Azure Storage Account
Complete Guide

var serviceClient = new BlobServiceClient("connection-string");
var containerClient = serviceClient.GetBlobContainerClient("my-container");
await containerClient.CreateIfNotExistsAsync(PublicAccessType.None);

// Upload with metadata
var blobClient = containerClient.GetBlobClient("folder/file.json");
await blobClient.UploadAsync(
    BinaryData.FromString("{\"id\": 1}"),
    new BlobUploadOptions
    {
        Metadata = new Dictionary<string, string> { ["env"] = "prod" },
        Tags = new Dictionary<string, string> { ["project"] = "myapp" },
        HttpHeaders = new BlobHttpHeaders { ContentType = "application/json" }
    });

// Download
BlobDownloadResult result = await blobClient.DownloadContentAsync();
string content = result.Content.ToString();

// Generate SAS URL (1 hour read-only)
Uri sasUri = blobClient.GenerateSasUri(
    BlobSasPermissions.Read,
    DateTimeOffset.UtcNow.AddHours(1));

// List blobs
await foreach (BlobItem blob in containerClient.GetBlobsAsync())
    Console.WriteLine($"{blob.Name} — {blob.Properties.ContentLength} bytes");

# Enable soft delete (30-day retention)
az storage blob service-properties delete-policy update \
  --account-name mystorageaccount \
  --enable true --days-retained 30

# Enable versioning
az storage account blob-service-properties update \
  --account-name mystorageaccount \
  --enable-versioning true

var queueClient = new QueueClient("connection-string", "my-queue");
await queueClient.CreateIfNotExistsAsync();

// Enqueue
await queueClient.SendMessageAsync("Hello, World!");

// Enqueue with 30s visibility delay
await queueClient.SendMessageAsync(
    "Delayed task",
    visibilityTimeout: TimeSpan.FromSeconds(30),
    timeToLive: TimeSpan.FromHours(1));

// Dequeue (peek-lock)
QueueMessage[] messages = await queueClient.ReceiveMessagesAsync(maxMessages: 10);
foreach (var msg in messages)
{
    Console.WriteLine($"Message: {msg.MessageText}");
    // Process...
    await queueClient.DeleteMessageAsync(msg.MessageId, msg.PopReceipt);
}

// Get queue depth
QueueProperties props = await queueClient.GetPropertiesAsync();
Console.WriteLine($"Approx count: {props.ApproximateMessagesCount}");

var tableClient = new TableClient("connection-string", "Employees");
await tableClient.CreateIfNotExistsAsync();

// Insert entity
var emp = new TableEntity("Engineering", "emp001")
{
    ["Name"] = "Alice",
    ["Role"] = "Developer",
    ["Age"] = 30
};
await tableClient.AddEntityAsync(emp);

// Query (OData filter)
var results = tableClient.QueryAsync<TableEntity>(
    filter: TableClient.CreateQueryFilter(
        $"PartitionKey eq 'Engineering' and Age gt {25}"));

await foreach (var entity in results)
    Console.WriteLine($"{entity["Name"]} — {entity["Role"]}");

// Upsert (insert or replace)
await tableClient.UpsertEntityAsync(emp);

// Delete
await tableClient.DeleteEntityAsync("Engineering", "emp001");

sudo apt install cifs-utils

sudo mount -t cifs //mystorageaccount.file.core.windows.net/myshare /mnt/myshare \
  -o vers=3.0,username=mystorageaccount,\
     password=<storageAccountKey>,dir_mode=0777,file_mode=0777

net use Z: \\mystorageaccount.file.core.windows.net\myshare \
  /user:Azure\mystorageaccount <storageAccountKey>

# Enable at creation (cannot change later)
az storage account create \
  --name mydatalake \
  --resource-group myRG \
  --kind StorageV2 \
  --enable-hierarchical-namespace true

# Azure Blob File System URI
abfs://<container>@<account>.dfs.core.windows.net/<path>

# Example
abfs://raw-data@mydatalake.dfs.core.windows.net/2025/01/sales.parquet

// Start rehydration (High priority = ~1 hour)
await blobClient.SetAccessTierAsync(
    AccessTier.Hot,
    rehydratePriority: RehydratePriority.High);

// Check status
BlobProperties props = await blobClient.GetPropertiesAsync();
Console.WriteLine(props.ArchiveStatus); // "rehydrate-pending-to-hot"

# Force Entra ID only — disables all account key + SAS key auth
az storage account update \
  --name mystorageaccount \
  --resource-group myRG \
  --allow-shared-key-access false

# Deny all public access by default
az storage account update \
  --name mystorageaccount --resource-group myRG \
  --default-action Deny

# Allow specific IP CIDR
az storage account network-rule add \
  --account-name mystorageaccount \
  --ip-address 203.0.113.0/24

# Allow VNet subnet
az storage account network-rule add \
  --account-name mystorageaccount \
  --vnet-name myVNet --subnet mySubnet

