{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "azure-blob-storage", "name": "Azure Blob Storage", "vendor": "Microsoft Corporation", "vendorUrl": "https://azure.microsoft.com/en-us/products/storage/blobs", "kind": "http-api", "category": "file-storage", "summary": "Microsoft Azure's object storage for files, backups and application data. Agents call a REST API or the Azure SDKs on a storage account, signing in with Microsoft Entra ID, an account key or a shared access signature.", "url": "https://www.anchorterminal.com/tools/azure-blob-storage", "markdownUrl": "https://www.anchorterminal.com/tools/azure-blob-storage.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/azure-blob-storage.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/azure-blob-storage.json", "repo": "https://github.com/Azure/azure-rest-api-specs", "license": "Proprietary service under Microsoft's Product Terms. The Azure SDK client libraries are MIT", "transports": [ "http" ], "remoteUrl": "https://\u003caccount\u003e.blob.core.windows.net", "packages": [ { "registry": "pypi", "name": "azure-storage-blob" }, { "registry": "npm", "name": "@azure/storage-blob" } ], "auth": "mixed", "authNotes": "Three routes. Microsoft Entra ID OAuth 2.0 bearer tokens, authorised by Azure roles assigned on a container, account, resource group or subscription, which Microsoft recommends. Shared Key, an HMAC signature made with one of the account's access keys, which carry full access and are accepted until the owner sets `AllowSharedKeyAccess` to false. A shared access signature (SAS), a signed query string that grants chosen permissions on a resource until an expiry time. A user delegation SAS is signed with a key obtained through Entra ID and lasts at most seven days. Access is self-serve inside an Azure subscription (https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage, https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory).", "pricing": "usage", "pricingNotes": "Hot tier LRS storage is $0.0208 a GB-month for the first 50 TB in East US, cool $0.0152, cold $0.0036 and archive $0.00099. Hot write operations cost $0.05 per 10,000, list and create container operations $0.05, read and other operations $0.004. Cool and cold reads add a retrieval charge of $0.01 and $0.03 a GB. The pricing page draws its numbers by script and showed none, so these come from the Azure Retail Prices API (https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Storage%27%20and%20armRegionName%20eq%20%27eastus%27%20and%20productName%20eq%20%27General%20Block%20Blob%20v2%27). Internet egress is billed separately as bandwidth and its rate was not read. No free allowance for Blob Storage could be read, because the free services page lists its services by script. A new Azure account gets $200 of credit for 30 days and needs a phone number and a credit or debit card (https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account).", "priceSummary": "$0.005 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Blob Storage REST reference, the storage docs read or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 12530696, "pypiWeekly": 22597364, "asOf": "2026-10-08" }, "docsUrl": "https://learn.microsoft.com/en-us/rest/api/storageservices/blob-service-rest-api", "openapi": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/storage/data-plane/Microsoft.BlobStorage/stable/2026-10-06/blob.json", "capabilities": [ "storage.object", "storage.presigned", "storage.share", "infra.azure" ], "tags": [ "hosted", "closed-source", "usage-priced", "card-required", "openapi", "oauth", "python", "typescript", "enterprise", "sla", "eu" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 75.7, "grade": "BB", "agentReady": true, "rank": 40, "ranked": true, "rankOf": 842, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 80, "payments": 20, "reliability": 88, "schema": 85, "security": 81, "transparency": 80 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 88, "points": 17.6, "reason": "Hosted reading. Azure status page with a history of post-incident reviews (20). The history lists three incidents in the last 90 days, West US network connectivity on 23 July 2026 (14:44 to 19:41 UTC), Azure OpenAI and Cognitive Services on 29 September, and gateway services in several regions from 30 September to 1 October. None names Storage. The page lists only broad incidents and the West US fault blocked traffic entering or leaving that region, so we count the record as minor (20 of 30). Targets published with numbers, 20,000 requests a second per standard account, 40,000 in 29 named regions, and 3,000 a second on one block blob (15). 