az storage blob download: Fetch Blobs in CI

az storage blob download retrieves a blob from a container into a local file.

Restoring a cache, a Terraform state file, or a build artifact often starts with a blob download. AAD auth keeps it keyless.

What it does

az storage blob download fetches a single blob to the path given by --file. The related download-batch pulls many blobs matching a pattern. Both authorize over RBAC with --auth-mode login.

Common usage

Terminal

az storage blob download \
  --account-name stappci20260630 \
  --container-name artifacts \
  --name build/app.tar.gz --file app.tar.gz \
  --auth-mode login
# many blobs by pattern
az storage blob download-batch \
  --account-name stappci20260630 -s artifacts -d ./out \
  --pattern "build/*" --auth-mode login

Subcommands and flags

Subcommand / Flag	What it does
blob download	Download a single blob
blob download-batch	Download many blobs by pattern
--name, -n	Blob name (with download)
--file, -f	Local destination path
--auth-mode login	Authorize with the AAD identity
--pattern	Glob filter for batch downloads

In CI

Pair --auth-mode login with a Storage Blob Data Reader role for read-only restore steps. For cache restores, branch on the BlobNotFound exit so a cold cache does not fail the build, then continue and repopulate it.

Common errors in CI

"The specified blob does not exist. ErrorCode:BlobNotFound" means a wrong name or container, or the blob was never uploaded. "AuthorizationPermissionMismatch" means the identity lacks a Storage Blob Data role. "No connection string, account key, or SAS token" means you omitted --auth-mode login on a keyless setup.