Azure Blob Storage Tier Strategy: Hot / Cool / Cold / Archive Selection & Lifecycle Management

Hot, Cool, Cold, and Archive are the four tiers. Hot: for frequently accessed data with the highest storage cost but the lowest transaction cost. Cool: for data kept 30+ days with infrequent access, with medium storage and medium transaction cost, a 30-day minimum retention (early deletion incurs a penalty). Cold: GA in 2022, intended for 90+ day retention, cheaper storage than Cool but more expensive than Archive, with higher transaction costs than Cool and a 90-day minimum. Archive: for long-term retention with yearly-scale access, the cheapest storage tier but takes hours-to-15-hours to retrieve, with a 180-day minimum. Standard playbook: organizational files → Hot, logs and backups → Cool, compliance long-term retention → Cold, regulatory 5-10 year retention → Archive.

A Storage Account lifecycle management policy is a JSON-based rule engine that automatically transitions and deletes blobs across tiers. Typical rules: 1) move Hot → Cool 30 days after creation, Cool → Cold at 180 days, Cold → Archive at 365 days, and delete at 2,555 days (7 years). 2) Move to Cool 90 days after last access (requires Last Accessed Tracking to be enabled). 3) Target only blobs with specific tags, paths, or prefixes. Rules are defined in JSON and applied via the Azure Portal, PowerShell, or Azure CLI. Up to 100 rules per Storage Account. The cost savings in production are huge (often millions of yen per year), so this is a must-configure feature. Last Accessed Tracking is disabled by default and must be explicitly enabled (and only tracks accesses after enablement).

Archive Blob retrieval has four options: 1) High Priority Rehydration: under 1 hour for blobs under 15 GB, costs several times the standard rate, for emergencies. 2) Standard Rehydration: a few hours up to 15 hours, standard cost, for planned retrievals. 3) Direct tier change with Set-AzStorageBlobContent to rehydrate to Cool/Hot (the most common approach). 4) Copy operation: rehydrate by copying to a separate blob, leaving the original Archive blob intact. During rehydration the blob cannot be read; completion notifications are delivered via Event Grid. Archive is the strongest cost optimization for compliance requirements like '5-year retention, retrieved once a year for audits', but never use it for data that needs immediate access.

These are Storage Account redundancy options. LRS (Locally Redundant Storage): 3 copies within a single datacenter, cheapest, 99.999999999% (11 9s) durability, weak against regional disasters. ZRS (Zone Redundant Storage): 3 copies across 3 Availability Zones in the same region, 99.9999999999% (12 9s), AZ-level redundancy. GRS (Geo Redundant Storage): LRS in the primary + asynchronous LRS in a secondary region, 99.99999999999999% (16 9s), covers regional disasters. GZRS (Geo Zone Redundant Storage): ZRS in the primary + asynchronous LRS in the secondary, highest availability and highest cost. RA-GRS / RA-GZRS (Read-Access GRS/GZRS): enables read access to the secondary region, so you can read from the secondary even in steady state. Standard playbook: general production → ZRS, critical production → GZRS, lowest cost → LRS, disaster recovery required → RA-GZRS.

Yes. Access tiers can move directly between any combination of Hot ↔ Cool ↔ Cold ↔ Archive, so Hot → Archive direct transitions are fine. The minimum retention rules still apply, however: moving or deleting within 30 days of a Cool transition incurs an early deletion fee (prorated), 90 days for Cold, and 180 days for Archive. In practice: uploading directly to Archive (one-shot archive writes) is valid, transitioning Hot → Archive right after upload is fine with no early deletion fee, but deletions or transitions before the 30/90/180-day thresholds for Cool/Cold/Archive will incur early deletion charges. Keep these rules in mind and the design decisions become clear.

These are Storage Account performance tiers. Standard: general purpose, supports all 4 access tiers (Hot/Cool/Cold/Archive), focused on cost optimization. Premium Block Blob: SSD-based, low latency (1-3 ms), high IOPS, Hot tier only (no Cool/Cold/Archive support), several to 10x the cost of Standard. Premium Block Blob shines for: 1) high-volume small-file read/write (ML datasets, log aggregation), 2) intermediate data in real-time analytics, 3) high-frequency API-based access, 4) high-performance AKS PersistentVolume requirements. The vast majority of workloads are fine with Standard; only use Premium Block Blob when you have a clear low-latency requirement. Beyond Block Blob, there are also Premium Page Blob (VM Managed Disk) and Premium File Storage (Azure Files) variants.

Key security controls: 1) Disable public access on the Storage Account (Allow Blob Anonymous Access = false) and only allow access via Private Endpoint. 2) Use Microsoft Entra ID authentication (RBAC roles such as Storage Blob Data Contributor) and limit Storage Account Keys to emergencies. 3) Always set an expiration on SAS tokens (centrally managed via Stored Access Policy) and prefer User Delegation SAS (Entra ID-based). 4) Encrypt with Customer-Managed Keys (CMK) integrated with Key Vault or Managed HSM. 5) Enable Microsoft Defender for Storage (malicious upload detection, Sensitive Data Discovery). 6) Restrict network access to Selected Networks + Private Endpoint. 7) Enable Versioning + Soft Delete to protect against logical/accidental deletion. 8) Send diagnostic logs to Log Analytics and monitor them with Microsoft Sentinel. These are must-configure items in production to prevent incidents.

AZ-104 (Administrator) Domain 2 (Storage, 15-20%) tests Blob, Files, access tiers, lifecycle, replication, and SAS in depth. AZ-204 (Developer Associate, retiring 2026-07) covers Blob operations via SDKs, AZ-305 (Solutions Architect Expert) covers storage selection architecture, DP-203 / DP-700 (Data Engineer) cover data lake use cases, SC-300 (Identity Admin) covers RBAC authentication, and SC-100 (Cybersecurity Architect Expert) covers data protection design. Understanding Storage Accounts is essential for every engineer who works with Azure.