How to Audit Azure Blobs by Access Tier and Metadata
Use inventory for reporting, not manual browsing
Section titled "Use inventory for reporting, not manual browsing"The Azure portal is fine when you need to inspect one container. It is a poor way to answer account-wide questions such as:
- How much data is in Hot, Cool, Cold, and Archive?
- Which old blobs are still on Hot?
- Which objects have a legal hold or encryption status?
- How large are the current versions, snapshots, and previous versions?
Azure Blob Inventory is the native reporting feature for that job. It writes a scheduled CSV or Apache Parquet report into a container in the storage account.[1]
What the report can contain
Section titled "What the report can contain"An inventory policy controls the fields and records in the report. Microsoft documents fields including:
- Name and blob type
- Creation and last-modified time
- Last access time
- Content length and content type
- ETag and content MD5
- Access tier and tier-change time
- Lease status
- Server-encryption status
- Metadata
The policy can include current blobs, snapshots, versions, and deleted records. Filters can narrow the report by blob type, age, and path prefix.
This is more reliable than scraping rows from the portal because Azure generates the report from a declared policy.
The schedule is the main limitation
Section titled "The schedule is the main limitation"Blob Inventory runs daily or weekly. It is not a live query button.
Create the destination container before enabling the policy, choose the fields you need, and wait for the scheduled report. Microsoft does not promise one fixed delivery hour, so do not build a same-minute operational process around it.
If you need to browse and act on files now, use the portal, CLI, SDK, or a file browser. Inventory is better for repeatable audits and trend analysis.
Start with a small policy
Section titled "Start with a small policy"An inventory policy can contain up to 100 rules. More rules are not automatically better.
Begin with one report for current block blobs and include only the fields needed for the first question. CSV is easy to inspect. Parquet is a better fit when an analytics tool will process a large report.
After the first output arrives:
- Confirm that the expected containers and prefixes appear.
- Check the tier values against a few known blobs.
- Compare the total content length with an independent account estimate.
- Add snapshots, versions, or deleted records only if the audit needs them.
Inventory and Blober solve different parts
Section titled "Inventory and Blober solve different parts"Use Blob Inventory when you need a scheduled account report. Use Blober when you need to browse selected containers, filter records, preview a transfer, change tiers, or reorganize files now.
The two tools fit together. Inventory finds a population, such as old Hot blobs. Blober can then handle a selected operational move or tier change without turning the reporting policy into a transfer script.
Related Guides
Section titled "Related Guides"- How to Bulk Change Azure Blob Storage Access Tiers
- Azure Blob Tiers vs S3 Storage Classes
- Organize Blob and Object Storage Without File Search
- Azure Blob Storage Setup and Transfers
Get Blober
Section titled "Get Blober"Inventory tells you what is there. Blober lets you browse, filter, and act on it. Select blobs, change access tiers, and move data between Azure and other providers from a desktop app.