🏆 Live Soccer TV: azure storage explorer setup

September 26, 2026

22 min read

Azure Storage Explorer is the free desktop tool Microsoft ships for browsing and managing blob containers, queues, tables, and file shares without touching the CLI every time. The latest build, version 1.46.0 (released August 27, 2026, build 20260827.4), runs on Windows 10/11, macOS (Intel and Apple Silicon), and Linux, and it now leans on a .NET 10 runtime under the hood. This tutorial walks through installing it, connecting to a real Azure Storage account, setting up authentication the right way, moving data with AzCopy integration, and avoiding the errors that send most people to a search bar at 2 a.m.

Whether you are a developer who just needs to peek inside a blob container, an ops engineer auditing SAS tokens, or someone migrating file shares before a deadline, this guide covers the full setup: prerequisites, step-by-step configuration, five pitfalls that waste the most time, troubleshooting for the errors people actually hit, and a small working project you can copy today.

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

What Is Azure Storage Explorer and Why It Still Matters in 2026

Azure Storage Explorer is a standalone GUI application, built on the same Electron-style shell Microsoft uses for VS Code, that connects directly to Azure Storage accounts, Azure Data Lake Storage Gen2, Azure Cosmos DB (via the Table API), and local storage emulators. It exists because the Azure Portal’s storage browser is fine for a quick look, but painful for repetitive uploads, bulk downloads, permission auditing, or working across multiple subscriptions and tenants at once.

Under the hood, Storage Explorer wraps AzCopy for transfer operations, meaning large uploads and downloads get the same parallelized, resumable behavior you’d get from the command line, just with drag-and-drop on top. It also handles Microsoft Entra ID (the current name for Azure AD) sign-in, Shared Access Signature (SAS) attachment, connection strings, and storage account access keys, covering essentially every way a storage account can be reached.

The tool matters more in 2026 than it did a few years ago because storage account security defaults have gotten stricter. Many organizations now disable shared key authorization at the account level, which means the old habit of pasting a connection string into a script no longer works out of the box. Storage Explorer’s support for signing in with Entra ID and honoring both management-plane (Azure Resource Manager) and data-plane RBAC roles makes it one of the few GUI tools that still works cleanly against a locked-down account.

Azure Storage Explorer vs Azure Portal vs Azure CLI

Before diving into setup, it’s worth being clear about when Storage Explorer is actually the right tool, since Azure gives you three overlapping ways to manage the same storage account and picking the wrong one for the job wastes time either way.

Tool	Best for	Drawback
Azure Storage Explorer	Interactive browsing, one-off uploads/downloads, SAS generation, permission checks, cross-tenant work	Not scriptable; a desktop app, not suited to CI/CD
Azure Portal	Quick checks from a browser, no install needed, viewing metrics and diagnostics	Slower for bulk operations; awkward for managing more than a few files at once
Azure CLI / AzCopy	Automation, CI/CD pipelines, reproducible infrastructure-as-code workflows	No visual browsing; steeper learning curve for one-off tasks

In practice, most teams end up using all three: the CLI to provision and automate, Storage Explorer to validate and debug interactively, and the Portal for a fast sanity check from a phone or a machine where nothing is installed. This tutorial focuses on Storage Explorer because it’s the one tool that combines visual verification with direct AzCopy-powered transfers, but every step here has a CLI equivalent shown alongside it so you can automate the same workflow once it’s proven out.

Prerequisites: Versions and Accounts You Need

Before installing anything, confirm you have the following. Skipping this step is the single most common reason installs fail silently or the app opens to a blank window.

