granting unscoped, non-expiring full data-plane access. Disable with allowSharedKeyAccess = false.

Access tier — a per-blob (or account-default) setting: Hot, Cool, Cold, or Archive. Trades storage price against transaction price, retrieval cost, and latency.

ADLS Gen2 — Azure Data Lake Storage Gen2. Not a separate product: a storage account with the hierarchical namespace enabled. (Gen1 was a genuinely separate, now-retired service.)

Append blob — a blob type optimised for append-only writes. Used by logging pipelines. Cannot be updated in place.

Archive tier — the cheapest storage tier and an offline one: an archived blob cannot be read until rehydrated, which takes hours.

Block blob — the default blob type, assembled from up to ~50,000 staged blocks committed atomically with Put Block List. What almost everything is.

Blob index tag — an indexed key-value tag on a blob, queryable with Find Blobs by Tags. The nearest thing to a query, and still not a database.

Change feed — an ordered, durable, read-only log of every change to blobs in an account. Required for point-in-time restore and object replication.

Cold tier — a tier between Cool and Archive: lower storage cost, higher transaction cost, still online, longer minimum retention.

Container — a flat namespace for blobs within an account, and the finest scope for a data-plane role assignment or a public-access setting.

Control plane — ARM at management.azure.com, governing the account resource. Separate RBAC from the data plane.

Data plane — <account>.blob.core.windows.net, governing blobs. Separate RBAC from the control plane.

Early deletion charge — a pro-rata penalty for deleting or re-tiering Cool, Cold, or Archive data before its minimum retention period elapses.

ETag — a version identifier on every blob; pass it as If-Match for optimistic concurrency (compare-and-swap) on writes.

GRS / GZRS — geo-redundant / geo-zone-redundant storage: a primary copy plus an asynchronous copy in the paired region. Non-zero RPO.

Hierarchical namespace (HNS) — the ADLS Gen2 flag that makes directories real objects, makes rename atomic, and adds POSIX ACLs. Set at creation, irreversible.

Immutable storage / WORM — time-based retention or legal-hold policies preventing modification or deletion. A locked policy can be extended but never shortened.

Kind — the storage account model: StorageV2 (the default and correct answer), BlockBlobStorage (premium block blob), and the legacy Storage, BlobStorage, FileStorage.

Last sync time — the metric showing how far a geo-replicated secondary lags the primary. Everything after it is lost in an unplanned failover.

Lease — an explicit, time-bound exclusive lock on a blob or container. What Terraform's azurerm backend uses for state locking.

Lifecycle management — rules that automatically tier or delete blobs by age, prefix, last-access time, or index tag. The single largest cost lever in the service.

LRS — locally-redundant storage: three copies in one datacentre.

Microsoft Entra ID — formerly Azure Active Directory (Azure AD). The identity provider that issues the tokens used for keyless blob access.

Object replication — asynchronous, rule-based replication of blobs between accounts. Requires versioning and change feed on the source.

Page blob — a blob type supporting 512-byte-aligned random reads and writes. The substrate behind unmanaged VHDs.

Partition — the unit the partition layer serves, keyed lexicographically on account/container/blobname. A monotonic key prefix concentrates load on one partition.

Point-in-time restore — restores a container to an earlier moment. Requires versioning and change feed and soft delete enabled beforehand.

Premium block blob — an SSD-backed performance tier with consistent single-digit-ms latency and very high transaction rates. No Archive tier, higher per-GB cost.

Private endpoint — a private IP for the account inside your VNet, with a privatelink.blob.core.windows.net DNS zone doing the override. One per sub-resource (blob, dfs, …).

RA-GRS / RA-GZRS — the read-access variants, exposing a readable -secondary endpoint that may lag the primary.

Rehydration — copying or promoting an archived blob back to an online tier. Measured in hours; standard or high priority.

SAS (shared access signature) — a signed URL granting scoped, time-limited access. Three kinds: account SAS, service SAS (both signed with the account key), and user-delegation SAS (signed via Entra ID — the one to use).

Snapshot — a read-only, point-in-time copy of a blob that you create explicitly.

Soft delete — a retention window during which deleted blobs or containers can be undeleted. Must be enabled before the deletion. The retained bytes are billable.

Stamp — a cluster of racks in a datacentre running the front-end, partition, and stream layers.

Stored access policy — a named container-level policy a service SAS can reference. The only way to revoke an issued service SAS without rotating the account key.

Storage account — the regional ARM resource with a globally unique name that owns the endpoints, redundancy, firewall, encryption, keys, and most of the scale limits.

Stream layer — the append-only distributed filesystem storing replicated extents. Where durability comes from.

User-delegation SAS — a SAS signed with a key obtained from Entra ID rather than the account key. Bounded by the signer's RBAC and revocable by removing the role assignment. Use this one.

Versioning — automatic creation of a read-only version on every overwrite or delete. Pair with a lifecycle rule expiring old versions, or the bill grows forever.

ZRS — zone-redundant storage: three copies across availability zones in one region. The production default where zones exist.

$web / $logs — special containers for static website hosting and classic storage analytics logs. Easy to forget when auditing what's public.

