AutoGineer
Generated banner for Azure Storage
Generated logo for Azure Storage

Azure Storage

MicrosoftOfficialCreated by Microsoft

  • Skill
  • Tool integration
  • Cloud and DevOps
  • MIT
  • Low risk
Download ZIP

From the author

Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. Answers questions about storage access tiers (hot, cool, cold, archive), when to use each tier, and tier comparison. Provides object storage, SMB file shares, async messaging, NoSQL key-value, and big data analytics. Includes lifecycle management. USE FOR: blob storage, file shares, queue storage, table storage, data lake, upload files, download blobs, storage accounts, access tiers, storage tiers, hot cool cold archive, storage tier comparison, when to use storage tiers, lifecycle management, Azure Storage concepts. DO NOT USE FOR: SQL databases, Cosmos DB (use azure-prepare), messaging with Event Hubs or Service Bus (use azure-messaging).
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides comprehensive guidance on Azure Storage services, covering Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. It offers practical information on storage account tiers, blob access tiers (Hot, Cool, Cold, Archive), and redundancy options. The skill also includes instructions for using the Azure MCP server for direct interaction, CLI fallback commands, and links to language-specific SDK documentation for .NET, Java, JavaScript, Python, Go, and Rust.

What it does

  • Explains Azure Storage service types and their specific use cases.
  • Provides MCP tool commands for listing and managing storage accounts, containers, and blobs.
  • Offers CLI commands for common storage operations as a fallback.
  • Details blob access tiers and storage redundancy options.
  • Provides links to SDK quick-start guides for multiple programming languages.
  • Includes best practices for authentication using Azure Identity.

When to use it

  • When you need to understand which Azure storage service fits your data needs.
  • When you are setting up or managing Azure storage accounts, containers, or blobs.
  • When you need to choose the appropriate access tier for cost and performance optimization.
  • When you are developing applications that interact with Azure Storage programmatically.
  • When you need to troubleshoot or perform basic storage operations via CLI.

Advantages

  • Centralizes information on storage tiers, redundancy, and service selection.
  • Provides clear paths for both MCP-enabled and CLI-based workflows.
  • Includes language-specific SDK references for rapid development.
  • Promotes secure authentication patterns using managed identities.

Usage examples

“What is the difference between Hot and Archive access tiers in Azure Blob Storage?”
The agent explains the access frequency requirements and cost trade-offs for Hot versus Archive tiers, including the rehydration process for archived data.
“How do I list the blobs in my Azure storage container using the MCP tool?”
The agent provides the specific azure__storage command to list blobs, or guides the user to enable the Azure MCP if it is not currently active.
“Show me how to upload a file to Azure Blob Storage using the Python SDK.”
The agent provides a code snippet using the BlobServiceClient and DefaultAzureCredential, along with the necessary installation command for the Python SDK.
“Which redundancy option should I choose for a development environment?”
The agent recommends LRS (Locally-redundant storage) for dev/test environments based on the provided durability and use-case table.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/microsoft/azure-storage/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip azure-storage.zip -d .agents/skills

Documentation by Microsoft

Azure Storage Services

Services

ServiceUse WhenMCP ToolsCLI
Blob StorageObjects, files, backups, static contentazure__storageaz storage blob
File SharesSMB file shares, lift-and-shift-az storage file
Queue StorageAsync messaging, task queues-az storage queue
Table StorageNoSQL key-value (consider Cosmos DB)-az storage table
Data LakeBig data analytics, hierarchical namespace-az storage fs

MCP Server (Preferred)

When Azure MCP is enabled:

  • azure__storage with command storage_account_list - List storage accounts

  • azure__storage with command storage_container_list - List containers in account

  • azure__storage with command storage_blob_list - List blobs in container

  • azure__storage with command storage_blob_get - Download blob content

  • azure__storage with command storage_blob_put - Upload blob content

If Azure MCP is not enabled: In Copilot CLI or Claude Code, ask the user to run /mcp and enable Azure MCP; in other hosts, ask the user to enable Azure MCP through the host's MCP configuration.

CLI Fallback

# List storage accounts
az storage account list --output table

# List containers
az storage container list --account-name ACCOUNT --output table

# List blobs
az storage blob list --account-name ACCOUNT --container-name CONTAINER --output table

# Download blob
az storage blob download --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH

# Upload blob
az storage blob upload --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH

Storage Account Tiers

TierUse CasePerformance
StandardGeneral purpose, backupMilliseconds
PremiumDatabases, high IOPSSub-millisecond

Blob Access Tiers

TierAccess FrequencyCost
HotFrequentHigher storage, lower access
CoolInfrequent (30+ days)Lower storage, higher access
ColdRare (90+ days)Lower still
ArchiveRarely (180+ days)Lowest storage, rehydration required

Redundancy Options

TypeDurabilityUse Case
LRS11 ninesDev/test, recreatable data
ZRS12 ninesRegional high availability
GRS16 ninesDisaster recovery
GZRS16 ninesBest durability

Service Details

For deep documentation on specific services:

SDK Quick References

For building applications with Azure Storage SDKs, see the condensed guides:

For full package listing across all languages, see SDK Usage Guide.