Requirement	Minimum / Current Version	Notes
Azure Storage Explorer	1.46.0 (Aug 27, 2026 build)	Download from the official Microsoft page or GitHub releases
Windows	Windows 10 or Windows 11, 64-bit	32-bit Windows unsupported since Storage Explorer 1.30.0
macOS	10.15 Catalina or later	Native builds for Intel x64 and Apple Silicon ARM64
Linux	Current major distros (Ubuntu, Debian, Fedora, RHEL family)	Requires a system password/secret manager (e.g., gnome-keyring, kwallet)
.NET runtime	.NET 10	Required starting with Storage Explorer 1.42.0; the Windows installer can install it for you
Azure subscription	Active, with at least one storage account	Free tier or pay-as-you-go both work
Azure account role	Storage Blob Data Reader/Contributor (data-plane) plus Reader on the subscription (management-plane)	Both planes are needed for full Entra ID sign-in access
AzCopy	Bundled automatically by Storage Explorer	Used internally for all transfer operations

You do not need the Azure CLI or PowerShell installed for this tutorial, though both are useful later if you want to script what you build here in the GUI first. If you plan to test with the local storage emulator instead of a live account, install Azurite via npm (npm install -g azurite) before starting Step 6.

Step 1: Download and Install Azure Storage Explorer

Go to the official Azure Storage Explorer documentation page and download the installer for your OS, or grab a specific build straight from the GitHub releases page if you need to pin a version for a team.

# Windows (winget, if you have it)
winget install Microsoft.AzureStorageExplorer

# macOS (Homebrew)
brew install --cask microsoft-azure-storage-explorer

# Linux (Debian/Ubuntu, using the .deb from GitHub releases)
sudo dpkg -i StorageExplorer-linux-x64.deb
sudo apt-get install -f

On Windows, the installer will prompt to install the .NET 10 runtime if it’s missing — accept this, since Storage Explorer 1.42.0 and later will not launch without it. On first launch, the app checks for an available password manager; on Linux this means gnome-keyring or a compatible secret service needs to be running, or credential storage will fail later.

Step 2: Sign In With Microsoft Entra ID

Open Storage Explorer and click the plug icon (Connect) in the left sidebar, then choose “Subscription.” Select “Sign in using Microsoft Entra ID” (the current name for what used to be labeled Azure AD in older Storage Explorer versions).

Choose your Azure environment (Azure, Azure China, Azure Government, or a sovereign cloud) — most readers want the default “Azure” option.
A browser window opens for sign-in. Use the account tied to your Azure subscription.
Back in Storage Explorer, check the box next to each subscription and tenant you want visible in the left tree.
Click Apply.

If your subscription doesn’t show up after signing in, it’s almost always a permissions gap rather than a bug — see the Troubleshooting section below. Note that a successful sign-in alone is not sufficient: Storage Explorer needs both Azure Resource Manager (management-plane) visibility into the subscription and storage data-plane RBAC roles (like Storage Blob Data Reader) to actually list and open containers.

Step 3: Create or Locate a Storage Account

If you already have a storage account, skip to Step 4. Otherwise, create one from the Azure Portal or the CLI so you have something to connect to.

az group create --name rg-storage-tutorial --location eastus

az storage account create \
  --name sttutorial2026 \
  --resource-group rg-storage-tutorial \
  --location eastus \
  --sku Standard_LRS \
  --kind StorageV2 \
  --access-tier Hot \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false

Setting --allow-blob-public-access false here matters: newer storage accounts default to blocking anonymous public read on containers, and leaving it that way unless you specifically need a public CDN-style container is the safer default for 2026 deployments.

Step 4: Understand Your Authentication Options

Storage Explorer supports four distinct ways to reach a storage account, and picking the wrong one for your situation is where most setup time gets wasted.

Method	Best for	Requires shared key enabled?
Microsoft Entra ID sign-in	Day-to-day use, team environments, accounts with shared key disabled	No
Connection string	Local development, quick scripts, CI secrets	Yes
Storage account access key	Legacy tooling, direct account attach	Yes
SAS URI / SAS token	Scoped, time-limited, external-party access	No (SAS can be issued via Entra ID user delegation)

If your organization has disabled shared key authorization on the storage account (a setting under Configuration in the Azure Portal), connection strings and access keys will fail outright with an authorization error, regardless of how correctly you typed them. In that case, Entra ID sign-in or an Entra-issued user delegation SAS are your only paths in. This single setting is worth checking first any time a “valid” connection string suddenly stops working.

