---
id: azure--azure-blob-operation
title: "Blob operation"
summary: "Deletes, copies, moves, tags or changes the access tier of a blob in Azure Storage. The blob comes from an incoming blob file info (*Blob enumerator*) or from the configuration; the file info of the resulting blob is passed on. Use it for housekeeping (archive or delete old blobs) or to move blobs between containers."
audience: user
keywords: "input, output, nodata, authentication, connectionstring, accounturl, tenantid, clientid, clientsecret, sastoken, operation, containername, blobname, targetcontainer, targetnamepattern, existingbloboption, tag, accesstier"
---
# Blob operation

Deletes, copies, moves, tags or changes the access tier of a blob in Azure Storage. The blob comes from an incoming blob file info (*Blob enumerator*) or from the configuration; the file info of the resulting blob is passed on. Use it for housekeeping (archive or delete old blobs) or to move blobs between containers.

## Pins

| Pin | Kind | Types | Description |
|---|---|---|---|
| Input | input | `Viaducta.TypeSystem.Metadata.ViaFileInfo` | Triggers the operation. A `ViaFileInfo` whose `FilePath` is a blob URL selects the blob; any other input uses `ContainerName`/`BlobName`. |
| Output | output | `Viaducta.TypeSystem.Metadata.ViaFileInfo` | Called after the operation with the blob's file info: the target of a copy or move, otherwise the blob itself. |
| NoData | no-data output | same as input | Called with the input record when the container or blob does not exist (HTTP 404). |

## Configuration

| Field | Type | Default | Description |
|---|---|---|---|
| `Authentication` | dropdown: `0` ConnectionString, `1` EntraId, `2` ServicePrincipal, `3` SasToken | `0` | How to sign in to the storage account. |
| `ConnectionString` | string | | Storage connection string. Required when `Authentication` is `0`. |
| `AccountUrl` | string | | Blob endpoint, for example `https://myaccount.blob.core.windows.net`, no query. Required when `Authentication` is `1`, `2` or `3`. |
| `TenantId` | string | | Entra ID tenant id. Required for `2`, optional for `1`. |
| `ClientId` | string | | `2`: client id of the app registration (required). `1`: client id of a user-assigned managed identity (optional). |
| `ClientSecret` | password | | Client secret of the app registration. Required for `2`. |
| `SasToken` | password | | Account or container SAS token (a leading `?` is ignored). Required for `3`. |
| `Operation` | dropdown: `0` Delete, `1` Copy, `2` Move, `3` Tag, `4` SetTier | `0` | What to do with the blob. |
| `ContainerName` | string | | Container of the blob, used when the input is not a blob `ViaFileInfo`. |
| `BlobName` | string | | Blob name including virtual folders, used when the input is not a blob `ViaFileInfo`. |
| `TargetContainer` | string | | Copy/Move: target container (must exist); empty keeps the blob's container. |
| `TargetNamePattern` | string | `%SN%` | Copy/Move: target blob name. `%SN%` source blob name with virtual folders, `%FN%` its last part (after the last `/`), `%BN%` the last part without extension, `%TS%` `yyyyMMdd-HHmmss`, `%DATE%` `yyyyMMdd`, `%TIME%` `HHmmss` (UTC). |
| `ExistingBlobOption` | dropdown: `0` Fail, `1` Overwrite, `2` Rename | `0` | Copy/Move when the target exists: fail (HTTP 409), replace it, or write to `<name>_yyyyMMdd_HHmmss<ext>` (plus `_1`, `_2`, ... if that exists too). |
| `Tag` | string | `viaducta-processed` | Tag: index tag to add, `name` or `name=value`; without a value the UTC time is the value. Other tags are kept. |
| `AccessTier` | dropdown: `1` Hot, `2` Cool, `3` Cold, `4` Archive | `2` | SetTier: the new access tier. |

## Behaviour

- The storage client is created at flow start; missing sign-in fields, an unknown operation, Tag without a name or SetTier without a tier fail the start. `1` EntraId uses the default Azure credential (managed identity of the host, workload identity, environment variables or Azure CLI); the identity needs *Storage Blob Data Contributor* (*Storage Blob Data Owner* for Tag).
- Per input the blob is chosen (from the `ViaFileInfo` blob URL or `ContainerName`/`BlobName`; with neither the input fails) and its properties are read. A 404 calls `NoData` with the input record.
- `0` Delete deletes the blob with its snapshots. `1` Copy copies it within the account (server-side) to `<TargetContainer or the same container>/<TargetNamePattern>`. `2` Move copies, then deletes the source. `3` Tag adds `Tag` to the blob's index tags. `4` SetTier sets the access tier of a block blob.
- Delete, Copy and Move only act on the version whose properties were read: a blob changed meanwhile fails with HTTP 412.
- `Output` is called with a `ViaFileInfo` (`FileName` = blob name, `FilePath` = blob URL, size and dates): of the target for Copy and Move, of the blob otherwise (for Delete the blob that was deleted). Storage errors raise an error.

## Notes

- Copy and move stay within the storage account of the sign-in; the target container must exist.
- Setting `Archive` takes the blob offline; setting `Hot`/`Cool`/`Cold` on an archived blob starts a rehydration that takes hours, reads fail until it is done.
- With `3` SasToken the token needs read, write, delete (and tag) permissions as the operation requires.
- Store secrets as expression settings (`=Secrets.AzureStorage`).

## Example

```json
{ "Authentication": 1, "AccountUrl": "https://myaccount.blob.core.windows.net", "Operation": 2, "TargetContainer": "archive", "TargetNamePattern": "%DATE%/%FN%", "ExistingBlobOption": 2 }
```

Timer → Blob enumerator (`OrderBy` `1`, `MinAgeMinutes` `1440`) → **Blob operation** → Log