503 Server Busy and 500 Operation Timeout are documented with advice to back off exponentially, the Python client retries three times by default, and `If-None-Match: *` makes a retried write safe. No Retry-After header was found in the pages read (13 of 15). The SLA document of 1 October 2026 commits to 99.9 per cent on the hot tier, 99.99 per cent for reads on RA-GRS accounts, with 10 and 25 per cent credits (10). Generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 85, "points": 13.81, "reason": "A public OpenAPI 2.0 document for service version 2026-10-06 with 69 operations, each with a description (25). learn.microsoft.com/llms.txt returns 404, but every Learn page we asked for with `Accept: text/markdown` came back as Markdown, so half (5 of 10). Reference pages state each operation's purpose, permissions, limits by version and billing category, and seldom say when not to use one. Several are dated 2023 (15 of 20). The contract types 117 parameters, 15 with enums, but most inputs travel as headers or XML and metadata is free-form (12 of 15). Sample requests and responses on the reference pages, a table of 70-odd Blob error codes with HTTP status and message, and a 114-value error code enum in the contract. The contract carries no examples (13 of 15). Dated `x-ms-version` values, a versioning page updated 23 September 2026 with deployment by region, and a page of changes for each version (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 84, "points": 13.65, "reason": "API reading, since Blob Storage has no MCP server of its own. List Blobs caps a page at 5,000 items, returns metadata, tags, versions and snapshots only when `include` asks, and Get Blob takes a `Range`. Responses are XML with no field selection (20 of 25). Paging by `marker` and `NextMarker`, `prefix` and `delimiter` filters, and Find Blobs by Tags (20). Errors carry a code and a message, 70-odd Blob codes are documented, and a 503 says which account limit was passed (16 of 20). Conditional headers, leases and soft delete make retries and mistakes recoverable. `x-ms-client-request-id` correlates logs and is not an idempotency key. The Azure MCP Server, a separate listing, marks its four Blob tools read-only or destructive (16 of 20). Official Python and JavaScript SDKs were checked on their registries, and the Python client retries by default. A REST call needs `x-ms-version`, `x-ms-date` and, for uploads, `x-ms-blob-type` (12 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 81, "points": 14.18, "reason": "Microsoft Entra ID OAuth 2.0 tokens with Azure roles, managed identities on Azure, and user delegation signatures limited to seven days. Account access keys with full access are accepted until the owner disallows Shared Key. A SAS travels in the URL query string. It is a signature over stated permissions and an expiry, not the account key, so we read it as we read S3 presigned URLs and take no deduction, though Microsoft's docs say to protect a SAS like an account key (28 of 30). Storage Blob Data Reader for read-only work, roles on one container, attribute conditions, soft delete of 1 to 365 days, immutability policies and legal holds. Nothing asks for approval on a write or delete (17 of 20). The service returns whatever bytes were stored, and no guidance on treating blob contents as untrusted was found (8 of 15). Resource logs record reads, writes and deletes with caller IP address, but only after the owner adds a diagnostic setting (12 of 15). MSRC coordinated disclosure and bounty policies and a SOC 2 Type 2 report covering Azure. The microsoft.com security.txt passed its Expires date on 23 September 2026, and the audit scope page we loaded did not name services (16 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "No x402, MPP or L402 (0). Per-GB and per-operation prices are public through the Azure Retail Prices API, while the pricing page fills its numbers by script (20). The Azure free account needs a credit or debit card, and no free Blob Storage allowance could be read (0). A person signs up in a browser with a phone number and a card (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "reason": "Read as a closed service with official SDKs. azure-storage-blob 12.31.0 reached PyPI on 30 September 2026, and the versioning page was updated on 23 September (30). Four Python releases in the last 90 days, 12.30.1 on 27 August, 12.30.2 on 16 September, 12.30.3 on 22 September and 12.31.0 on 30 September (20). A versioning page and per-version change pages, Microsoft Q\u0026A and the SDK issue trackers on GitHub, which we did not read (10 of 15). Official SDKs current in Python (12.31.0) and JavaScript (12.34.0) (15). The SDKs are released from the azure-sdk monorepos, CI not checked (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "note": "editorial 73, provenance 86", "reason": "Closed service under Microsoft's Product Terms, with MIT client libraries and a public API contract (15 of 30). The privacy statement, last updated September 2026, sends Azure customer data to the Product Terms and the Data Protection Addendum. The addendum of 22 May 2026 keeps customer data for 90 days after a subscription ends and deletes it within a further 90, and the redundancy docs say LRS replicates only inside the chosen region. These agree (26 of 30). The Modern Lifecycle Policy promises 12 months' notice before support ends, and the general-purpose v1 account retirement was announced in September 2025 for October 2026 (18 of 20). The addendum promises six months' notice of a new sub-processor, and data location follows the region and redundancy option chosen. The sub-processor list sits on the Service Trust Portal, a script-drawn page we could not read (14 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "API reading, since Blob Storage has no MCP server of its own. List Blobs caps a page at 5,000 items, returns metadata, tags, versions and snapshots only when `include` asks, and Get Blob takes a `Range`. Responses are XML with no