Creating Azure Blob Containers and Managing Access Levels

Azure Blob Storage is a highly scalable and secure service that allows you to store unstructured data such as text files, images, videos, and documents. In this recipe, you’ll learn how to create a container, upload blobs, and configure access levels for your data.

📌 Note: For the detailed lab with screenshots and step-by-step explanations, refer to the lab “R7201 – Creating Azure Blob Containers and Managing Access Levels” in the 4MCEA or the AIEA course in BuddyTutor.com.

Getting Ready

Before you begin, make sure you have:

• A valid Azure subscription
• An Azure Storage Account (Performance: Standard (General Purpose v2) or, if Premium, the account type should be Block blobs)
• Familiarity with blob types (see this guide: Understanding the differences between Block Blob, Append Blob, and Page Blob in Azure)

Step-by-Step: Creating a Blob Container and Uploading Blobs

1. Sign in to Azure Portal
   Go to https://portal.azure.com and log in with your Azure credentials.
2. Navigate to Storage Accounts
   Use the search bar to find Storage accounts, and select the storage account you want to use.
3. Create a Container
   • In the left-hand panel, under Data storage, click Containers.
   • Click + Container.
   • Name the container images and click Create.
4. Upload Blobs
   • Open the images container.
   • Click Upload.
   • On the Upload blob screen, click Browse for files and select the file(s) you want to upload (e.g., azure.jpg).
   • Click Upload.
5. Verify Blob URL
   • Open the uploaded file in the container.
   • Copy its URL (e.g., https://trainsostorage1.blob.core.windows.net/images/azure.jpg).
   • Paste the URL in a new browser tab — you’ll get an access denied error, because the default access level is Private.

Managing Access Levels

By default, blobs are private. You can change this behavior:

1. Enable Anonymous Access at Storage Account Level
   • Go back to your storage account.
   • Under Settings, click Configuration.
   • Set Allow Blob anonymous access to Enable and click Save.
2. Change Access Level at Container or Blob Level
   • In your images container, select the blob (e.g., azure.jpg).
   • Click Change access level.
   • Choose:
     • Private: No anonymous access (default).
     • Blob: Anonymous read access for blobs only.
     • Container: Anonymous read access for both the container and blobs.
   • For this lab, select Blob and click OK.
3. Verify Access
   • Refresh the blob URL in your browser.
   • This time, you should see the image without authentication.

How It Works

• Unique Addressing: Each storage account provides a globally unique namespace (e.g., https://<storageaccount>.blob.core.windows.net).
• Blob Types:
  • Block blobs → Optimized for large files.
  • Append blobs → Optimized for logs.
  • Page blobs → Optimized for random access (e.g., VHDs).
• Access Levels:
  • Private → Only authorized requests allowed.
  • Blob → Blobs can be read anonymously, but the container cannot be listed.
  • Container → Both blobs and container listings are publicly accessible.

Best Practice: Use SAS Instead of Anonymous Access

While anonymous access is useful for testing, it’s not recommended for production. Instead, use a Shared Access Signature (SAS), which provides time-limited and permission-specific access to your blobs.

👉 You can learn more in the recipe Using Shared Access Signature – Blob Level.