# Allow trusted Azure services to bypass
az storage account update \
  --name mystorageaccount --bypass AzureServices

{
  "rules": [{
    "name": "tiering-rule",
    "enabled": true,
    "type": "Lifecycle",
    "definition": {
      "filters": {
        "blobTypes": ["blockBlob"],
        "prefixMatch": ["logs/", "backups/"]
      },
      "actions": {
        "baseBlob": {
          "tierToCool":    { "daysAfterModificationGreaterThan": 30 },
          "tierToCold":    { "daysAfterModificationGreaterThan": 90 },
          "tierToArchive": { "daysAfterModificationGreaterThan": 180 },
          "delete":        { "daysAfterModificationGreaterThan": 365 }
        },
        "snapshot": { "delete": { "daysAfterCreationGreaterThan": 90 } },
        "version":  { "delete": { "daysAfterCreationGreaterThan": 90 } }
      }
    }
  }]
}

// Service SAS — read-only blob for 1 hour
BlobSasBuilder sasBuilder = new BlobSasBuilder
{
    BlobContainerName = "images",
    BlobName = "profile.jpg",
    Resource = "b",  // b=blob, c=container
    ExpiresOn = DateTimeOffset.UtcNow.AddHours(1)
};
sasBuilder.SetPermissions(BlobSasPermissions.Read);
Uri sasUri = blobClient.GenerateSasUri(sasBuilder);

// User Delegation SAS (Entra ID backed — most secure)
UserDelegationKey delegationKey = await blobServiceClient
    .GetUserDelegationKeyAsync(
        DateTimeOffset.UtcNow,
        DateTimeOffset.UtcNow.AddHours(4));

https://account.blob.core.windows.net/images/photo.jpg
?sv=2023-01-03     ← Storage version
&st=2025-01-01T10:00Z  ← Start time
&se=2025-01-01T11:00Z  ← Expiry time
&sr=b              ← Resource (b=blob, c=container)
&sp=r              ← Permissions (r=read, w=write, d=delete, l=list)
&sip=203.0.113.0/24    ← Allowed IP range (optional)
&spr=https         ← HTTPS only
&sig=<signature>   ← HMAC-SHA256

# Enable CMK with Key Vault
az storage account update \
  --name mystorageaccount \
  --encryption-key-source Microsoft.Keyvault \
  --encryption-key-vault https://myKeyVault.vault.azure.net \
  --encryption-key-name storage-encryption-key

# Enforce HTTPS-only + TLS 1.2
az storage account update \
  --name mystorageaccount \
  --https-only true \
  --min-tls-version TLS1_2

[FunctionName("ProcessUpload")]
public static async Task Run(
    [BlobTrigger("uploads/{name}", Connection = "AzureWebJobsStorage")]
    Stream blobStream,
    string name,
    BlobClient blobClient,
    ILogger log)
{
    log.LogInformation($"Blob {name} uploaded. Size: {blobStream.Length}");
    BlobProperties props = await blobClient.GetPropertiesAsync();
    // Process...
}

[FunctionName("ProcessQueueMessage")]
public static void Run(
    [QueueTrigger("task-queue", Connection = "AzureWebJobsStorage")]
    string message, ILogger log)
{
    log.LogInformation($"Queue message: {message}");
}

[FunctionName("GenerateReport")]
[return: Blob("reports/{DateTime}.json", Connection = "AzureWebJobsStorage")]
public static string Run([TimerTrigger("0 0 * * * *")] TimerInfo timer)
{
    return JsonSerializer.Serialize(new { GeneratedAt = DateTime.UtcNow });
}

[FunctionName("LogEvent")]
public static async Task Run(
    [HttpTrigger] HttpRequest req,
    [Table("AuditLog", Connection = "AzureWebJobsStorage")]
    IAsyncCollector<TableEntity> table)
{
    await table.AddAsync(new TableEntity("2025-01", Guid.NewGuid().ToString())
    {
        ["EventType"] = "UserLogin",
        ["IpAddress"] = req.HttpContext.Connection.RemoteIpAddress?.ToString()
    });
}

<inbound>
  <base />
  <authentication-managed-identity
      resource="https://storage.azure.com/"
      output-token-variable-name="storageToken" />

  <send-request mode="new"
      response-variable-name="uploadResult" timeout="60">
    <set-url>@($"https://{{account}}.blob.core.windows.net/uploads/{context.Request.MatchedParameters["filename"]}")</set-url>
    <set-method>PUT</set-method>
    <set-header name="Authorization" exists-action="override">
      <value>@("Bearer " + (string)context.Variables["storageToken"])</value>
    </set-header>
    <set-header name="x-ms-blob-type" exists-action="override">
      <value>BlockBlob</value>
    </set-header>
    <set-header name="x-ms-version" exists-action="override">
      <value>2023-01-03</value>
    </set-header>
    <set-body>@(context.Request.Body.As<string>())</set-body>
  </send-request>

  <return-response response-variable-name="uploadResult" />
</inbound>

StorageBlobLogs
| where StatusCode == 403
| summarize count() by CallerIpAddress, OperationName
| order by count_ desc

# Enable static website hosting
az storage blob service-properties update \
  --account-name mystorageaccount \
  --static-website \
  --index-document index.html \
  --404-document 404.html

# Upload build output to $web container
az storage blob upload-batch \
  --account-name mystorageaccount \
  --source ./dist \
  --destination '$web'

# URL: https://mystorageaccount.z6.web.core.windows.net/