field selection (20 of 25). Paging by `marker` and `NextMarker`, `prefix` and `delimiter` filters, and Find Blobs by Tags (20). Errors carry a code and a message, 70-odd Blob codes are documented, and a 503 says which account limit was passed (16 of 20). Conditional headers, leases and soft delete make retries and mistakes recoverable. `x-ms-client-request-id` correlates logs and is not an idempotency key. The Azure MCP Server, a separate listing, marks its four Blob tools read-only or destructive (16 of 20). Official Python and JavaScript SDKs were checked on their registries, and the Python client retries by default. A REST call needs `x-ms-version`, `x-ms-date` and, for uploads, `x-ms-blob-type` (12 of 15).", "maintenance": "Read as a closed service with official SDKs. azure-storage-blob 12.31.0 reached PyPI on 30 September 2026, and the versioning page was updated on 23 September (30). Four Python releases in the last 90 days, 12.30.1 on 27 August, 12.30.2 on 16 September, 12.30.3 on 22 September and 12.31.0 on 30 September (20). A versioning page and per-version change pages, Microsoft Q\u0026A and the SDK issue trackers on GitHub, which we did not read (10 of 15). Official SDKs current in Python (12.31.0) and JavaScript (12.34.0) (15). The SDKs are released from the azure-sdk monorepos, CI not checked (5 of 10).", "payments": "No x402, MPP or L402 (0). Per-GB and per-operation prices are public through the Azure Retail Prices API, while the pricing page fills its numbers by script (20). The Azure free account needs a credit or debit card, and no free Blob Storage allowance could be read (0). A person signs up in a browser with a phone number and a card (0).", "reliability": "Hosted reading. Azure status page with a history of post-incident reviews (20). The history lists three incidents in the last 90 days, West US network connectivity on 23 July 2026 (14:44 to 19:41 UTC), Azure OpenAI and Cognitive Services on 29 September, and gateway services in several regions from 30 September to 1 October. None names Storage. The page lists only broad incidents and the West US fault blocked traffic entering or leaving that region, so we count the record as minor (20 of 30). Targets published with numbers, 20,000 requests a second per standard account, 40,000 in 29 named regions, and 3,000 a second on one block blob (15). 503 Server Busy and 500 Operation Timeout are documented with advice to back off exponentially, the Python client retries three times by default, and `If-None-Match: *` makes a retried write safe. No Retry-After header was found in the pages read (13 of 15). The SLA document of 1 October 2026 commits to 99.9 per cent on the hot tier, 99.99 per cent for reads on RA-GRS accounts, with 10 and 25 per cent credits (10). Generally available (10).", "schema": "A public OpenAPI 2.0 document for service version 2026-10-06 with 69 operations, each with a description (25). learn.microsoft.com/llms.txt returns 404, but every Learn page we asked for with `Accept: text/markdown` came back as Markdown, so half (5 of 10). Reference pages state each operation's purpose, permissions, limits by version and billing category, and seldom say when not to use one. Several are dated 2023 (15 of 20). The contract types 117 parameters, 15 with enums, but most inputs travel as headers or XML and metadata is free-form (12 of 15). Sample requests and responses on the reference pages, a table of 70-odd Blob error codes with HTTP status and message, and a 114-value error code enum in the contract. The contract carries no examples (13 of 15). Dated `x-ms-version` values, a versioning page updated 23 September 2026 with deployment by region, and a page of changes for each version (15).", "security": "Microsoft Entra ID OAuth 2.0 tokens with Azure roles, managed identities on Azure, and user delegation signatures limited to seven days. Account access keys with full access are accepted until the owner disallows Shared Key. A SAS travels in the URL query string. It is a signature over stated permissions and an expiry, not the account key, so we read it as we read S3 presigned URLs and take no deduction, though Microsoft's docs say to protect a SAS like an account key (28 of 30). Storage Blob Data Reader for read-only work, roles on one container, attribute conditions, soft delete of 1 to 365 days, immutability policies and legal holds. Nothing asks for approval on a write or delete (17 of 20). The service returns whatever bytes were stored, and no guidance on treating blob contents as untrusted was found (8 of 15). Resource logs record reads, writes and deletes with caller IP address, but only after the owner adds a diagnostic setting (12 of 15). MSRC coordinated disclosure and bounty policies and a SOC 2 Type 2 report covering Azure. The microsoft.com security.txt passed its Expires date on 23 September 2026, and the audit scope page we loaded did not name services (16 of 20).", "transparency": "Closed service under Microsoft's Product Terms, with MIT client libraries and a public API contract (15 of 30). The privacy statement, last updated September 2026, sends Azure customer data to the Product Terms and the Data Protection Addendum. The addendum of 22 May 2026 keeps customer data for 90 days after a subscription ends and deletes it within a further 90, and the redundancy