Blob access tiers and lifecycle rules

Both of these turn up as urgent tickets, usually on a Friday evening.

1Break it: “The file won’t download”

Try to read the archived log:

az storage blob download --account-name $st --auth-mode login --container-name lab --name logs/day3.log --file C:\azure-lab\day3-back.log

You’ll get an error like this:

This operation is not permitted on an archived blob.
RequestId:5b1e...
Time:2026-10-20T16:05:11.0000000Z
ErrorCode:BlobArchived

Archive blobs are offline. Nothing can read them, not even the account owner, until they are rehydrated to an online tier.

Fix it: rehydrate with High priority, then watch the status:

az storage blob set-tier --account-name $st --auth-mode login --container-name lab --name logs/day3.log --tier Hot --rehydrate-priority High
az storage blob show --account-name $st --auth-mode login --container-name lab --name logs/day3.log --query "{tier:properties.blobTier, status:properties.archiveStatus, priority:properties.rehydratePriority}" -o table

You should see something like this:

Tier     Status                    Priority
-------  ------------------------  ----------
Archive  rehydrate-pending-to-hot  High

While it’s pending, any other tier change is refused. Try it once:

az storage blob set-tier --account-name $st --auth-mode login --container-name lab --name logs/day3.log --tier Cool

This operation is not permitted because the blob is being rehydrated.
ErrorCode:BlobBeingRehydrated

Wait for it (usually under an hour with High), then download:

do { Start-Sleep -Seconds 300; $t = az storage blob show --account-name $st --auth-mode login --container-name lab --name logs/day3.log --query properties.blobTier -o tsv; $t } until ($t -eq 'Hot')
az storage blob download --account-name $st --auth-mode login --container-name lab --name logs/day3.log --file C:\azure-lab\day3-back.log -o none
Get-Content C:\azure-lab\day3-back.log

You should see this at the end:

Hot
log line from day 3

High priority costs more per GB than Standard. For big restores, plan ahead with Standard and tell people it may take until tomorrow.

2Break it: the blob deleted by mistake

Delete hello.txt, then look for it:

az storage blob delete --account-name $st --auth-mode login --container-name lab --name hello.txt
az storage blob list --account-name $st --auth-mode login --container-name lab --query "[].name" -o tsv
az storage blob list --account-name $st --auth-mode login --container-name lab --include d --query "[?deleted].{name:name, deleted:deleted}" -o table

You should see something like this:

logs/day1.log
logs/day2.log
logs/day3.log
Name       Deleted
---------  ---------
hello.txt  True

The normal list doesn’t show it, but the list with deleted items does. Because you turned on soft delete in step 4, it’s still recoverable. Without step 4, it would be gone for good.

Fix it: undelete it:

az storage blob undelete --account-name $st --auth-mode login --container-name lab --name hello.txt
az storage blob download --account-name $st --auth-mode login --container-name lab --name hello.txt --file C:\azure-lab\hello-back.txt -o none
Get-Content C:\azure-lab\hello-back.txt

You should see this:

hello from lesson 21

Clean up: remove the logs and the lifecycle rule, keep soft delete on:

az storage blob delete-batch --account-name $st --auth-mode login --source lab --pattern 'logs/*' -o none
az storage account management-policy delete --resource-group rg-saat-data --account-name $st
az storage blob list --account-name $st --auth-mode login --container-name lab --query "[].name" -o tsv

You should see this:

hello.txt

✅ Checkpoint: You brought back an archived blob and a deleted blob. Only hello.txt is left, and soft delete stays on.

The deleted logs stay as soft-deleted copies for 7 days, which costs a fraction of a cent. The archived one also has a tiny early deletion charge, because it left Archive before 180 days.