How to Audit Azure Blobs by Access Tier and Metadata
· 3 min read · Updated
The Azure portal is fine when you need to inspect one container. It is a poor way to answer questions about the whole account, such as:
- How much data is in Hot, Cool, Cold, and Archive?
- Which old blobs are still on Hot?
- Which objects have a legal hold or encryption status?
- How large are the current versions, snapshots, and previous versions?
Azure's built-in feature for that job is Blob Inventory. It writes a scheduled CSV or Apache Parquet report into a container in the storage account.[1]
An inventory policy controls the fields and records in the report. Microsoft documents fields including:
- Name and blob type
- Creation and last-modified time
- Last access time
- Content length and content type
- ETag and content MD5
- Access tier and tier-change time
- Lease status
- Server-encryption status
- Metadata
The policy can include current blobs, snapshots, versions, and deleted records. Filters can narrow the report by blob type, age, and path prefix.
Because Azure generates the report from a declared policy, it is more reliable than scraping rows from the portal.
Blob Inventory runs daily or weekly, and you can't trigger a report on demand.
Create the destination container before enabling the policy, choose the fields you need, and wait for the scheduled report. Microsoft does not promise a fixed delivery hour, so don't build a process around it that needs the answer within minutes.
If you need to browse and act on files now, use the portal, CLI, SDK, or a file browser. Inventory suits repeatable audits and trend analysis.
An inventory policy can contain up to 100 rules. Begin with one: a report for current block blobs that includes only the fields your first question needs. CSV is easy to inspect. Parquet suits a large report that an analytics tool will process.
After the first output arrives:
- Confirm that the expected containers and prefixes appear.
- Check the tier values against a few known blobs.
- Compare the total content length with an independent account estimate.
- Add snapshots, versions, or deleted records only if the audit needs them.
Use Blob Inventory when you need a scheduled account report. Use Blober when you need to act now: browse selected containers, filter records, preview a transfer, change tiers, reorganize files, or move data between Azure and other providers.
The two work well in sequence. Let the inventory find a group of blobs, such as old blobs still on Hot, then select them in Blober and change their tier or move them. The reporting policy stays a report, and you don't have to build a transfer script on top of it.
How often does Azure Blob Inventory run? Daily or weekly. Microsoft does not promise a fixed delivery hour, so it fits scheduled audits better than questions you need answered right now.
Can the inventory report show each blob's access tier? Yes. Access tier and tier-change time are fields a policy can include, alongside size, dates, ETag, lease status, encryption status, and metadata.
Should I export CSV or Parquet? CSV is easier to open and read. Parquet is the better choice for a large report that an analytics tool will process.
Does the report include snapshots and old versions? It can. A policy can include current blobs, snapshots, versions, and deleted records, and filters can narrow it by blob type, age, and path prefix.