Azure Storage Blob Py
MicrosoftOfficialCreated by Microsoft
- Skill
- Tool integration
- Cloud and DevOps
- MIT
- Low risk
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The azure-storage-blob-py skill provides the official Python client library for interacting with Azure Blob Storage. It covers essential operations including container management, blob uploads and downloads, listing, and metadata handling. The skill emphasizes secure authentication using DefaultAzureCredential and provides patterns for both synchronous and asynchronous operations.
What it does
- Provides client classes for account, container, and blob-level operations.
- Supports uploading and downloading blobs from files, bytes, or streams.
- Enables listing and hierarchical navigation of blobs within containers.
- Facilitates management of blob metadata and HTTP headers.
- Includes patterns for generating SAS tokens using user delegation keys.
- Offers both synchronous and asynchronous client implementations.
When to use it
- When integrating Azure Blob Storage into Python applications.
- When you need to perform programmatic object storage tasks in Azure.
- When implementing secure, identity-based access to storage resources.
- When managing large file transfers with configurable concurrency settings.
Advantages
- Uses standard Azure identity patterns for secure authentication.
- Supports both sync and async programming models.
- Provides granular control over blob properties and metadata.
- Includes built-in support for parallelized data transfers.
Usage examples
- “How do I upload a file to Azure Blob Storage using Python?”
- The agent provides a code snippet using BlobServiceClient and BlobClient, demonstrating how to open a local file and upload it to a specified container.
- “Show me how to list blobs in an Azure container.”
- The agent provides an example using list_blobs or walk_blobs to iterate through objects, including filtering by prefix.
- “How can I securely authenticate to Azure Blob Storage?”
- The agent explains the use of DefaultAzureCredential to avoid hardcoded keys and demonstrates how to wrap clients in context managers.
- “How do I generate a SAS token for a blob?”
- The agent provides a script using generate_blob_sas and a user delegation key to create a time-limited access token.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-storage-blob-py/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip azure-storage-blob-py.zip -d .agents/skills
Documentation by Microsoft
Azure Blob Storage SDK for Python
Client library for Azure Blob Storage — object storage for unstructured data.
Installation
pip install azure-storage-blob azure-identityEnvironment Variables
AZURE_STORAGE_ACCOUNT_NAME=<your-storage-account> # Required for all auth methods
# Or use full URL
AZURE_STORAGE_ACCOUNT_URL=https://<account>.blob.core.windows.net # Alternative to account name
AZURE_TOKEN_CREDENTIALS=prod # Required only if DefaultAzureCredential is used in productionAuthentication & Lifecycle
🔑 Two rules apply to every code sample below:
Prefer
DefaultAzureCredential. It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation.
Local dev:
DefaultAzureCredentialworks as-is.Production: set
AZURE_TOKEN_CREDENTIALS=prod(orAZURE_TOKEN_CREDENTIALS=<specific_credential>) to constrain the credential chain to production-safe credentials.Wrap every client in a context manager so HTTP transports, sockets, and token caches are released deterministically:
Sync:
with <Client>(...) as client:Async:
async with <Client>(...) as client:andasync with DefaultAzureCredential() as credential:(fromazure.identity.aio)Snippets may abbreviate this setup, but production code should always follow both rules.
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential
from azure.storage.blob import BlobServiceClient
# Local dev: DefaultAzureCredential. Production: set AZURE_TOKEN_CREDENTIALS=prod or AZURE_TOKEN_CREDENTIALS=<specific_credential>
credential = DefaultAzureCredential(require_envvar=True)
# Or use a specific credential directly in production:
# See https://learn.microsoft.com/python/api/overview/azure/identity-readme?view=azure-python#credential-classes
# credential = ManagedIdentityCredential()
account_url = "https://<account>.blob.core.windows.net"
with BlobServiceClient(account_url, credential=credential) as blob_service_client:
# Use blob_service_client here (see following sections for operations)
...Client Hierarchy
| Client | Purpose | Get From |
|---|---|---|
BlobServiceClient | Account-level operations | Direct instantiation |
ContainerClient | Container operations | blob_service_client.get_container_client() |
BlobClient | Single blob operations | container_client.get_blob_client() |
Core Workflow
Create Container
container_client = blob_service_client.get_container_client("mycontainer")
container_client.create_container()Upload Blob
# From file path
blob_client = blob_service_client.get_blob_client(
container="mycontainer",
blob="sample.txt"
)
with open("./local-file.txt", "rb") as data:
blob_client.upload_blob(data, overwrite=True)
# From bytes/string
blob_client.upload_blob(b"Hello, World!", overwrite=True)
# From stream
import io
stream = io.BytesIO(b"Stream content")
blob_client.upload_blob(stream, overwrite=True)Download Blob
blob_client = blob_service_client.get_blob_client(
container="mycontainer",
blob="sample.txt"
)
# To file
with open("./downloaded.txt", "wb") as file:
download_stream = blob_client.download_blob()
file.write(download_stream.readall())
# To memory
download_stream = blob_client.download_blob()
content = download_stream.readall() # bytes
# Read into existing buffer
stream = io.BytesIO()
num_bytes = blob_client.download_blob().readinto(stream)List Blobs
container_client = blob_service_client.get_container_client("mycontainer")
# List all blobs
for blob in container_client.list_blobs():
print(f"{blob.name} - {blob.size} bytes")
# List with prefix (folder-like)
for blob in container_client.list_blobs(name_starts_with="logs/"):
print(blob.name)
# Walk blob hierarchy (virtual directories)
for item in container_client.walk_blobs(delimiter="/"):
if item.get("prefix"):
print(f"Directory: {item['prefix']}")
else:
print(f"Blob: {item.name}")Delete Blob
blob_client.delete_blob()
# Delete with snapshots
blob_client.delete_blob(delete_snapshots="include")Performance Tuning
# Configure chunk sizes for large uploads/downloads
with BlobClient(
account_url=account_url,
container_name="mycontainer",
blob_name="large-file.zip",
credential=credential,
max_block_size=4 * 1024 * 1024, # 4 MiB blocks
max_single_put_size=64 * 1024 * 1024 # 64 MiB single upload limit
) as blob_client:
# Parallel upload
blob_client.upload_blob(data, max_concurrency=4)
# Parallel download
download_stream = blob_client.download_blob(max_concurrency=4)SAS Tokens (User Delegation)
Generate SAS tokens with a user delegation key signed by Microsoft Entra ID — never with an account key. This keeps SAS issuance tied to Entra audit/rotation.
