Sequence 5 — Managing Data: Storage Explorer & AzCopy

Prerequisites: Sequences 1-4 (storage account structure, redundancy, encryption). · What you'll be able to do: pick the right tool for a data-movement task · attach Storage Explorer to a resource four different ways · authorize and run AzCopy reliably · know exactly when to reach for sync instead of copy. · Est. time: ~13 min.

1. The client-tools landscape — when to use which

Azure gives you several ways to view and move data in a storage account. They differ along two axes: GUI vs command line, and interactive vs scriptable/automatable.

Mnemonic: portal to peek, Explorer to manage, AzCopy to move (a lot), CLI/PowerShell to automate, SDK to build.

All four data services — Block/Page/Append blobs, Files, Queues, and Tables — are reachable from the portal and from Storage Explorer. AzCopy targets Blob and Files (plus Data Lake Storage Gen2, Amazon S3, and Google Cloud Storage as sources).

Note: the standalone Storage Explorer desktop app and the in-portal Storage browser are two delivery vehicles for the same idea — a tree-based GUI over your data. The desktop app manages many accounts at once and works offline against the local emulator; the in-portal browser needs nothing installed.

2. Azure Storage Explorer — install & connect

Storage Explorer is a free, standalone, cross-platform app for Windows 10/11, macOS 10.15+ (Intel & Apple Silicon), and Linux (best installed from the Snap Store, or via a .tar.gz). Current builds require a .NET runtime that the installer can provision for you. Download it from storageexplorer.com.

There are two broad ways to connect:

1. Sign in to Azure — adds your Microsoft Entra account so every subscription and storage account you can see appears automatically in the tree.
2. Attach to an individual resource — connect to one container, share, queue, or account using one of several credential types.

Important: full access after signing in needs both management-plane (Azure Resource Manager) and data-plane permissions. If you only have data-layer access, attach to the specific resource and choose Sign in using Microsoft Entra ID rather than relying on subscription enumeration. (RBAC roles are detailed in Sequence 7.)

Attach methods — what each one can reach

Key takeaways from the table: name+key attaches at the account level only; a SAS connection string attaches a whole account, while a SAS URL attaches a single container/share/queue/table; Entra ID is the only method that reaches every resource type; anonymous works only for public blob containers.

A SAS connection string bundles the signature with service endpoints, e.g.:

SharedAccessSignature=sv=2020-04-08&ss=btqf&srt=sco&sp=rl&se=...&sig=...;
BlobEndpoint=https://contoso.blob.core.windows.net/;
FileEndpoint=https://contoso.file.core.windows.net/;
QueueEndpoint=https://contoso.queue.core.windows.net/;
TableEndpoint=https://contoso.table.core.windows.net/;

A SAS URL points at one resource:

https://contoso.blob.core.windows.net/container01?sv=2020-04-08&sr=c&sp=rl&se=...&sig=...

Storage Explorer also connects to a local emulator (Azurite on any OS; the legacy Azure Storage Emulator on Windows) for offline development.

3. Storage Explorer — everyday tasks

Once attached, the EXPLORER tree exposes everything; the right pane is your work surface.

• Create a container: right-click Blob Containers > Create Blob Container, type a name, press Enter.
• Upload blobs: on the container ribbon select Upload (file or folder), choose the blob type — Block (default, most files), Append (logging), or Page (VHDs backing IaaS VMs; upload .vhd/.vhdx as page blobs), and optionally a destination folder. Progress shows in the Activities pane.
• View / download: select a container to list blobs; select a blob and click Download.
• Snapshots: right-click a blob > Create Snapshot; review via Manage history > Manage Snapshots (covered in depth in Sequence 11).
• Generate a SAS: right-click an account, container, or blob > Get Shared Access Signature…, pick start/expiry and permissions, Create, then copy the connection string or raw query string.

Note: a SAS made on an account is an account SAS; one made on a container or blob is a service SAS. Storage Explorer always signs the SAS with the storage account key — it does not create a user delegation SAS (one signed with Entra credentials). SAS types are the subject of Sequence 6.

To find a resource quickly, type in the EXPLORER search box, or right-click a node and choose Search From Here.

4. AzCopy v10 — install & authorize

AzCopy v10 is the current, supported command-line utility for copying data to, from, or between storage accounts. It is the right tool for bulk and repeatable transfers and slots cleanly into scripts and pipelines.

Install: on Linux use your package manager (auto-updates, dependency resolution). On all other OSes, download the portable binary and, for convenience, add its directory to your PATH so you can type azcopy from anywhere.

Authorize — you must do this before any meaningful command. Owning the account does not automatically grant data-plane access. Two options:

# Authorize once with your Entra identity (user, managed identity, or service principal)
azcopy login
# Check status / sign out
azcopy login status
azcopy logout

With a SAS token instead, you append it to the resource URL (note the token is a query string on the URL):

azcopy copy "C:\local\path" "https://account.blob.core.windows.net/mycontainer/?sv=2018-03-28&ss=bjqt&srt=sco&sp=rwddgcup&se=2019-05-01T05:01:17Z&sig=REDACTED" --recursive=true

Useful AzCopy verbs: make (create a container/share), copy, sync, list, remove, set-properties (change access tier / tags), and jobs (list/show/resume/clean — resilient, resumable transfers). Get help with azcopy -h or azcopy <command> -h. (Note: AzCopy has no rename command.)