Step 5: Attach a Storage Account Directly (Without Full Subscription Access)

If you were handed a connection string, a SAS URL, or you only have data-plane access without subscription-level visibility, use the direct attach flow instead of Step 2.

Click Connect (plug icon) → “Storage account or service.”
Choose the connection type: “Connection string,” “Shared access signature URL,” “Storage account name and key,” or “Sign in using Microsoft Entra ID” (per-resource sign-in, separate from the subscription-wide sign-in in Step 2).
Paste the value Azure gave you — for a connection string, grab it from Access Keys in the portal or from your team’s secret manager, never from a chat message.
Give the connection a display name so it’s identifiable later if you attach several accounts.
Click Next, then Connect.

This attach method is what most CI pipelines and contractors without full portal access should use, since it avoids granting broader subscription-level RBAC than necessary.

Step 6: Set Up the Local Emulator for Development (Optional but Recommended)

For local development, connecting to a real Azure bill just to test upload logic is wasteful. Azurite, the current cross-platform storage emulator, plugs directly into Storage Explorer.

# Install and start Azurite (default ports 10000 blob, 10001 queue, 10002 table)
npm install -g azurite
azurite --silent --location ./azurite-data --debug ./azurite-data/debug.log

In Storage Explorer, go to Connect → “Attach to a local emulator,” accept the default ports, and it appears in the tree as “(Emulator – Default Ports).” Everything you build against it in this tutorial — containers, blobs, queues — behaves the same way it will against a live account, just without cost or network latency.

Step 7: Create a Blob Container and Upload Files

With your account connected (real or emulated), expand it in the left tree, right-click “Blob Containers,” and choose “Create Blob Container.” Name it using lowercase letters, numbers, and hyphens only — Azure enforces this at the API level, so Storage Explorer will reject anything else before it even reaches the service.

Double-click the new container, then either drag files from your file manager directly into the pane, or use the Upload button and choose “Upload Files” or “Upload Folder.” For larger batches, Storage Explorer hands the transfer to its bundled AzCopy engine automatically, giving you a progress bar with throughput and an activity log entry you can review afterward.

# Equivalent AzCopy command, if you prefer scripting the same upload
azcopy copy "./local-folder/*" \
  "https://sttutorial2026.blob.core.windows.net/my-container?" \
  --recursive

Set the access tier (Hot, Cool, Cold, or Archive) per-blob or per-container from the right-click menu depending on how often the data will be read. Getting this wrong is one of the most expensive mistakes in the pitfalls section below.

Step 8: Generate and Scope a SAS Token

To share access without handing out account keys, right-click a container, storage account, or individual blob and choose “Get Shared Access Signature.”

Set the start time slightly in the past (5–10 minutes) to absorb clock skew between your machine and Azure’s servers.
Set an expiry time that matches the actual need — not “never,” and not a default one-year window for a token you’re emailing to a vendor.
Restrict allowed IP ranges if the consumer’s network is known and static.
Choose only the permissions actually required: Read, Write, Delete, List, Add, Create — avoid checking every box by default.
Set “Allowed protocols” to HTTPS only.
Click Create, then copy either the SAS URL, the SAS token alone, or the query string, depending on what the consumer expects.

A SAS generated this way (an account or service SAS) is signed with the storage account key, so it stops working immediately if shared key authorization is later disabled on that account. For accounts with shared key access turned off, generate a user delegation SAS instead, which is signed with Entra ID credentials and keeps working under stricter security postures.

Step 9: Manage Queues, Tables, and File Shares

Blob storage gets most of the attention, but Storage Explorer handles the other three storage services in the same account just as directly, and each one has its own quirks worth knowing before you rely on it for a real workload.

Working With Queues

Right-click “Queues” under a storage account and create a new one — queue names, like container names, must be lowercase with hyphens only. Once created, double-click it and use “Add Message” to test producer/consumer logic without writing any code yet. The “Peek” button lets you inspect pending messages without dequeuing them, which is useful for debugging a stuck worker process without accidentally consuming the message it’s waiting on. Messages have a visible dequeue count and insertion timestamp, so you can spot a poison message that keeps failing and re-queuing without ever completing.

