Create and secure storage accounts — AZ-104 Chapter 4

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Configure storage accounts, redundancy and access (keys, SAS, firewalls)

Choose the account type

Most accounts are Standard general-purpose v2 (StorageV2). Premium types are for low latency.

Type	For
Standard general-purpose v2	Blobs, files, queues, tables — the default
Premium block blobs	Many small, fast blob operations
Premium file shares	Fast SMB / NFS file shares
Premium page blobs	Unmanaged disks (rare today)

$az storage account create -n stshop2026 -g rg-data -l westeurope --sku Standard_ZRS --kind StorageV2 \
    --min-tls-version TLS1_2 --allow-blob-public-access false --https-only true
$az storage account show -n stshop2026 --query "{sku:sku.name, kind:kind, tls:minimumTlsVersion}"

Remember

The account name is global: 3–24 small letters and digits, unique in all of Azure.

4.2

Choose the redundancy

Azure always keeps several copies. The SKU decides where they are.

SKU	Copies	Survives
LRS	3 in one data centre	A disk or server failure
ZRS	3 across 3 zones	Loss of one data centre
GRS	LRS + 3 in the paired region	Loss of a region (failover needed)
RA-GRS	GRS + read access to the copy	Read during a regional outage
GZRS / RA-GZRS	ZRS + paired region	Zone and region loss

$az storage account update -n stshop2026 -g rg-data --sku Standard_RAGZRS

4.3

Use access keys with care

Each account has two access keys with full rights. Rotate them one at a time; better: do not use them at all.

$az storage account keys list -n stshop2026 -g rg-data -o table
$az storage account keys renew -n stshop2026 -g rg-data --key key1
$az storage account update -n stshop2026 -g rg-data --allow-shared-key-access false

Watch out

A leaked account key = full access to all data. Store keys in Key Vault, rotate them, or turn shared-key access off and use Entra roles.

4.4

Give limited access with SAS

A shared access signature (SAS) is a signed URL with limited rights, scope and time.

SAS type	Signed with	Best for
User delegation SAS	An Entra identity	Blobs — the most secure SAS
Service SAS	The account key	One service (blob, file, queue, table)
Account SAS	The account key	Several services

$az storage container generate-sas --account-name stshop2026 --name invoices --permissions r --expiry 2026-11-01T00:00Z --auth-mode login --as-user -o tsv
$az storage container policy create --account-name stshop2026 --container-name invoices --name read-30d --permissions r --expiry 2026-12-01

At work

A stored access policy on a container lets you cancel all SAS tokens made from it at once — delete or change the policy.

4.5

Give data access with Entra roles

Data roles give users and apps access to blobs and queues without keys.

$az role assignment create --assignee APP_OR_USER_ID --role "Storage Blob Data Contributor" \
    --scope /subscriptions/SUB_ID/resourceGroups/rg-data/providers/Microsoft.Storage/storageAccounts/stshop2026/blobServices/default/containers/invoices
$az storage blob list --account-name stshop2026 --container-name invoices --auth-mode login -o table

Role	Rights
Storage Blob Data Reader	Read blobs
Storage Blob Data Contributor	Read, write, delete blobs
Storage Blob Data Owner	Also set POSIX ACLs (Data Lake)
Storage File Data SMB Share Contributor	Read and write on file shares with identity-based access

4.6

Limit network access

The storage firewall allows only chosen networks and IPs. A private endpoint gives the account a private IP in your VNet.

$az storage account update -n stshop2026 -g rg-data --default-action Deny
$az storage account network-rule add -n stshop2026 -g rg-data --ip-address 203.0.113.10
$az storage account network-rule add -n stshop2026 -g rg-data --vnet-name vnet-prod --subnet snet-app

Private endpoints are explained in Secure network access.

4.7

Know the encryption options

All data is encrypted at rest. You choose who holds the key.

Microsoft-managed keys: the default, nothing to do.
Customer-managed keys in Key Vault: you control rotation and can revoke access.
Infrastructure encryption: a second layer of encryption.
In transit: HTTPS only and minimum TLS 1.2.

All commands in this chapter

az