az storage container create: Create a Blob Container

az storage container create makes a blob container inside a storage account.

Containers hold blobs. In CI prefer Azure AD auth (--auth-mode login) over account keys so a federated identity, not a long-lived secret, grants access.

What it does

az storage container create creates a container in the named storage account. With --auth-mode login it authorizes using your az login identity over RBAC, avoiding account keys entirely.

Common usage

Terminal

az storage container create \
  --name artifacts \
  --account-name stappci20260630 \
  --auth-mode login
# block public access explicitly
az storage container create -n logs \
  --account-name stappci20260630 \
  --auth-mode login --public-access off

Subcommands and flags

Flag	What it does
--name, -n	Container name
--account-name	Storage account to create it in
--auth-mode login	Authorize with the AAD identity, not a key
--public-access	off, blob, or container anonymous access
--connection-string	Alternative to account-name plus key

In CI

Use --auth-mode login with a federated service principal that holds Storage Blob Data Contributor on the account. This removes account keys from your pipeline. Control-plane Contributor alone is not enough; data-plane roles authorize blob operations.

Common errors in CI

"AuthorizationPermissionMismatch: This request is not authorized to perform this operation using this permission" means the identity has Contributor but not a Storage Blob Data role; assign Storage Blob Data Contributor. Omitting --auth-mode login forces a key lookup and can fail with "No connection string, account key, or SAS token".