Working With Tables

Create a table, then add entities manually with PartitionKey and RowKey pairs — these two fields together form the unique identity of a row and determine how Azure physically partitions your data for scale. Storage Explorer’s Query editor accepts OData-style filters, for example PartitionKey eq 'orders-2026' or Timestamp gt datetime'2026-09-01T00:00:00Z', so you can validate a query’s logic and result shape before hardcoding it into application code. This is also the fastest way to confirm whether a partition key design is actually spreading load evenly, since Storage Explorer shows entity counts per query result.

Working With File Shares

Create an SMB-compatible share, upload folders directly through the same drag-and-drop interface used for blobs, and mount it as a network drive from Windows or macOS using the “Connect VM” dialog. That dialog generates the exact net use (Windows) or mount_smbfs (macOS) command with the storage account name and key already filled in, which saves you from hand-assembling a UNC path and remembering the port 445 requirement most corporate firewalls block by default. If a mount attempt hangs, that blocked port is almost always the reason — Azure File Sync or a VPN tunnel that permits port 445 traffic is the usual workaround for restrictive networks.

Step 10: Push and Pull Data With AzCopy Directly

For very large transfers — tens of thousands of files or multi-terabyte datasets — drop out of the GUI and call AzCopy directly for finer control over concurrency, retries, and job resumption. Storage Explorer’s bundled AzCopy handles the same operations, but the standalone binary gives you scriptable logging.

# Authenticate once with Entra ID instead of passing a SAS on every command
azcopy login

# Sync a local folder to a container (only copies changed files)
azcopy sync "./dataset" \
  "https://sttutorial2026.blob.core.windows.net/my-container" \
  --recursive

# Resume an interrupted job using its Job ID (shown when a transfer is interrupted)
azcopy jobs resume

AzCopy’s authorization options include Microsoft Entra ID, SAS tokens, managed identities, and service principals, which makes it the right tool to wire into a CI/CD pipeline instead of Storage Explorer’s GUI, which is designed for interactive human use.

Step 11: Lock Down Network Access and Security Settings

Before calling the setup production-ready, review these account-level settings, since Storage Explorer will happily connect through a misconfigured account and give no warning that it’s insecure.

Secure transfer required — forces HTTPS for every request; leave this on.
Allow Blob anonymous access — should be off unless a specific container is intentionally public.
Shared key access — disable if your team standardizes on Entra ID and SAS; this closes off connection-string and access-key attacks entirely.
Minimum TLS version — set to TLS 1.2 at minimum.
Public network access — set to “Disabled” or “Selected networks” for accounts holding sensitive data, paired with a private endpoint.
Firewall and virtual network rules — allowlist only the IP ranges or VNets that need access.

If a storage account uses a private endpoint or restricted network rules, Storage Explorer can authenticate successfully via Entra ID and still fail to list containers, because authentication and network authorization are enforced independently. Confirm your machine is on an allowed network or VPN before assuming a failed connection is a credentials problem.

Step 12: Configure Proxy Settings (Corporate Networks)

On a corporate network behind a proxy, Storage Explorer and its bundled AzCopy need matching proxy configuration or transfers will hang or fail with generic network errors.

Open Storage Explorer → Edit (or Preferences on macOS) → Application → Proxy.
Choose “System proxy” to let AzCopy auto-detect, “Configure manually” to set host/port explicitly, or “No proxy” to disable proxying entirely.
If your proxy requires basic authentication, enter credentials in the same dialog — AzCopy inherits this from Storage Explorer’s settings rather than needing separate configuration.
Restart Storage Explorer after changing proxy settings for them to take effect on the bundled AzCopy process.