docs say LRS replicates only inside the chosen region. These agree (26 of 30). The Modern Lifecycle Policy promises 12 months' notice before support ends, and the general-purpose v1 account retirement was announced in September 2025 for October 2026 (18 of 20). The addendum promises six months' notice of a new sub-processor, and data location follows the region and redundancy option chosen. The sub-processor list sits on the Service Trust Portal, a script-drawn page we could not read (14 of 20)." }, "sources": [ { "what": "Blob Storage REST API index", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/blob-service-rest-api", "seen": "2026-10-08" }, { "what": "versioning and deployed service versions", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/versioning-for-the-azure-storage-services", "seen": "2026-10-08" }, { "what": "previous service versions", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/previous-azure-storage-service-versions", "seen": "2026-10-08" }, { "what": "authorisation options", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage", "seen": "2026-10-08" }, { "what": "Entra ID roles and scopes", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory", "seen": "2026-10-08" }, { "what": "preventing Shared Key authorisation", "url": "https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent", "seen": "2026-10-08" }, { "what": "Get User Delegation Key", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/get-user-delegation-key", "seen": "2026-10-08" }, { "what": "user delegation SAS", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas", "seen": "2026-10-08" }, { "what": "SAS overview and practices", "url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview", "seen": "2026-10-08" }, { "what": "Put Blob", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/put-blob", "seen": "2026-10-08" }, { "what": "Get Blob", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/get-blob", "seen": "2026-10-08" }, { "what": "List Blobs", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/list-blobs", "seen": "2026-10-08" }, { "what": "Blob Batch", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/blob-batch", "seen": "2026-10-08" }, { "what": "conditional headers", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/specifying-conditional-headers-for-blob-service-operations", "seen": "2026-10-08" }, { "what": "Blob error codes", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/blob-service-error-codes", "seen": "2026-10-08" }, { "what": "common error codes", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/common-rest-api-error-codes", "seen": "2026-10-08" }, { "what": "Blob scalability targets", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/scalability-targets", "seen": "2026-10-08" }, { "what": "standard account scalability targets", "url": "https://learn.microsoft.com/en-us/azure/storage/common/scalability-targets-standard-account", "seen": "2026-10-08" }, { "what": "Python retry policy", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-retry-policy-python", "seen": "2026-10-08" }, { "what": "soft delete", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-blob-overview", "seen": "2026-10-08" }, { "what": "immutable storage", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview", "seen": "2026-10-08" }, { "what": "monitoring and resource logs", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage", "seen": "2026-10-08" }, { "what": "resource log reference", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage-reference", "seen": "2026-10-08" }, { "what": "security recommendations", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/security-recommendations", "seen": "2026-10-08" }, { "what": "redundancy options", "url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy", "seen": "2026-10-08" }, { "what": "general-purpose v1 retirement", "url": "https://learn.microsoft.com/en-us/azure/storage/common/general-purpose-version-1-account-migration-overview", "seen": "2026-10-08" }, { "what": "OpenAPI document, Blob 2026-10-06", "url": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/storage/data-plane/Microsoft.BlobStorage/stable/2026-10-06/blob.json", "seen": "2026-10-08" }, { "what": "retail prices, East US", "url": "https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20%27Storage%27%20and%20armRegionName%20eq%20%27eastus%27%20and%20productName%20eq%20%27General%20Block%20Blob%20v2%27", "seen": "2026-10-08" }, { "what": "pricing page", "url": "https://azure.microsoft.com/en-us/pricing/details/storage/blobs/", "seen": "2026-10-08" }, { "what": "product page", "url": "https://azure.microsoft.com/en-us/products/storage/blobs", "seen": "2026-10-08" }, { "what": "Azure free account", "url": "https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account", "seen": "2026-10-08" }, { "what": "free services", "url": "https://azure.microsoft.com/en-us/pricing/free-services", "seen": "2026-10-08" }, { "what": "SLA for Online Services, 1 October 2026", "url": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services", "seen": "2026-10-08" }, { "what": "status history", "url": "https://azure.status.microsoft/en-us/status/history/", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.microsoft.