Azure Blob Storage vs Cloudflare R2

Azure Blob Storage

Microsoft Entra ID roles can be scoped to one container, and a user delegation signature hands out a link that expires within seven days. Account keys with full access stay enabled until the owner turns them off, request logs are off until configured, and an Azure account needs a person, a phone number and a payment card.

Cloudflare R2

Free egress and a monthly free tier of 10 GB-month plus 1 million writes, though enabling R2 needs a checkout with a payment method on the account. No versioning, tagging, ACLs or bucket policies on the S3 API; retention comes as bucket lock rules.

Azure Blob Storage

1. Request an Entra ID token for https://storage.azure.com/ and send it as a Bearer header with x-ms-version and x-ms-date. Put Blob also needs x-ms-blob-type: BlockBlob
2. Ask for a Storage Blob Data role on the one container. Role changes can take up to 10 minutes to apply
3. To share a file, call Get User Delegation Key, then sign a SAS with sp=r, spr=https and a short expiry. Treat the URL as a secret
4. Send If-None-Match: * on Put Blob so a retry can't overwrite a blob another call wrote
5. On 503 ServerBusy back off exponentially. After 500 OperationTimedOut check the blob's state before retrying, since the write may have succeeded

Cloudflare R2

1. Set region to auto and the endpoint to https://<account-id>.r2.cloudflarestorage.com. us-east-1 also works, other region names fail
2. Ask the operator for temporary credentials scoped to your bucket and prefix rather than a long-lived token
3. For public reads put a custom domain or an r2.dev subdomain on the bucket; presigned URLs only sign the S3 hostname
4. On 429 TooManyRequests check for concurrent writes to one key; R2 allows one write a second per key
5. Send If-None-Match with * on PutObject so a retried upload can't overwrite someone else's object