Step 13: Verify Everything Works End to End

Run through this checklist before considering the setup finished:

Sign-in via Entra ID shows the correct subscriptions and tenants in the tree.
A test container was created and a file uploaded, viewable inside the Azure Portal too (confirms it’s hitting the real account, not a cached view).
A SAS token generated in Storage Explorer works when tested from a separate tool (curl, Postman, or a second machine).
Access tier assignments match the intended usage pattern (Hot for active data, Cool/Cold/Archive for the rest).
Security settings (secure transfer, public access, shared key) reflect your organization’s policy, not the account defaults.
Proxy settings, if needed, allow both the GUI and AzCopy transfers to complete without hanging.

Understanding Azure Blob Storage Pricing Tiers

Choosing the wrong access tier is the most expensive mistake covered in this tutorial, so it gets its own section with real numbers. These are the current LRS, pay-as-you-go rates for the first 50 TB/month in a US region, according to Microsoft’s official cost-estimation documentation.

Tier	Storage price (per GB/month)	Write ops (per 10,000)	Read ops (per 10,000)	Retrieval (per GB)
Hot	$0.0208	$0.055	$0.0044	Free
Cool	$0.0115	$0.10	$0.01	$0.01
Cold	$0.0045	$0.18	$0.10	$0.03
Archive	$0.002	$0.11	$5.50	$0.022

The pattern is consistent across every cloud object storage service: cheaper storage means expensive retrieval. Archive tier storage costs roughly 10x less than Hot per gigabyte stored, but a single read operation costs over 1,000x more than a Hot-tier read. Archive also imposes retrieval latency measured in hours, not milliseconds, because data has to be rehydrated before it’s accessible — Storage Explorer will show a blob’s state as “Archived” and require an explicit rehydration request before you can even preview it.

A practical rule that holds up in most environments: if data is read more than once a month, keep it Hot. If it’s compliance or backup data touched rarely and never urgently, Archive is almost always cheaper even after accounting for occasional retrieval costs. Cool and Cold sit in between for data accessed a few times a quarter.

5 Common Pitfalls When Setting Up Azure Storage Explorer

1. Assuming Entra ID sign-in alone grants full access. A successful browser sign-in only proves your identity, not your permissions. Without a data-plane role like Storage Blob Data Reader or Storage Blob Data Contributor assigned via IAM on the storage account, containers will appear empty or throw a 403 the moment you try to open one.

2. Using connection strings against an account with shared key access disabled. The connection string will look completely valid, paste in without error, and then fail the instant a data operation runs. Check the account’s Configuration blade in the Azure Portal for “Allow storage account key access” before assuming a copy-paste mistake.

3. Setting SAS expiry with the wrong clock assumption. If your machine’s clock is even a few minutes ahead of Azure’s servers, a SAS with a start time of “now” can be rejected as not-yet-valid. Backdating the start time by 5–10 minutes avoids this entirely and costs nothing in security.

4. Uploading everything to the Hot tier by default. Storage Explorer defaults new containers to whatever access tier the storage account itself defaults to, usually Hot. For backup or archival workloads, this silently multiplies storage cost for months before anyone notices the bill.

5. Ignoring proxy settings on corporate networks. Storage Explorer’s UI can appear to hang indefinitely during a transfer when a proxy is misconfigured, with no error message pointing at the actual cause. Because AzCopy inherits its proxy behavior from Storage Explorer’s settings rather than the OS automatically, “it works on my home network but not at the office” is almost always a proxy configuration gap, not a credentials issue.

Expected Output: What Success Looks Like

After completing the steps above, here’s what a working setup produces. The left navigation tree in Storage Explorer should show:

Local & Attached
└── (Emulator - Default Ports)
    ├── Blob Containers
    ├── Queues
    ├── Tables
    └── File Shares

[email protected] (Microsoft Entra ID)
└── Your Subscription Name
    └── Storage Accounts
        └── sttutorial2026
            ├── Blob Containers
            │   └── my-container (3 files, 42.1 MB)
            ├── Queues
            ├── Tables
            └── File Shares

A successful AzCopy upload from the command line looks like this:

INFO: Scanning...
INFO: Any empty folders will not be processed, because source and/or destination doesn't have full folder support