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Product Terms for Online Services", "url": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "seen": "2026-10-08" }, { "what": "Online Subscription Agreement", "url": "https://azure.microsoft.com/en-us/support/legal/subscription-agreement/", "seen": "2026-10-08" }, { "what": "privacy statement", "url": "https://www.microsoft.com/en-us/privacy/privacystatement", "seen": "2026-10-08" }, { "what": "Data Protection Addendum, 22 May 2026", "url": "https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA", "seen": "2026-10-08" }, { "what": "Modern Lifecycle Policy", "url": "https://learn.microsoft.com/en-us/lifecycle/policies/modern", "seen": "2026-10-08" }, { "what": "SOC 2 Type 2 page", "url": "https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-soc-2", "seen": "2026-10-08" }, { "what": "Python SDK on PyPI", "url": "https://pypi.org/project/azure-storage-blob/", "seen": "2026-10-08" }, { "what": "JavaScript SDK on npm", "url": "https://registry.npmjs.org/@azure/storage-blob/latest", "seen": "2026-10-08" }, { "what": "Azure MCP Server commands", "url": "https://github.com/microsoft/mcp/blob/main/servers/Azure.Mcp.Server/docs/azmcp-commands.md", "seen": "2026-10-08" }, { "what": "authorising with Microsoft Entra ID", "url": "https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-azure-active-directory", "seen": "2026-10-08" }, { "what": "RDAP, windows.net", "url": "https://rdap.verisign.com/net/v1/domain/windows.net", "seen": "2026-10-08" } ], "openQuestions": [ "The lead was right on the interface and the docs. Its URL redirects to https://azure.microsoft.com/en-us/products/storage/blobs, and the contracting entity is Microsoft Corporation.", "unchecked: a free Blob Storage allowance. The free services page lists its services by script and the free account page names none for Blob Storage.", "unchecked: the internet egress (bandwidth) rate, which is a separate Azure meter and was not read.", "unchecked: whether Storage is on Azure's SOC 2 audit scope list. The scope page we loaded did not name services, and the reports sit on the Service Trust Portal.", "unchecked: the Microsoft sub-processor list. The Service Trust Portal page is drawn by script.", "unchecked: incidents limited to one region or to Storage alone, since the public status history lists only broad incidents.", "unchecked: MSRC advisories for Azure Storage in the last 12 months, and CI and open issues for the azure-sdk repositories.", "unchecked: the .NET, Java and Go client libraries, which were not looked up on their registries.", "Not established: whether 503 responses carry a Retry-After header, whether throttled or failed calls are billed, and whether new accounts have blob soft delete on by default.", "The specs repository has a stable folder named 2026-12-06 whose document still gives its version as 2026-10-06. The versioning page does not mention 2026-12-06.", "A judgement call. We took no deduction for SAS tokens in the URL query string, to match the Amazon S3 reading of presigned URLs. Microsoft's docs tell users to protect a SAS like an account key, so a stricter reading takes 10 off Security.", "The Product Terms page showed no effective date when read. Its competitive benchmarking clause is recorded as a fact with no deduction." ] }, "negative": 0, "verdict": "Microsoft Entra ID roles can be scoped to one container, and a user delegation signature hands out a link that expires within seven days. Account keys with full access stay enabled until the owner turns them off, request logs are off until configured, and an Azure account needs a person, a phone number and a payment card.", "bestFor": "Agents and runtimes already on Azure, where a managed identity writes to one container with no stored key, and jobs that need tiers, immutability or geo-redundant copies.", "strengths": [ "Microsoft Entra ID roles such as Storage Blob Data Reader can be assigned on one container, with no stored key for workloads on Azure", "A user delegation shared access signature is signed with Entra credentials, lasts at most seven days and can be limited by permission, IP address and protocol", "SLA of 99.9 per cent on the hot tier, 99.99 per cent for reads on RA-GRS accounts, in the 1 October 2026 SLA document", "Public OpenAPI 2.0 contract with 69 operations for service version 2026-10-06, and Learn pages returned as Markdown on request", "Conditional headers, leases, soft delete of 1 to 365 days and immutability policies protect against a wrong overwrite or delete" ], "weaknesses": [ "Shared Key authorisation with the account's access keys is allowed until the owner sets `AllowSharedKeyAccess` to false", "Request logs are not collected until a diagnostic setting routes the StorageRead, StorageWrite and StorageDelete categories somewhere", "Requests and responses use headers and XML, and every authorised call must carry `x-ms-version`", "The pricing page draws its numbers by script, so an agent reading it sees no price. The Retail Prices API has them", "An Azure account needs a phone number and a credit or debit card, and no free Blob Storage allowance could be read" ], "agentNotes": [ "Request an Entra ID token for https://storage.azure.com/ and send it as a Bearer header with `x-ms-version` and `x-ms-date`. Put Blob also needs `x-ms-blob-type: BlockBlob`", "Ask for a Storage Blob Data role on the one