Azure Fundamentals · Lesson 3 of 3
Azure Blob Storage
Explain what Azure Blob Storage is used for, describe the storage account → container → blob hierarchy, follow a file being uploaded and retrieved, and explain why access needs both network connectivity and authorization.
Tip: turn your phone sideways or use full screen for larger labels.
Captions match the narration word for word. Narration uses your browser's built-in voice, so it sounds different on each device. Press Space to play or pause and the arrow keys to change scenes.
Learning objective
Explain what Azure Blob Storage is used for, describe the storage account → container → blob hierarchy, follow a file being uploaded and retrieved, and explain why access needs both network connectivity and authorization.
Recap
- Blob Storage is Azure's object storage, optimized for large amounts of unstructured data such as documents, images, video, logs and backups.
- Data is organized as storage account → container → blob, and each blob has its own HTTPS address.
- Storage account names are unique across Azure: 3–24 lowercase letters and numbers.
- The app uploads and retrieves files as blobs over HTTPS.
- Access needs authorization (for example a managed identity with an Azure role) and an allowed network path. Anonymous access isn't allowed by default.
Knowledge check
Test yourself
Question 1. Put these in order from the top of the hierarchy down: blob, storage account, container.
- Container → storage account → blob
- Storage account → container → blob
- Blob → container → storage account
Show answer
B. Storage account → container → blob. A storage account holds containers, and containers hold blobs.
Question 2. The VM can reach the storage account over the network, but it has no role assignment or other credentials. Can it read the photos?
- Yes, network access is enough
- No, requests must also be authorized, and anonymous access isn't allowed by default
- Only if the photos are smaller than 1 MB
Show answer
B. No, requests must also be authorized, and anonymous access isn't allowed by default. Network connectivity and authorization are separate checks. Without valid credentials, such as a managed identity with a data role, the request is denied.
Voiceover script
Script and on-screen text
The full narration, scene by scene, with the headline shown on screen. The captions file below contains the same text with timings.
Scene 1 · 0:00
On screen: Lesson 3: Azure Blob Storage
So far, we've built a VM for our web app and connected it to a virtual network. Now, the users' uploaded photos need a home. In this final lesson, we'll store them in Azure Blob Storage and see how the app uploads and retrieves them securely.
Scene 2 · 0:20
On screen: Why not keep the files on the VM?
The app could save photos on its own disks, but then the files are tied to that one VM, and they're harder to share, scale and back up. Blob Storage is Microsoft's object storage service for the cloud. It's optimized for storing massive amounts of unstructured data, which apps can reach over HTTPS.
Scene 3 · 0:44
On screen: Unstructured data: files, not tables
Unstructured data is data that doesn't follow a particular data model, the way rows in a database table do. Think documents, images, video and audio, log files and backups. That's exactly the kind of data Blob Storage is designed to hold.
Scene 4 · 1:02
On screen: Level 1: the storage account
Blob Storage is organized in three levels. At the top is the storage account. It gives your data a unique namespace in Azure. The account name must be unique across Azure, three to twenty-four characters, lowercase letters and numbers only, and it becomes part of every address, like stphotosdemo01.blob.core.windows.net.
Scene 5 · 1:24
On screen: Level 2: containers organize blobs
Inside the account, you create containers. A container organizes a set of blobs, similar to a folder in a file system. Our example has two: uploads, for user photos, and backups, for the app's backup files. Container names are lowercase too, because they become part of the address.
Scene 6 · 1:46
On screen: Level 3: blobs are the files
Inside containers are blobs: the files themselves. Each blob has its own address, built from the account endpoint, the container name and the blob name. Blob names can include slashes, like 2026/10/team.png, to create a folder-like structure called a virtual directory.
Scene 7 · 2:04
On screen: Upload: the app writes a new blob
Now, an upload. A user sends a photo to the web app, and the app uploads it to the uploads container over HTTPS, where it's stored as a new blob. In Azure terms, this is a block blob, the blob type for text and binary data such as images and documents.
Scene 8 · 2:27
On screen: Retrieve: the app reads the blob back
Later, someone wants to see the photo. The app requests the blob by its address, receives the data, and returns the image to the user's browser. Upload and retrieve: that's the core pattern. But we skipped an important question. Why was the app allowed to do either?
Scene 9 · 2:48
On screen: Access requires authorization
Every request to Blob Storage must be authorized, unless anonymous read access has been deliberately turned on, and by default it isn't allowed. A good fit for our VM is a managed identity: an identity in Microsoft Entra ID for the VM, granted an Azure role such as Storage Blob Data Contributor. A request without valid credentials is denied.
Scene 10 · 3:14
On screen: …and a network path
Authorization isn't the only gate. The storage account's network settings must also let the request in. You can limit access to selected networks, or use a private endpoint, so the VM reaches storage through its virtual network. So the VM can use Blob Storage only when both are in place: network connectivity, and the right permissions.
Scene 11 · 3:38
On screen: Series recap: one simple cloud design
Let's put it all together. The web app runs on an Azure virtual machine. The VM connects through a network interface to a subnet in a virtual network, where security rules filter traffic. And the photos are stored as blobs, in containers, in a storage account, reached with the right network access and permissions.