Job 4a2f9c11-... has started
Log file is located at: /home/user/.azcopy/4a2f9c11.log

100.0 %, 128 Done, 0 Failed, 0 Pending, 0 Skipped, 128 Total,

Job 4a2f9c11 summary
Elapsed Time (Minutes): 0.42
Total Number Of Transfers: 128
Number of Transfers Completed: 128
Number of Transfers Failed: 0
TotalBytesTransferred: 44207616
Final Job Status: Completed

Troubleshooting: 8+ Common Errors and Fixes

1. “Cannot connect” or the account never loads. Check that the correct tenant/directory is selected in the top-right account switcher, confirm your Entra sign-in session hasn’t expired, and verify the storage account isn’t behind a private endpoint your machine can’t reach.

2. 403 AuthorizationFailure on every operation. This almost always means the signed-in identity or SAS token lacks the required data-plane role or permission bit. Confirm you have Storage Blob Data Reader (read) or Storage Blob Data Contributor (write) assigned at the storage account or resource group level — Owner/Contributor at the subscription level alone does not grant data-plane access by default.

3. Firewall or virtual network blocking access. Authentication can succeed while data access still fails if the storage account’s networking is set to “Selected networks” and your current IP isn’t allowlisted. Check the Networking blade and either add your IP or connect through an allowed VPN.

4. SAS token expired or not yet valid. Inspect the se (expiry) and st (start time) query parameters in the SAS string directly. A clock skew of even a couple of minutes between your machine and Azure can trigger a “not yet valid” rejection on a token that looks correct.

5. Throughput far below expectations on large transfers. Large batch uploads bottleneck on local disk speed, network bandwidth, or excessive concurrency settings more often than on Azure-side limits. For transfers in the hundreds of thousands of files, use AzCopy directly instead of the GUI so you can tune --cap-mbps and concurrency explicitly.

6. Subscription doesn’t appear after signing in. The signed-in identity may lack Reader access on that subscription, or a Conditional Access / tenant policy is filtering subscription discovery. If you only have data-plane access, skip the subscription tree entirely and use “Attach to a resource” with a connection string or SAS instead.

7. “Storage Explorer requires a password manager” error on Linux. Install and start a compatible secret service — gnome-keyring on GNOME-based distros, or ksecretservice/kwallet on KDE — then restart the application. Headless servers without a desktop environment generally can’t run the GUI app at all; use AzCopy or the Azure CLI there instead.

8. App won’t launch after updating on Windows. Confirm the .NET 10 runtime installed correctly; Storage Explorer 1.42.0 and later fail silently on launch if the runtime is missing or mismatched with the app’s architecture (x64 vs ARM64). Reinstall via the official installer, which bundles the correct runtime installer.

9. Uploaded file shows in Storage Explorer but not in the app consuming it. Check whether the consuming app is pointed at a different storage account, region, or the emulator instead of the live account — a surprisingly common mix-up when developers copy a connection string from an old .env file.

10. Archive-tier blob won’t open or download. Archive blobs must be explicitly rehydrated before they’re readable. Right-click the blob, choose “Change Access Tier,” rehydrate to Hot or Cool, and wait — rehydration from Archive typically takes several hours, not seconds.

Advanced Tips for Production Use

Script what you validate in the GUI. Storage Explorer is excellent for figuring out the right SAS permissions or container structure interactively, but once it works, replicate the same operations in AzCopy or Azure CLI scripts so the setup is reproducible and auditable in version control.

Use lifecycle management policies instead of manual tier changes. Rather than remembering to move old blobs to Cool or Archive manually, configure an Azure Storage lifecycle management rule on the account that automatically transitions blobs after N days of inactivity. This eliminates pitfall #4 entirely for any new data going forward.

Prefer user delegation SAS over account SAS wherever possible. A user delegation SAS is tied to an Entra ID identity’s permissions and has a hard 7-day maximum lifetime enforced by Azure, which limits the blast radius if a token leaks. Account SAS tokens signed with a storage key have no such enforced ceiling and remain valid for however long you set the expiry.