container. Role changes can take up to 10 minutes to apply", "To share a file, call Get User Delegation Key, then sign a SAS with `sp=r`, `spr=https` and a short expiry. Treat the URL as a secret", "Send `If-None-Match: *` on Put Blob so a retry can't overwrite a blob another call wrote", "On 503 ServerBusy back off exponentially. After 500 OperationTimedOut check the blob's state before retrying, since the write may have succeeded" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 75.7 } ], "editorialScores": { "ergonomics": 84, "maintenance": 80, "payments": 20, "reliability": 88, "schema": 85, "security": 81, "transparency": 73 }, "provenanceScore": 86 }, "connect": { "install": "pip install azure-storage-blob azure-identity # or: npm i @azure/storage-blob @azure/identity", "http": "PUT https://myaccount.blob.core.windows.net/mycontainer/myblob\nx-ms-version: 2026-04-06\nx-ms-date: \u003cdate\u003e\nx-ms-blob-type: BlockBlob\nAuthorization: Bearer \u003cEntra ID access token for https://storage.azure.com/\u003e" }, "letme": { "capability": "https://letme.dev/storage.object", "tool": "https://letme.dev/azure-blob-storage" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "azure-document-intelligence", "azure-devops-mcp", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "onedrive-sharepoint", "microsoft-teams", "dynamics-365-sales", "power-automate", "foundry-local", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph" ], "notable": [ "The Blob REST API lists 42 operation pages on accounts, containers and blobs, and the OpenAPI 2.0 document for service version 2026-10-06 has 69 operations (https://learn.microsoft.com/en-us/rest/api/storageservices/blob-service-rest-api; https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/specification/storage/data-plane/Microsoft.BlobStorage/stable/2026-10-06/blob.json)", "As of 23 September 2026 the latest fully deployed service version is 2026-04-06, with 2026-06-06 and 2026-10-06 enabled in almost every region. The newest SDKs default to 2026-10-06 (https://learn.microsoft.com/en-us/rest/api/storageservices/versioning-for-the-azure-storage-services)", "A standard account has a default target of 20,000 requests a second, 40,000 in 29 named regions, and a single block blob up to 3,000 a second. Past a partition's limit the service answers 503 Server Busy or 500 Operation Timeout (https://learn.microsoft.com/en-us/azure/storage/common/scalability-targets-standard-account; https://learn.microsoft.com/en-us/azure/storage/blobs/scalability-targets)", "A block blob can reach about 190.7 TiB (50,000 blocks of 4,000 MiB). One Put Blob call takes up to 5,000 MiB (https://learn.microsoft.com/en-us/azure/storage/blobs/scalability-targets)", "Get User Delegation Key returns a key valid for at most seven days, and a user delegation SAS grants the intersection of its `sp` permissions and the signer's role (https://learn.microsoft.com/en-us/rest/api/storageservices/get-user-delegation-key; https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)", "The `AllowSharedKeyAccess` property is not set by default, and the account accepts Shared Key requests while it is null or true (https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent)", "General-purpose v1 accounts retire in October 2026. Microsoft announced it in September 2025, stopped new v1 accounts in September 2026 and migrates the rest to v2 itself (https://learn.microsoft.com/en-us/azure/storage/common/general-purpose-version-1-account-migration-overview)", "Microsoft's Azure MCP Server, listed separately, has four Blob tools (container create, container get, blob get, blob upload), each marked read-only or destructive (https://github.com/microsoft/mcp/blob/main/servers/Azure.Mcp.Server/docs/azmcp-commands.md)", "https://www.microsoft.com/.well-known/security.txt shows Expires 2026-09-23T16:00:00.000Z, which had passed on 8 October 2026", "The Product Terms' competitive benchmarking clause asks a customer that sells a competing service and publishes a benchmark of an Online Service to give Microsoft the information needed to replicate it (https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all)" ], "area": "everyday", "details": [ { "label": "API", "value": "REST at https://\u003caccount\u003e.blob.core.windows.net, 42 documented operations on accounts, containers and blobs, XML bodies and `x-ms-` headers. Newest service version 2026-10-06, sent in `x-ms-version`. Accounts are created through Azure Resource Manager" }, { "label": "Credentials", "value": "Microsoft Entra ID bearer tokens with Azure roles, Shared Key with one of the account's access keys, or a shared access signature in the URL. Anonymous read is possible where the owner enables it" }, { "label": "Roles", "value": "Storage Blob Data Reader, Contributor and Owner, and Storage Blob Delegator for the user delegation key, assignable on a container, account, resource group or subscription. Attribute-based conditions narrow them further" }, { "label": "Expiring links", "value": "User delegation SAS signed with a key from Get User Delegation Key, valid at most seven days, limited by `sp` permissions, `sip` address range and `spr` protocol. A service SAS tied to a stored access policy can be revoked, with five policies a container" }, { "label": "Request rates", "value": "20,000 requests