Storyboard
Timestamped storyboard
Scene-by-scene direction for animators or video tools. Timings assume narration at about 145 words per minute.
| Time | Narration | Visual scene | Animation or transition | On-screen labels |
|---|---|---|---|---|
| 0:00–0:20 | So far, we've built a VM for our web app and connected it to a virtual network. Now, the users' uploaded photos need a home. In this final lesson, we'll store them in Azure Blob Storage and see how the app uploads and retrieves them securely. | The VM inside its VNet, carried over from the previous lessons. | Title fades in; VM and VNet slide in from the left. |
|
| 0:20–0:44 | The app could save photos on its own disks, but then the files are tied to that one VM, and they're harder to share, scale and back up. Blob Storage is Microsoft's object storage service for the cloud. It's optimized for storing massive amounts of unstructured data, which apps can reach over HTTPS. | A user uploads a photo to the VM; the VM is highlighted. | Upload path animates from the user to the VM. |
|
| 0:44–1:02 | Unstructured data is data that doesn't follow a particular data model, the way rows in a database table do. Think documents, images, video and audio, log files and backups. That's exactly the kind of data Blob Storage is designed to hold. | A panel of six tiles: documents, images, video and audio, log files, backups, archives. | Tiles fade in one by one. |
|
| 1:02–1:24 | Blob Storage is organized in three levels. At the top is the storage account. It gives your data a unique namespace in Azure. The account name must be unique across Azure, three to twenty-four characters, lowercase letters and numbers only, and it becomes part of every address, like stphotosdemo01.blob.core.windows.net. | The examples panel is replaced by a large storage account box with its endpoint URL. | Panel cross-fades into the account box; URL types on. |
|
| 1:24–1:46 | Inside the account, you create containers. A container organizes a set of blobs, similar to a folder in a file system. Our example has two: uploads, for user photos, and backups, for the app's backup files. Container names are lowercase too, because they become part of the address. | Two containers appear inside the account: uploads and backups. | Containers slide up into the account. |
|
| 1:46–2:04 | Inside containers are blobs: the files themselves. Each blob has its own address, built from the account endpoint, the container name and the blob name. Blob names can include slashes, like 2026/10/team.png, to create a folder-like structure called a virtual directory. | File cards appear in each container; a full blob URL appears with its three parts labeled. | Files drop into containers; URL segments underline one by one. |
|
| 2:04–2:27 | Now, an upload. A user sends a photo to the web app, and the app uploads it to the uploads container over HTTPS, where it's stored as a new blob. In Azure terms, this is a block blob, the blob type for text and binary data such as images and documents. | A file icon travels from the VM, through an access-checks box, into the uploads container, where beach.jpg appears marked NEW. | File icon moves along the upload path; new blob card flashes in. |
|
| 2:27–2:48 | Later, someone wants to see the photo. The app requests the blob by its address, receives the data, and returns the image to the user's browser. Upload and retrieve: that's the core pattern. But we skipped an important question. Why was the app allowed to do either? | The file icon travels back from the container to the VM. | File icon moves along the return path. | — |
| 2:48–3:14 | Every request to Blob Storage must be authorized, unless anonymous read access has been deliberately turned on, and by default it isn't allowed. A good fit for our VM is a managed identity: an identity in Microsoft Entra ID for the VM, granted an Azure role such as Storage Blob Data Contributor. A request without valid credentials is denied. | A managed identity badge appears under the VM; the Identity check is highlighted; a request without credentials from the internet is stopped with a ✕ label. | Badge fades in; denied path draws and stops at the account edge; ✕ label appears. |
|
| 3:14–3:38 | Authorization isn't the only gate. The storage account's network settings must also let the request in. You can limit access to selected networks, or use a private endpoint, so the VM reaches storage through its virtual network. So the VM can use Blob Storage only when both are in place: network connectivity, and the right permissions. | The Network check is highlighted on the upload path. | Network check pulses; upload path animates through both checks. |
|
| 3:38–4:02 | Let's put it all together. The web app runs on an Azure virtual machine. The VM connects through a network interface to a subnet in a virtual network, where security rules filter traffic. And the photos are stored as blobs, in containers, in a storage account, reached with the right network access and permissions. | The complete design: user, VM in its VNet, access checks and the storage account with containers and blobs. | Everything visible; upload path loops end to end. | — |
Sources and accuracy
Technical details were checked against Microsoft Learn on October 13, 2026. Azure changes often, so check the current documentation before relying on a specific detail. The example architecture, names, sizes and addresses are illustrative only.
- Introduction to Blob (object) Storage (Microsoft Learn)
- Storage account overview (naming rules) (Microsoft Learn)
- Remediate anonymous read access to blob data (Microsoft Learn)
- Authorize access to blobs using Microsoft Entra ID (Microsoft Learn)
- Azure Storage firewall and virtual network rules (Microsoft Learn)
Want hands-on Azure training for your team?
I run beginner-to-advanced Azure sessions built around your own environment and goals.