Cheatsheet

# --- account lifecycle -----------------------------------------------------
az storage account create -n $ACCT -g $RG -l uksouth \
  --sku Standard_ZRS --kind StorageV2 \
  --min-tls-version TLS1_2 --allow-blob-public-access false --allow-shared-key-access false

az storage account list -g $RG -o table
az storage account show -n $ACCT -g $RG --query "{sku:sku.name,hns:isHnsEnabled,pna:publicNetworkAccess}"
az storage account update -n $ACCT -g $RG --public-network-access Disabled

# --- containers and blobs (always --auth-mode login) -----------------------
az storage container create --account-name $ACCT -n raw --auth-mode login
az storage container list   --account-name $ACCT --auth-mode login -o table

az storage blob upload   --account-name $ACCT -c raw -n path/file.csv -f ./file.csv --auth-mode login
az storage blob download --account-name $ACCT -c raw -n path/file.csv -f ./out.csv  --auth-mode login
az storage blob list     --account-name $ACCT -c raw --prefix path/ --auth-mode login -o table
az storage blob delete   --account-name $ACCT -c raw -n path/file.csv --auth-mode login
az storage blob undelete --account-name $ACCT -c raw -n path/file.csv --auth-mode login

# --- tiering ---------------------------------------------------------------
az storage blob set-tier --account-name $ACCT -c raw -n path/file.csv --tier Cool --auth-mode login
az storage blob set-tier --account-name $ACCT -c raw -n path/file.csv --tier Hot \
  --rehydrate-priority High --auth-mode login          # from Archive: takes hours

# --- user-delegation SAS (signed by Entra ID, not by the account key) ------
az storage blob generate-sas --account-name $ACCT -c raw -n path/file.csv \
  --permissions r --expiry 2026-07-30T12:00Z --as-user --auth-mode login -o tsv

# --- RBAC: the data-plane roles that actually grant blob access -----------
az role assignment create --assignee-object-id $PRINCIPAL --assignee-principal-type ServicePrincipal \
  --role "Storage Blob Data Contributor" \
  --scope "$(az storage account show -n $ACCT -g $RG --query id -o tsv)/blobServices/default/containers/raw"

# --- bulk data movement (AzCopy is the right tool, not the CLI) -----------
azcopy login                                            # or use a managed identity
azcopy copy "./localdir" "https://$ACCT.blob.core.windows.net/raw/" --recursive
azcopy sync "https://$SRC.blob.core.windows.net/raw" "https://$DST.blob.core.windows.net/raw" --recursive

# --- leases (breaking a stuck Terraform state lock) -----------------------
az storage blob lease break --account-name $ACCT -c tfstate -b prod.terraform.tfstate --auth-mode login

# --- diagnostics (OFF by default) -----------------------------------------
az monitor diagnostic-settings create \
  --name diag-blob \
  --resource "$(az storage account show -n $ACCT -g $RG --query id -o tsv)/blobServices/default" \
  --workspace $LAW_ID \
  --logs    '[{"category":"StorageRead","enabled":true},{"category":"StorageWrite","enabled":true},{"category":"StorageDelete","enabled":true}]' \
  --metrics '[{"category":"Transaction","enabled":true}]'

# --- the "why is this failing" trio ---------------------------------------
az lock list --resource-group $RG -o table                  # CanNotDelete locks (inherit from parents)
az role assignment list --scope $ACCT_ID --include-inherited -o table
az monitor activity-log list --resource-id $ACCT_ID --start-time 2026-07-28 -o table

Resource ID shape

# The account
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{account}

# A container — the finest scope for a data-plane role assignment
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{account}/blobServices/default/containers/{container}

# The blob service — what a diagnostic setting must target (not the account ID)
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/{account}/blobServices/default

And the data-plane URLs, which are a different namespace entirely:

https://{account}.blob.core.windows.net/{container}/{blob}   # blob endpoint
https://{account}.dfs.core.windows.net/{filesystem}/{path}   # ADLS Gen2 endpoint (HNS accounts)
https://{account}-secondary.blob.core.windows.net/...        # RA-GRS / RA-GZRS read endpoint

Limits worth memorising — with the scope each is counted at

The scope is the part that matters; a number without one is useless in Azure. Every figure below varies by region, redundancy, and account type, so treat them as shapes rather than facts.

Limit	Scope	Note
Account name: 3–24 chars, lowercase alphanumeric	Global — unique across all of Azure	No hyphens, no uppercase. May stay reserved after deletion
Container name: 3–63 chars, lowercase	Per account
Ingress / egress bandwidth	Per storage account	The ceiling you hit first ⚠️ verify current values
Request rate	Per storage account	Premium block blob is substantially higher ⚠️ verify
Throughput to a single blob	Per blob	Far below the account ceiling
Storage accounts	Per subscription, per region	Soft limit, raisable by support ⚠️ verify
Max block blob size	Per blob	Block size × ~50,000 blocks ⚠️ verify
Blocks per block blob	Per blob	~50,000 ⚠️ verify
Blob index tags	Per blob	A small fixed maximum ⚠️ verify
Minimum retention: Cool ~30d, Cold ~90d, Archive ~180d	Per blob	Early deletion is charged pro-rata ⚠️ verify
Uncommitted block expiry	Per blob	About a week — and billed until then ⚠️ verify
Containers per account, blobs per container	Per account / container	Effectively unbounded

The five things to remember if you remember nothing else

The storage account is the unit of everything — limits, firewall, redundancy, encryption, and blast radius. Not the container.
Owner does not grant blob access. Control plane and data plane have separate RBAC, and allowSharedKeyAccess = false is what makes that separation real.
Redundancy is per account; access tier is per blob. They are not the same axis, whatever S3 taught you.
Cheaper storage means dearer transactions. Tier on measured access patterns, and always pair versioning with an expiry rule.
The hierarchical namespace is set at creation and cannot be changed. Decide it deliberately.

← Back to the Blob Storage overview · ← Previous: Interview Questions