from datetime import datetime, timedelta, timezone
from azure.identity import DefaultAzureCredential
from azure.storage.blob import (
BlobServiceClient,
BlobSasPermissions,
generate_blob_sas,
)
now = datetime.now(timezone.utc)
account_url = "https://<account>.blob.core.windows.net"
with BlobServiceClient(account_url, credential=DefaultAzureCredential()) as service:
# Get a user delegation key (valid up to 7 days). Caller needs the
# "Storage Blob Delegator" role on the storage account.
udk = service.get_user_delegation_key(
key_start_time=now,
key_expiry_time=now + timedelta(hours=1),
)
sas_token = generate_blob_sas(
account_name="<account>",
container_name="mycontainer",
blob_name="sample.txt",
user_delegation_key=udk,
permission=BlobSasPermissions(read=True),
expiry=now + timedelta(hours=1),
)
blob_url = f"{account_url}/mycontainer/sample.txt?{sas_token}"Blob Properties and Metadata
# Get properties
properties = blob_client.get_blob_properties()
print(f"Size: {properties.size}")
print(f"Content-Type: {properties.content_settings.content_type}")
print(f"Last modified: {properties.last_modified}")
# Set metadata
blob_client.set_blob_metadata(metadata={"category": "logs", "year": "2024"})
# Set content type
from azure.storage.blob import ContentSettings
blob_client.set_http_headers(
content_settings=ContentSettings(content_type="application/json")
)Async Client
from azure.identity.aio import DefaultAzureCredential
from azure.storage.blob.aio import BlobServiceClient
async def upload_async():
async with DefaultAzureCredential() as credential:
async with BlobServiceClient(account_url, credential=credential) as client:
blob_client = client.get_blob_client("mycontainer", "sample.txt")
with open("./file.txt", "rb") as data:
await blob_client.upload_blob(data, overwrite=True)
# Download async
async def download_async():
async with BlobServiceClient(account_url, credential=credential) as client:
blob_client = client.get_blob_client("mycontainer", "sample.txt")
stream = await blob_client.download_blob()
data = await stream.readall()Best Practices
Pick sync OR async and stay consistent. Do not mix
azure.storage.blobsync clients withazure.storage.blob.aioasync clients in the same call path. Choose one mode per module.Always use context managers for clients and async credentials. Wrap every client in
with BlobServiceClient(...) as client:(sync) orasync with BlobServiceClient(...) as client:(async). For asyncDefaultAzureCredentialfromazure.identity.aio, also useasync with credential:so tokens and transports are cleaned up.Use
DefaultAzureCredentialfor code that runs locally (instead of connection strings). Use a specific token credential for code that runs in Azure.Set
overwrite=Trueexplicitly when re-uploadingUse
max_concurrencyfor large file transfersPrefer
readinto()overreadall()for memory efficiencyUse
walk_blobs()for hierarchical listingSet appropriate content types for web-served blobs
Reference Files
| File | Contents |
|---|---|
| references/capabilities.md | Capability index mapping hero flows and non-hero references. |
| references/non-hero-scenarios.md | Dedicated non-hero examples (metadata/properties and async patterns). |
Files
- ATTRIBUTION.mdAdded by AutoGineer974 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md8.9 KiB
- references/capabilities.md1.3 KiB
- references/non-hero-scenarios.md1.6 KiB
references/non-hero-scenarios.md
azure-storage-blob-py non-hero scenarios
These scenarios are intentionally separate from hero flows in SKILL.md.
They cover secondary/advanced patterns typically used after the primary end-to-end path is working.
Blob Properties and Metadata
# Get properties
properties = blob_client.get_blob_properties()
print(f"Size: {properties.size}")
print(f"Content-Type: {properties.content_settings.content_type}")
print(f"Last modified: {properties.last_modified}")
# Set metadata
blob_client.set_blob_metadata(metadata={"category": "logs", "year": "2024"})
# Set content type
from azure.storage.blob import ContentSettings
blob_client.set_http_headers(
content_settings=ContentSettings(content_type="application/json")
)Async Client
from azure.identity.aio import DefaultAzureCredential
from azure.storage.blob.aio import BlobServiceClient
async def upload_async():
async with DefaultAzureCredential() as credential:
async with BlobServiceClient(account_url, credential=credential) as client:
blob_client = client.get_blob_client("mycontainer", "sample.txt")
with open("./file.txt", "rb") as data:
await blob_client.upload_blob(data, overwrite=True)
# Download async
async def download_async():
async with DefaultAzureCredential() as credential:
async with BlobServiceClient(account_url, credential=credential) as client:
blob_client = client.get_blob_client("mycontainer", "sample.txt")
stream = await blob_client.download_blob()
data = await stream.readall()Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an API key, Needs Python
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/skills · .github/plugins/azure-sdk-python/skills/azure-storage-blob-py · commit 0696600
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Microsoft.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-storage-blob-py.zip