Skip to content

Data in Azure lives in a storage account (blobs, files, queues, tables) or in dedicated database services.

Services at a glance

Category Services
Storage Blob Storage, Data Lake Gen2, Azure Files, Queue Storage, Table Storage, Managed Disks
Transfer AzCopy, Storage Explorer, Data Box, File Sync, Azure Migrate
Databases Azure SQL Database, SQL Managed Instance, Database for PostgreSQL / MySQL, Cosmos DB, Cache for Redis
Analytics Synapse Analytics, Microsoft Fabric, Data Factory

Storage Account

A namespace for your data, reachable at https://<account>.blob.core.windows.net (and .file, .queue, .table). The name must be globally unique, 3-24 lowercase letters and digits.

$ az storage account create -g rg-demo -n stdemo12345 \
    --sku Standard_LRS --kind StorageV2 --location southafricanorth

Services in an account

Service What it is
Blob Object storage for unstructured data (images, backups, logs)
Data Lake Gen2 Blob with hierarchical namespace for analytics
Files Managed SMB / NFS file shares
Queue Simple message queue
Table NoSQL key/attribute store
Managed Disks Block storage for VMs (separate resource type)

Blob types and access tiers

Blob types: Block (most files), Append (logs), Page (VM disks).

Tier Access Cost profile
Hot Frequent Higher storage, lower access cost
Cool Infrequent (30+ days) Cheaper storage, higher access cost
Cold Rare (90+ days) Cheaper again
Archive Almost never (180+ days) Cheapest, offline, hours to rehydrate

Lifecycle management policies move or delete blobs automatically by age.

Redundancy

Option Copies Protects against
LRS 3 in one datacenter Disk / rack failure
ZRS 3 across zones Datacenter failure
GRS LRS + 3 in the paired region Regional outage
GZRS ZRS + copy in paired region Zone and regional outage
RA-GRS / RA-GZRS Adds read access to the secondary Same, plus readable secondary

Securing Storage

  • Authentication: Microsoft Entra ID (preferred), shared key, or SAS tokens
  • SAS (Shared Access Signature): time-limited, scoped URL token, e.g. read one blob for an hour
  • Encryption: at rest by default with Microsoft-managed keys (can use customer-managed keys in Key Vault); in transit via HTTPS
  • Firewall and private endpoints: restrict network access
  • Soft delete, versioning, immutability (WORM): recover or protect from deletion
$ az storage container create --account-name stdemo12345 -n images --auth-mode login
$ az storage blob upload --account-name stdemo12345 -c images -f logo.png -n logo.png --auth-mode login

Moving Data

Tool Use
AzCopy CLI for fast bulk copy to/from storage
Storage Explorer Desktop GUI
Azure Data Box Physical appliance shipped for offline bulk transfer (TB to PB)
Azure File Sync Cache Azure Files on Windows Server on-prem
Azure Migrate Discover, assess and migrate servers, databases and apps 
$ azcopy copy "./data" "https://stdemo12345.blob.core.windows.net/images?<SAS>" --recursive

Databases on Azure

Service Type Notes
Azure SQL Database Managed relational (PaaS) Single DB or elastic pool
Azure SQL Managed Instance Near-full SQL Server compatibility Easier lift-and-shift
Azure Database for PostgreSQL / MySQL / MariaDB Managed open-source engines Flexible Server
Azure Cosmos DB Globally distributed NoSQL Multiple APIs, low latency, tunable consistency
Azure Cache for Redis In-memory cache Speed up reads, session store
Azure Synapse / Fabric Analytics Warehousing and big data

Relational fundamentals are in the Relational db Concepts notes under Databases.

Cosmos DB essentials

  • APIs: NoSQL (native), MongoDB, Cassandra, Gremlin (graph), Table
  • Throughput measured in Request Units (RU/s), provisioned or serverless / autoscale
  • Partition key choice drives scale and cost: pick a high-cardinality value that spreads load
  • Consistency levels, strongest to weakest: Strong, Bounded Staleness, Session (default), Consistent Prefix, Eventual
  • Global distribution: add read (and write) regions with a click