ShareMaster V2 is in beta, a complete rebuild. See what is new and request access →
Features All features overview
Migration Tools Overview Structure and content OneDrive ↔ SharePoint Content only Structure only Move / Copy Upload from this computer Download to this computer Dropbox to SharePoint Resume and incremental runs
Recycling Bin Overview Browse a site's recycle bin Empty recycle bins in bulk Restore and purge history
Archive Overview Configure the tenant On Demand Archive Restore Archived Files Archive Savings Report Blob Viewer
Optimise Storage Tools Overview Delete all items in a list Delete all files and folders in a library Remove empty folders Remove duplicate files Reduce image sizes Delete sites and subsites
SharePoint Tools Overview Tenant Explorer SharePoint Explorer Easy Settings Fix renamed groups List Explorer Search the Preservation Hold Library
Replace Overview Replace in SharePoint Replace in local files Find password-protected files
Shared Links Overview Report shared links Report unique permissions Remove a person from sharing links Remove shared links Remove unique permissions
Version History Overview Version trimming Version trimming report Reset file version
Reports Overview Inventory report Folder inventory Site and subsite storage Security matrix Teams permissions Pre-migration analysis Compare items Dropbox to Microsoft 365 compare Duplicate file report Empty folder report Image size report Recycle bin report Unused licences Report history
V2 beta Pricing Demos Blog Guides Use cases Compare Tools Alerts FAQ Contact Sign in Start free trial
  1. Home
  2. Documentation
  3. Archive

Step 2: Configure Blob Storage

Where your archived file contents actually live

Archived file contents go into an Azure storage account that you own, in your own subscription, on your own bill. ShareMaster never holds a copy. This step either creates a locked-down account for you or checks one you already have.

Makes changes. Creates a billable Azure storage account in your own subscription.
On this page What it does How it runs How it works What you need What it will not do Read next

What it does

  • A storage account and one PRIVATE container. Blob versioning on, and 30-day soft delete on both blobs and containers, so an overwritten or deleted payload is recoverable.
  • Anonymous access is off, so nothing in it can be read without a credential.
  • Account key access is off. ShareMaster uses no account key: a key is a credential that never expires and can do anything, so the account is created without that door. Files are delivered with short-lived links signed by a Microsoft identity instead.
  • HTTPS required, TLS 1.2 minimum, and cross-tenant replication off.
  • An account you already own is CHECKED and never silently reconfigured. Anything that differs is listed for you to decide on, because your account may be shared with systems we know nothing about.

How it runs

  1. Your subscriptions are read. Nothing is created yet. If none appear, the step explains the three reasons why.
  2. You choose redundancy and access tier. The two settings that decide what it costs and what it survives.
  3. The name is checked for availability. Storage account names are unique across all of Azure, so a clash is normal.
  4. The account is created once. One attempt, no retry, then reconciled - an uncertain write against your subscription is never repeated.
  5. The hardening is verified. Read back from Azure's own answer. A request body is a statement of intent.
  6. The private container is created. And refused if Azure reports it as anything other than private.

How it works

The step first lists every subscription your Azure sign-in can see, with its state. New storage is only created in an Enabled subscription; storage that already exists is found in any state, and a subscription that is not Enabled is named with a warning. A storage account ShareMaster created earlier is found by the tag it was created with, not by its name, so coming back to the wizard later picks it up; if more than one tagged account exists, the step reports that rather than choosing one.

Before offering to create anything, it checks that your role on the subscription really allows the create, counting roles that grant everything and then take an action away. On a subscription that has never held storage, Azure's storage service is registered on the subscription first, and the step can also create a resource group for the archive. The account is created once and tagged as the ShareMaster archive, then its settings are read back from Azure and compared with what was asked for. The blob settings and the private container follow, and the container is refused if Azure reports it as anything but private.

On an account it created, the step then gives your own signed-in account Storage Blob Data Contributor, because creating an account gives its creator no access to the data, and the first archive would otherwise fail on its first upload. An account you chose yourself is audited and left as it is: each setting that differs from the hardened set is listed for you to decide on, and the only thing the step adds is the private archive container, after asking. Your role on a chosen account is not changed here; an archive run that finds you cannot write to it offers the grant then.

Nothing in this step reads or writes SharePoint, and nothing is uploaded. Azure is reached with your own Microsoft sign-in throughout, and no account key is used.

What you need

  • An Azure subscription. A Microsoft 365 tenant does not come with one - it is a separate sign-up.
  • An Azure role on that subscription. Microsoft 365 admin roles grant nothing in Azure, so being a Global Administrator is not enough: reading the list needs Reader, and creating an account needs Contributor.

What it will not do

  • Redundancy: locally redundant is the default because it is the cheapest and the one you can raise later. Geo-redundant roughly doubles the storage line on your bill, so it is never chosen for you.
  • Access tier: Cool is the default. The reason a file was archived is that nobody opens it, and a Hot archive saves very little over leaving the file in SharePoint. Cold is cheaper again to store and dearer to read.
  • Azure's Archive tier is deliberately not offered. It applies to individual blobs rather than to an account, and getting a file out of it takes hours, so a click could not open the file, only start a wait. Cool and Cold are both instant.
  • Both settings re-rate existing data if you change them later, so it is cheaper to be right now than to move a full archive afterwards.
  • What happens next: this step gives your own account write access to the data (Storage Blob Data Contributor - Owner alone does not give it), and step 3 gives the endpoint the access it needs. Nothing else is needed from you.

See every feature