azcopy copy: Upload to Azure Blob Storage

azcopy copy uploads or downloads blobs to Azure Storage, authenticating with a SAS token in the URL or with an Azure AD login.

azcopy is the high-throughput transfer tool for Azure Blob and File storage. copy moves data with heavy parallelism; the main CI decision is how to authenticate, via a SAS token appended to the URL or an OIDC-federated AAD login.

What it does

azcopy copy transfers files between local paths and Azure Storage URLs. The destination is a blob or container URL; authentication is either a SAS token query string on the URL or a prior azcopy login (AAD). --recursive copies directory trees.

Common usage

Terminal

# SAS token in the URL
azcopy copy "./dist/*" \
  "https://acct.blob.core.windows.net/www?${SAS_TOKEN}" --recursive

# AAD login (OIDC federated), then copy without a SAS
azcopy login --identity
azcopy copy "./build.tar.gz" \
  "https://acct.blob.core.windows.net/artifacts/build.tar.gz"

Options

Flag	What it does
--recursive	Copy directories recursively
--overwrite true\|false\|ifSourceNewer	Overwrite policy at the destination
--content-type <type>	Set the blob Content-Type
--put-md5	Store an MD5 hash for integrity checks
AZCOPY_AUTO_LOGIN_TYPE	Env var to select the login method (e.g. MSI, SPN)

In CI

Prefer AAD via azcopy login --identity or OIDC-federated credentials over a long-lived SAS in a secret; if you must use a SAS, scope it tightly and give it a short expiry. Quote the URL so the shell does not eat the SAS query string. --recursive with a trailing /* uploads directory contents.

Common errors in CI

"AuthenticationFailed: Server failed to authenticate the request" means a bad or malformed SAS token. "403 This request is not authorized to perform this operation" means the SAS or role lacks the needed permission (Write on the container). "AuthenticationFailed ... signed expiry time ... has already passed" is an expired SAS. "RequestTimeTooSkewed"-style errors appear when the runner clock differs too much from Azure; sync NTP.