Azure SDKs

For building applications that interact with Azure Storage programmatically, Azure provides SDK packages in multiple languages (.NET, Java, JavaScript, Python, Go, Rust). See SDK Usage Guide for package names, installation commands, and quick start examples.

Files

references/auth-best-practices.md

Azure Authentication Best Practices

Source: Microsoft — Passwordless connections for Azure services and Azure Identity client libraries.

Golden Rule

Use managed identities and Azure RBAC in production. Reserve DefaultAzureCredential for local development only.

Authentication by Environment

EnvironmentRecommended CredentialWhy
Production (Azure-hosted)ManagedIdentityCredential (system- or user-assigned)No secrets to manage; auto-rotated by Azure
Production (on-premises)ClientCertificateCredential or WorkloadIdentityCredentialDeterministic; no fallback chain overhead
CI/CD pipelinesAzurePipelinesCredential / WorkloadIdentityCredentialScoped to pipeline identity
Local developmentDefaultAzureCredentialChains CLI, PowerShell, and VS Code credentials for convenience

Why Not DefaultAzureCredential in Production?

  1. Unpredictable fallback chain — walks through multiple credential types, adding latency and making failures harder to diagnose.

  2. Broad surface area — checks environment variables, CLI tokens, and other sources that should not exist in production.

  3. Non-deterministic — which credential actually authenticates depends on the environment, making behavior inconsistent across deployments.

  4. Performance — each failed credential attempt adds network round-trips before falling back to the next.

Production Patterns

.NET
using Azure.Identity;

var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
// For user-assigned identity: new ManagedIdentityCredential("<client-id>")
TypeScript / JavaScript
import { DefaultAzureCredential, ManagedIdentityCredential } from "@azure/identity";

const credential = process.env.NODE_ENV === "development"
  ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
  : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
// For user-assigned identity: new ManagedIdentityCredential("<client-id>")
Python
import os
from azure.identity import DefaultAzureCredential, ManagedIdentityCredential

credential = (
    DefaultAzureCredential()                              # local dev — uses CLI/VS credentials
    if os.getenv("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
    else ManagedIdentityCredential()                      # production — deterministic, no fallback chain
)
# For user-assigned identity: ManagedIdentityCredential(client_id="<client-id>")
Java
import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.identity.ManagedIdentityCredentialBuilder;

var credential = "Development".equals(System.getenv("AZURE_FUNCTIONS_ENVIRONMENT"))
    ? new DefaultAzureCredentialBuilder().build()          // local dev — uses CLI/VS credentials
    : new ManagedIdentityCredentialBuilder().build();      // production — deterministic, no fallback chain
// For user-assigned identity: new ManagedIdentityCredentialBuilder().clientId("<client-id>").build()

Local Development Setup

DefaultAzureCredential is ideal for local dev because it automatically picks up credentials from developer tools:

  1. Azure CLI — az login

  2. Azure Developer CLI — azd auth login

  3. Azure PowerShell — Connect-AzAccount

  4. Visual Studio / VS Code — sign in via Azure extension

import { DefaultAzureCredential } from "@azure/identity";

// Local development only — uses CLI/PowerShell/VS Code credentials
const credential = new DefaultAzureCredential();

Environment-Aware Pattern

Detect the runtime environment and select the appropriate credential. The key principle: use DefaultAzureCredential only when running locally, and a specific credential in production.

Tip: Azure Functions sets AZURE_FUNCTIONS_ENVIRONMENT to "Development" when running locally. For App Service or containers, use any environment variable you control (e.g. NODE_ENV, ASPNETCORE_ENVIRONMENT).

import { DefaultAzureCredential, ManagedIdentityCredential } from "@azure/identity";

function getCredential() {
  if (process.env.NODE_ENV === "development") {
    return new DefaultAzureCredential();          // picks up az login / VS Code creds
  }
  return process.env.AZURE_CLIENT_ID
    ? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned
    : new ManagedIdentityCredential();                            // system-assigned
}

Security Checklist

  • [ ] Use managed identity for all Azure-hosted apps

  • [ ] Never hardcode credentials, connection strings, or keys

  • [ ] Apply least-privilege RBAC roles at the narrowest scope

  • [ ] Use ManagedIdentityCredential (not DefaultAzureCredential) in production

  • [ ] Store any required secrets in Azure Key Vault

  • [ ] Rotate secrets and certificates on a schedule

  • [ ] Enable Microsoft Defender for Cloud on production resources

Further Reading

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs a command-line tool

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills · .github/plugins/azure-skills/skills/azure-storage · commit 0696600
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from .github/plugins/azure-skills/LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
microsoft/azure-skills

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-storage.zip