PD Azure Blob Storage for Blesta

PD Azure Blob Storage lets a hosting company sell Microsoft Azure Blob Storage as its own product in Blesta. Your customer orders a storage package, and a dedicated Azure storage account and container are created in your subscription within minutes, each with its own access token. The customer manages their storage from your Blesta client portal, you set the price, Azure bills you at cost, and the difference is your margin.

It is built for hosts who run on Microsoft's cloud, or whose customers ask for Azure-based backup and file storage, and who want to offer it without giving anyone an Azure login or building the tooling around it.

Why hosts choose PD Azure Blob Storage

Real Azure storage, isolated by Azure. Every service gets its own storage account and container, plus an access token that Azure itself restricts to that one container. A customer cannot read, write or list any other storage in your subscription, even if they somehow obtained another customer's token.

Customers never need an Azure account. They see a container name, an endpoint and a token in your client portal. Setup in Azure is a one-time job for you; after that every order provisions itself once its invoice is paid.

More than thirty regions. Customers choose where their data lives, from Azure regions across six continents. You can sell UK, European, American and Asian storage from one package.

Works with the tools Azure users already have. The module speaks Azure's own Blob API natively, with no S3 shim in between. Customers get ready-made setups for AzCopy, rclone, Azure Storage Explorer and Cyberduck, and the official Azure SDKs work out of the box.

Quotas you can sell in tiers. Blesta does not invoice usage-based overage, so storage is sold in quota tiers, one package option per tier. Usage is measured daily and shown to customers against their quota, and you see who is over in the admin panel.

Guided when Azure gets in the way. If your Azure subscription has not enabled its storage service yet, the module detects it and walks you through the fix. When your Azure app secret is about to expire it warns you 60, 30 and 7 days ahead, and if it has expired you get a clear message instead of a cryptic error.

How it works

1. Connect your Azure subscription. Run one Cloud Shell command to create a service principal with the Contributor role, then paste its JSON into an Azure Subscription account under Settings, Company, Modules. Test Connection verifies it.
2. Create your packages. Add a package with this module and your subscription, then use Generate options to build the Storage Quota, Region and Versioning options and price them under Configurable Options.
3. Your customer orders. They pick a quota and a region and pay. A storage account, a container and a scoped token are created, and their service page shows progress until it is ready.
4. You get paid, they manage it. Blesta keeps billing as usual. Upgrades and downgrades use Blesta's normal flow and keep the customer's data.

What you get in Blesta

Selling and pricing

• Package options generated in one click: Storage Quota, Region and Versioning
• Choose which options customers see; anything you hide uses the package's default
• Soft quota mode (the default) warns but keeps uploads working; hard mode pauses uploads at 100% while downloads and deleting keep working
• Customers are emailed at 80% and again at 100% of their quota, and you can copy those emails to your administrators
• A name prefix you choose makes your brand part of every container name
• Default region, quota and versioning for packages that do not offer a choice

Provisioning you can trust

• Each service gets its own storage account and container, with names generated to Azure's rules and guaranteed unique
• If no Azure subscription is connected, an order is refused up front instead of leaving a half-made service
• Azure's default limit of about 250 storage accounts per subscription and region produces a guided message, not a raw failure
• A failed setup is never shown as done: the customer sees a plain message and the exact error is kept in your Activity log
• Cancelling a service terminates it: access is revoked and the data is kept for your retention window
• One Azure subscription can serve several installs, each under its own prefix

Running it day to day

• Clients & Storage shows every service with its client, state, access mode, quota percentage, usage and last measurement
• Set any service to read and write, read-only or disabled without changing the customer's credential or touching their data
• Rotate a customer's token in one click, with the old one stopped immediately
• Retention lists terminated services with a countdown to purge eligibility, with approve and hold controls
• Reconcile compares your Azure subscription with Blesta and flags orphan containers, missing containers and stray storage accounts. It only reports and never changes anything
• A health report covers the licence, Azure connection, services, metering and the secret-expiry countdown

What your customers get

• A storage page with endpoint, container, region, access mode and usage against their quota
• An access token they can reveal and copy whenever they need it, and rotate in one click
• Versioning, so overwritten or deleted files can be recovered
• Automatic clean-up rules to delete files after a number of days
• Browser access (CORS) rules for web apps, with no Azure portal access needed
• Expiring share links for downloading or uploading a file, with no account needed on the other side
• Ready-made setups for AzCopy, rclone, Azure Storage Explorer, Cyberduck and the Azure SDKs, with the endpoint, storage account name, container and token already filled in
• Usage history for the last 30 days

Share links, container management and storage settings are each a switch on the package. Turn one off and it disappears from the customer's page and its actions are refused. The pages follow Blesta's client portal theme and are fully translatable.

Security built in

• Your Azure credentials are stored encrypted and never appear on a customer page.
• Each customer's access token is stored encrypted and restricted by Azure to their container only.
• Share links stop working the moment access is restricted by suspension or a quota pause, or when the token is rotated or revoked.
• Nothing is sent to us: customer container names, tokens, files and usage go only to Azure and to your own Blesta.
• Nothing is deleted without your approval in the default purge mode, and an immediate purge requires the container name to be typed.

One product, every feature

PD Azure Blob Storage is one paid module with everything included: provisioning, metering, quotas, versioning, clean-up rules, CORS, share links, retention and reconcile. There is no free tier. There are no per-gigabyte fees to us: your storage lives in your own Azure subscription, you pay Microsoft at cost and set your own sell price.

If your subscription ever lapses, nothing is deleted. You get a 14-day grace period with everything working, then admin management locks while customers keep being served, and only after that do customer features pause behind a neutral message. Usage collection keeps running, and no data is purged while the module is unlicensed.

Requirements

• Blesta 6 or later on PHP 8.2 or later, with the ionCube Loader
• An active Azure subscription, a Microsoft Entra app registration with the Contributor role, and the Microsoft.Storage provider registered (a one-time step per subscription)
• Blesta's cron running, and its Provision Paid Pending Services task enabled
• PD Modules, the free control panel every PD module installs into