5. AzCopy — upload (local → blob)

Create a container, then copy. Single quotes wrap path arguments in every shell except Windows cmd.exe, where you use double quotes.

# Create a container
azcopy make 'https://mystorageaccount.blob.core.windows.net/mycontainer'

# Upload one file
azcopy copy 'C:\myDirectory\myTextFile.txt' 'https://mystorageaccount.blob.core.windows.net/mycontainer/myTextFile.txt'

# Upload a directory (and everything under it) — folder name is preserved
azcopy copy 'C:\myDirectory' 'https://mystorageaccount.blob.core.windows.net/mycontainer' --recursive

# Upload the CONTENTS of a directory (trailing \* drops the parent folder)
azcopy copy 'C:\myDirectory\*' 'https://mystorageaccount.blob.core.windows.net/mycontainer/myBlobDirectory'

Filtering and targeting flags:

# Combine recursion with a name pattern: all .txt in the whole tree
azcopy copy 'C:\myDirectory' 'https://mystorageaccount.blob.core.windows.net/mycontainer' --recursive --include-pattern '*.txt'

Tip: to get all matching files inside subfolders, combine --recursive (walks the tree) with --include-pattern (filters the names) — pattern matching alone does not descend.

6. AzCopy — sync (one-way mirror) and copy vs sync

azcopy sync makes the destination match the source — a one-way mirror. You choose which endpoint is source and which is destination. It skips files already present and identical (compares last-modified / size and, optionally, MD5), so re-runs transfer only the delta. With --delete-destination, it can also remove destination files that no longer exist at the source.

# Local -> container (container is the destination/mirror)
azcopy sync 'C:\myDirectory' 'https://mystorageaccount.blob.core.windows.net/mycontainer' --recursive

# Container -> local (local is the destination)
azcopy sync 'https://mystorageaccount.blob.core.windows.net/mycontainer' 'C:\myDirectory' --recursive

# Container -> container with SAS tokens on BOTH endpoints
azcopy sync 'https://src.blob.core.windows.net/mycontainer?<src-SAS>' 'https://dst.blob.core.windows.net/mycontainer?<dst-SAS>' --recursive

Important: before using --delete-destination=prompt|true, enable soft delete (Sequence 11) so an accidental sync can't permanently erase data.

Notable sync facts: --recursive defaults to true for sync (you must explicitly disable it). Current AzCopy sync only mirrors local ↔ Blob and Blob ↔ Blob — not Azure Files or S3. --include-pattern/--exclude-pattern match file names only.

copy vs sync — the decision

Rule of thumb: first/one-time load → copy; keep-them-identical, run-again-and-again → sync. Sync is preferable whenever you want incremental, idempotent updates (e.g., a nightly job pushing only changed files), because it avoids re-uploading unchanged data and can prune stale destination files.

Key takeaways

• Peek-Manage-Move-Automate-Build: portal / Storage Explorer / AzCopy / CLI+PowerShell / SDK.
• Storage Explorer attach methods: Entra reaches everything; name+key = account only; SAS connection string = account, SAS URL = one resource; anonymous = public containers only.
• Storage Explorer SAS is always key-signed (account SAS at account level, service SAS at container/blob level) — never a user delegation SAS.
• AzCopy: authorize first (azcopy login for Entra, or append a SAS per URL). Owning the account ≠ data access.
• copy = transfer; sync = mirror. --recursive is opt-in for copy, on by default for sync.
• Patterns (--include/exclude-pattern) match file names only; pair with --recursive to reach subfolders.
• Always enable soft delete before --delete-destination.

Exercises

1. (Recall) Name the five Microsoft client categories for working with storage data and one defining strength of each.
2. (Recall) Which Storage Explorer attach method is the only one that can reach blob containers, file shares, queues, and tables?
3. (Applied) You must run a nightly job that pushes only the files changed since yesterday from a local folder to a container, and removes files deleted locally. Which AzCopy verb and flags?
4. (Applied) Write an azcopy copy command that uploads only .log files from C:\app\logs and all its subfolders into container logs.
5. (Scenario) A teammate has only data-plane RBAC on one container (no subscription-level rights). They can't see the account when they sign in to Storage Explorer. How should they connect, and why does plain sign-in fail?
6. (Scenario) A colleague generated a SAS in Storage Explorer and is surprised it isn't a user delegation SAS. Explain what Storage Explorer produces and the practical consequence.

Coming up next

Sequence 6 — Authorization Foundations: Access Keys & SAS: how account keys work, the anatomy and types of shared access signatures (account vs service vs user delegation), permissions, and how to construct and scope them safely.