Enable Defender for Storage on accounts holding sensitive data. It adds malware scanning on upload and anomaly detection for unusual access patterns, catching things like a compromised SAS token being used from an unexpected geography before it becomes a bigger incident.

Pin the Storage Explorer version in team documentation. Because Storage Explorer ships fairly frequent releases and some features (like OCI-style attach flows or updated RBAC prompts) change behavior between versions, noting the exact build your team validated against saves confusion when someone’s local install auto-updates mid-project.

Automating Storage Explorer-Style Workflows With PowerShell

Once a workflow is validated by clicking through it in Storage Explorer, the next step for most teams is turning it into a repeatable script. PowerShell’s Az module covers the same ground as the GUI and integrates more naturally into Windows-centric CI environments than the Azure CLI does.

# Install the Az module if it isn't already present
Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force

# Sign in interactively (equivalent to Storage Explorer's Entra ID sign-in)
Connect-AzAccount

# Create a storage context using Entra ID instead of an account key
$ctx = New-AzStorageContext -StorageAccountName "sttutorial2026" -UseConnectedAccount

# List containers, mirroring the Storage Explorer tree view
Get-AzStorageContainer -Context $ctx | Select-Object Name, LastModified

# Upload a single file
Set-AzStorageBlobContent `
  -File "./reports/summary.pdf" `
  -Container "reports" `
  -Blob "summary.pdf" `
  -Context $ctx

# Generate a time-limited SAS token for a blob
$sasToken = New-AzStorageBlobSASToken `
  -Container "reports" `
  -Blob "summary.pdf" `
  -Permission "r" `
  -ExpiryTime (Get-Date).AddHours(24) `
  -Context $ctx

Write-Output "Shareable URL: https://sttutorial2026.blob.core.windows.net/reports/summary.pdf$sasToken"

Running this after you’ve already confirmed the same operations work in Storage Explorer gives you a fast way to catch scope or permission mismatches: if the GUI can list a container but the script can’t, the difference is almost always which identity or role each is using to authenticate, not a bug in either tool.

Working With Azure Data Lake Storage Gen2 and Cosmos DB

Storage Explorer isn’t limited to flat blob containers. Two adjacent Azure services show up in the same navigation tree and are worth knowing about if your work touches analytics or NoSQL workloads.

Azure Data Lake Storage Gen2 is a storage account with the hierarchical namespace feature turned on, which changes how folders behave under the hood — instead of blob names simulating a folder structure with slashes, ADLS Gen2 has real directory objects with their own metadata and access control lists (ACLs). Storage Explorer detects this automatically and switches to a folder-first view, letting you right-click any directory to manage POSIX-style ACLs (read/write/execute for owner, group, and other) directly from the GUI instead of calling the Data Lake REST API by hand. This matters for teams running Databricks, Synapse, or Spark jobs against the same account, since those tools expect the hierarchical namespace to be present and correctly permissioned.

Azure Cosmos DB shows up in Storage Explorer’s tree when you attach an account using the Table API, letting you browse and edit Cosmos DB entities with the same interface used for classic Azure Table Storage. The underlying wire protocol is compatible, which is precisely why Microsoft lets one tool handle both — but be aware that Cosmos DB’s request-unit (RU) billing model means even light browsing in Storage Explorer consumes RUs against your provisioned or serverless throughput, unlike classic Table Storage where browsing has no equivalent cost implication.

Complete Working Project: A Blob Upload and SAS-Sharing Workflow

Here’s a complete, minimal workflow that ties every step above together: create a storage account, a container, upload a folder, generate a scoped SAS, and verify access — using the Azure CLI so it’s fully reproducible, with Storage Explorer used to inspect and verify at each stage.