a second per standard account by default, 40,000 in 29 named regions, 3,000 a second on one block blob. 503 Server Busy or 500 Operation Timeout past a partition's limit" }, { "label": "Object limits", "value": "Block blob about 190.7 TiB (50,000 blocks of up to 4,000 MiB), 5,000 MiB in one Put Blob, append blob about 195 GiB, page blob 8 TiB" }, { "label": "Listing", "value": "List Blobs returns up to 5,000 items a page with `prefix`, `delimiter`, `marker` and optional `include` datasets. Find Blobs by Tags queries index tags. Arrow output from version 2026-06-06" }, { "label": "Deletion", "value": "Blob soft delete keeps deleted or overwritten data for 1 to 365 days once enabled, and Undelete Blob restores it. Time-based retention and legal holds make blobs write-once" }, { "label": "Audit", "value": "Azure Monitor resource logs in the StorageRead, StorageWrite and StorageDelete categories, with caller IP address. Not collected until a diagnostic setting is created" }, { "label": "SLA", "value": "Hot tier, 99.9% for reads and writes and 99.99% for reads on RA-GRS and RA-GZRS accounts. Cool, cold and archive, 99% for writes and 99.9% for reads. Credits of 10% and 25%" }, { "label": "Tiers and redundancy", "value": "Hot, cool, cold and archive tiers. LRS, ZRS, GRS, GZRS and the read-access forms of the last two. LRS keeps replicas inside one region" }, { "label": "SDKs", "value": "Python azure-storage-blob 12.31.0 (30 September 2026, Python 3.10 or later) and JavaScript @azure/storage-blob 12.34.0 (Node 22 or later), both MIT. The Python client retries with exponential backoff by default, three times from 15 seconds" }, { "label": "MCP server", "value": "None dedicated. The Azure MCP Server, listed separately, has four Blob tools for containers, blob properties and upload" } ], "unitPrices": [ { "item": "Hot LRS storage, first 50 TB", "unit": "gb-month", "usd": 0.0208, "note": "East US, general-purpose v2, from the Azure Retail Prices API" }, { "item": "Cool LRS storage", "unit": "gb-month", "usd": 0.0152, "note": "East US" }, { "item": "Hot LRS write operations", "unit": "1k-requests", "usd": 0.005, "note": "$0.05 per 10,000" }, { "item": "Hot read operations", "unit": "1k-requests", "usd": 0.0004, "note": "$0.004 per 10,000" } ], "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "domainNote": "Accounts answer at \u003caccount\u003e.blob.core.windows.net, as Microsoft's REST reference gives it. RDAP shows windows.net registered on 1995-08-10. Docs are on learn.microsoft.com.", "endpointOnVendorDomain": true, "terms": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "privacy": "https://www.microsoft.com/en-us/privacy/privacystatement", "statusPage": "https://azure.status.microsoft/en-us/status", "changelog": "https://learn.microsoft.com/en-us/rest/api/storageservices/versioning-for-the-azure-storage-services", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The Product Terms for Online Services cover Microsoft Azure, carry an acceptable use policy and a competitive benchmarking clause, and point to the Data Protection Addendum. The page showed no effective date when read on 8 October 2026.", "Self-serve Azure accounts also accept the Microsoft Online Subscription Agreement (last updated March 2019, Microsoft Corporation, Washington law) at https://azure.microsoft.com/en-us/support/legal/subscription-agreement/, which incorporates the Online Services Terms and the SLAs.", "The privacy statement (last updated September 2026) names Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, and Microsoft Ireland Operations Limited. It lists Microsoft Azure among the enterprise online services covered by the Product Terms.", "The Data Protection Addendum read is the English edition of 22 May 2026, a Word file linked from https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.", "https://www.microsoft.com/.well-known/security.txt shows Expires 2026-09-23T16:00:00.000Z. It points to the MSRC researcher portal, the bounty policy and the coordinated disclosure policy.", "RDAP gives 1991-05-02 for microsoft.com and 1995-08-10 for windows.net. The registry record does not name a registrant.", "The versioning page is dated 23 September 2026 and each service version has its own page of changes." ], "score": 86, "checks": [ { "check": "Legal entity named", "value": "Microsoft Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "microsoft.com, registered 1991-05-02 (35 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "\u003caccount\u003e.blob.core.windows.net", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 4 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 3.4, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "azure.status.microsoft/en-us/status", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" } ], "policies": [ { "kind": "terms", "url": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "state": "read", "readAt": "2026-10-08", "words": 5677, "points": 3.4, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": false }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…no responsibility or liability for any losses or damages due to performance issues (including but not limited to security vulnerabilities, data loss, or service interruptions) of a Product that customer uses after the end of the applicable support period as provided in the Product Support Lifecycle [https://learn.micr…" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If Microsoft suspends the Online Service, Microsoft will suspend only to the extent reasonably necessary." