Azure Files and Blob Storage

What it is

Azure Files gives you managed file shares that behave like a network drive. Blob Storage holds objects such as images, backups and logs in containers.

Both services have protection features, and the exam asks which one recovers a deleted or changed item, and which one controls cost.

How it works

Azure Files shares

A file share is reached over SMB, or over NFS on premium shares. Standard shares can use the transaction optimized, hot or cool tier, and premium shares use SSD storage. You set a quota when you create the share and can mount it from Windows, Linux or macOS.

• Share snapshots are read-only, point-in-time copies of a share. They are incremental, and a share can hold up to 200. Windows users can open earlier versions from File Explorer.
• Soft delete for file shares keeps a deleted share recoverable. The default retention is 7 days and can be set from 1 to 365 days.

Blob containers and public access

A container groups blobs. Its access level controls anonymous reads.

You can turn off anonymous access for the whole account, which overrides the container setting.

Access tiers

Blobs sit in the hot, cool, cold or archive tier. Hot suits frequent use, and each cooler tier lowers storage cost and raises access cost. The minimum stay is 30 days for cool, 90 for cold and 180 for archive. Archive is offline, and a blob must be rehydrated to an online tier before it can be read, which can take hours. The account has a default tier of hot or cool for new blobs.

Soft delete and versioning

Versioning keeps a previous version each time a blob is overwritten or deleted, and you restore by promoting one. Point in time restore for block blobs needs versioning, change feed and blob soft delete to be turned on.

Lifecycle management

A lifecycle rule moves or deletes blobs automatically. A rule has a filter, such as a blob type or name prefix, and actions on a schedule of days.

• tierToCool, tierToCold and tierToArchive move blobs to a cooler tier.
• delete removes blobs.

The conditions are measured in days since the blob was last modified, since it was created, or since it was last accessed. Last access time tracking must be turned on to use access based rules. Rules can also act on previous versions and snapshots, and the policy runs once a day.

Mounting a share

The portal's Connect page for a share generates a script for Windows, Linux or macOS. The script stores the credentials and mounts the share as a drive. Mounting uses SMB over port 445, so that port must be open from the client. If an internet provider or firewall blocks outbound port 445, use a VPN or private endpoint instead.

A lifecycle rule in JSON

Lifecycle rules are stored as a JSON policy. This one moves log blobs to cool after 30 days, to archive after 180 and deletes them after a year.

{ "rules": [ { "name": "age-out-logs", "enabled": true, "type": "Lifecycle",
  "definition": {
    "filters": { "blobTypes": ["blockBlob"], "prefixMatch": ["logs/"] },
    "actions": { "baseBlob": {
      "tierToCool": { "daysAfterModificationGreaterThan": 30 },
      "tierToArchive": { "daysAfterModificationGreaterThan": 180 },
      "delete": { "daysAfterModificationGreaterThan": 365 } } } } } ] }

Choosing a protection feature

How the exam asks about this

• "Reduce cost for data nobody reads after 90 days." A lifecycle rule to cool or archive.
• "Read an archived blob within the hour." Copy it to an online tier with high rehydration priority.
• "Block anonymous access to every container." Disable blob anonymous access on the account.
• "How many snapshots can a share hold?" 200.
• Access time based rules need last access time tracking turned on.