#!/bin/bash
set -e

RG="rg-storage-tutorial"
LOCATION="eastus"
ACCOUNT="sttutorial2026"
CONTAINER="reports"

# 1. Resource group + storage account with secure defaults
az group create --name "$RG" --location "$LOCATION"

az storage account create \
  --name "$ACCOUNT" \
  --resource-group "$RG" \
  --location "$LOCATION" \
  --sku Standard_LRS \
  --kind StorageV2 \
  --access-tier Hot \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --allow-shared-key-access false

# 2. Assign yourself the data-plane role (replace with your object ID)
USER_ID=$(az ad signed-in-user show --query id -o tsv)
SCOPE=$(az storage account show --name "$ACCOUNT" --resource-group "$RG" --query id -o tsv)

az role assignment create \
  --assignee "$USER_ID" \
  --role "Storage Blob Data Contributor" \
  --scope "$SCOPE"

# 3. Create the container using Entra ID auth (no shared key needed)
az storage container create \
  --name "$CONTAINER" \
  --account-name "$ACCOUNT" \
  --auth-mode login

# 4. Upload a folder with AzCopy (also usable via Storage Explorer's Upload button)
azcopy login
azcopy copy "./reports/*" \
  "https://$ACCOUNT.blob.core.windows.net/$CONTAINER" \
  --recursive

# 5. Generate a 24-hour, read-only user delegation SAS for an external reviewer
EXPIRY=$(date -u -d "+24 hours" '+%Y-%m-%dT%H:%MZ')

az storage container generate-sas \
  --account-name "$ACCOUNT" \
  --name "$CONTAINER" \
  --permissions r \
  --expiry "$EXPIRY" \
  --auth-mode login \
  --as-user \
  --https-only

echo "Setup complete. Open Storage Explorer, sign in with Entra ID, and confirm '$CONTAINER' shows the uploaded files."

Run this end to end, then open Storage Explorer and confirm the container and files appear under your subscription tree exactly as scripted — that cross-check is the fastest way to catch a permissions or naming mistake before it reaches a teammate or a CI pipeline.

Frequently Asked Questions

Is Azure Storage Explorer free?
Yes. It’s a free download from Microsoft with no license cost; you only pay for the underlying Azure Storage resources it connects to.

Does Azure Storage Explorer work without an internet connection?
Only against the local Azurite emulator. Any real Azure Storage account requires network access to Azure’s endpoints.

Can I use Azure Storage Explorer with Azure Data Lake Storage Gen2?
Yes, ADLS Gen2 accounts (storage accounts with the hierarchical namespace feature enabled) are fully browsable, including folder-style navigation and ACL management.

Why does my connection string stop working after it worked yesterday?
Check whether shared key access was disabled on the account, or whether the access keys were rotated. Both actions invalidate existing connection strings immediately.

What’s the difference between a SAS token and an access key?
An access key grants full, unscoped access to the entire storage account. A SAS token can be scoped to a specific service, resource, permission set, IP range, and time window, making it the safer option for sharing access with anyone outside your core team.

Can Storage Explorer manage multiple Azure tenants at once?
Yes. After signing in, you can select multiple tenants and subscriptions to display simultaneously in the same navigation tree, switching between them without re-authenticating.

How do I move a blob between access tiers without re-uploading it?
Right-click the blob (or container) and choose “Change Access Tier.” This changes the tier in place; it does not require downloading and re-uploading the data, though moving out of Archive requires a rehydration wait.

Is AzCopy faster than uploading through the Storage Explorer GUI?
They use the same underlying engine, so raw throughput is similar. AzCopy run directly from a terminal gives more control over concurrency and logging for very large or automated transfers, which is why it’s the better choice for CI/CD pipelines.

Related Coverage

Elias Virtanen

Cybersecurity Analyst

Elias Virtanen is the Cybersecurity Analyst at Tech Insider, bringing hands-on expertise from his background in penetration testing and security consulting. He previously worked as a security researcher at F-Secure in Helsinki, where he focused on threat intelligence and vulnerability disclosure. Elias covers ransomware trends, zero-trust architecture, and the evolving regulatory landscape including NIS2 and the EU Cyber Resilience Act. He holds a CISSP certification and an MSc in Information Security from Aalto University.

View all articles

Azure Storage Explorer Setup: Manage Blobs in 13 Steps [2026]