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Except as permitted in this paragraph or in the Online Service-specific Terms, Customer may not reassign an SL on a short-term basis (i.e., within 90 days of the last assignment)." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Many Online Services offer a Service Level Agreement (SLA)." } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Customer may not use web scraping, web harvesting, or other data extraction methods to extract data from a Microsoft Generative AI Service.", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "If Customer offers a product or service competitive to an Online Service, by using the Online Service, Customer waives any restrictions on competitive use and benchmark testing in the terms governing its competitive products and services.", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "A subscription that is not renewed can continue month by month, and Microsoft may invoice that period at the monthly price plus a three per cent uplift for certain Products.", "quote": "Microsoft reserves the right to invoice Customer for the Extended Term at the then-current published price for a monthly subscription plus a three (3) percent uplift for certain Products." }, { "date": "2026-10-08", "text": "After an account is disabled, the customer has 90 days to extract Customer Data and the subscription cannot be reactivated.", "quote": "Customer will have 90 days to extract Customer Data from a disabled account, but the Subscription cannot be reactivated." }, { "date": "2026-10-08", "text": "The customer is responsible for any application or AI agent it creates with Microsoft AI Services, including legal, regulatory and licensing compliance.", "quote": "Customer is responsible for the design, development and use of any application or AI agent it creates using or for use with Microsoft AI Services, including complying with any legal, regulatory, or licensing requirements applicable to the resulting application or AI agent or its use." } ] }, { "kind": "privacy", "url": "https://www.microsoft.com/en-us/privacy/privacystatement", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-01", "words": 33580, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: September 2026", "says": "Last updated 2026-09-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The data we collect depends on the context of your interactions with Microsoft and the choices you make, including your privacy settings and the products and features you use." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "When you delete an email or item from a mailbox in Outlook.com, the item generally goes into your Deleted Items folder where it remains for approximately 7 days unless you move it back to your inbox, you empty the folder, or the service empties the folder automatically, whichever comes first.", "says": "Names a period of 7 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers that help us determine your device’s location." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students;" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "State Data Privacy Notice (including notice at collection details) and the Consumer Health Data Privacy Policy for additional information about your rights and the processing of your personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have a privacy concern, complaint, or question for the Microsoft privacy team or Data Protection Officer, please visit our privacy support and requests page and click on “Contact the Microsoft privacy team or the Microsoft Data Protection Officer” menu.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "In such cases, we implement legal safeguards-such as standard contractual clauses approved by the European Commission – to help protect your rights and ensure your data remains protected.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We also disclose personal data for digital advertising purposes." } ], "notes": [ { "date": "2026-10-08", "text": "For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict.", "quote": "In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control." }, { "date": "2026-10-08", "text": "Prompts and related data sent to the consumer Microsoft Copilot are used to improve services and for relevant advertising.", "quote": "Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising." }, { "date": "2026-10-08", "text": "Microsoft staff manually review some results of its automated systems, including AI, against the source data.", "quote": "For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/azure-blob-storage.json", "live": { "slug": "azure-blob-storage", "probe": { "target": "https://\u003caccount\u003e.blob.core.windows.net", "method": "get", "lastAt": "2026-10-09T11:46:22.69203777Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 44, "samples30d": 44, "days": [ { "date": "2026-10-09", "probes": 44, "ok": 0 } ], "outages": [ { "start": "2026-10-09T07:40:20.163794763Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "updatedAt": "2026-10-09T11:46:22.69203777Z" } } }