DEV Community: nnamdi nmarah

Update and Maintain Resources in Azure - Manage tags and locks

nnamdi nmarah — Mon, 30 Mar 2026 06:43:11 +0000

If you’ve worked through the earlier exercises, you’ve already added a subnet to a virtual network, modified a virtual machine, and interacted with an Azure storage account. This final part of the guided project focuses on using tags and resource locks to better organize, monitor, and protect your environment. In this exercise, you’ll revisit those resources and apply tags, locks, or both where appropriate.

Scenario

The Azure administrator wants to finalize a few configurations to improve visibility and safeguard resources. Specifically, they want to ensure the virtual machine running as an FTP server isn’t accidentally deleted, and they’d like a simple way to identify which department owns each resource and its purpose.

Managing tags and locks on virtual machines

Tags provide a convenient way to organize and categorize resources. They can be applied at different levels, making it easier to group resources in a way that fits your environment.

Adding tags to a virtual machine

Start by assigning two tags to the virtual machine—one to describe its purpose and another to indicate the department it supports.

In the Azure portal, search for Virtual machines under Services.
Select the guided-project-vm virtual machine.

From the menu pane, select Tags.
On one line for Name, enter Department, and for Value, enter Customer Service
On the next line, for Name, enter Purpose, and for Value, enter FTP Server.
Select Apply.

Add a resource lock to a VM

While on the Virtual Machine page, expand the Settings submenu and select Locks.

Select + Add.

For the name, enter VM-delete-lock.
For the Lock type, select Delete.
You may enter a note to help remind you why you created the lock.
Select OK.

That’s it—your virtual machine is now protected against accidental deletion and includes tags for easier tracking and organization. Next, let’s move on to the networking side.

Adding tags to network resources

Head over to the Virtual Networks page and select the guided-project-vnet network to begin applying tags.

From the menu pane, select Tags.

Note: You’ll notice you can either choose from existing tags or create new ones. You can also pick a tag name or value and define the other field yourself.

Set Name to Department.
Enter IT as the value.
Click Apply.

Now both the VNet and VM are organized.

Conclusion

Effectively managing metadata and protection features in the Microsoft Azure Portal is essential for keeping cloud resources organized and secure. Tags—structured as key-value pairs—can be applied to resources like virtual machines and networking components to enhance organization, cost management, automation, and governance. By tagging resources such as virtual networks, subnets, and network security groups, administrators can group them by environment, department, owner, or project, making it easier to filter assets, track costs, and apply policies consistently.

Alongside tagging, resource locks add an extra layer of security for critical resources. These locks help prevent accidental deletion or unwanted changes by enforcing either Delete or Read-only restrictions. When used together, tags improve visibility and resource management, while locks strengthen protection—ensuring a more structured, secure, and well-controlled Azure environment.

Update and Maintain Resources in Azure - Control Storage Access

nnamdi nmarah — Mon, 30 Mar 2026 06:02:10 +0000

In this section, we’ll work through a series of tasks focused on managing an Azure Storage Account and its key components.
Note: This builds on the project covered in my previous article.

Scenario

An Azure administrator wants to deepen your understanding of storage accounts, containers, and file shares. As the need to share files continues to grow, they’re looking for someone confident in handling these services. Your task is to create a storage container, set up a file share, and upload files to both.

Create a Storage Container

Start by navigating to the Storage Account page and selecting the storage account you created in the previous “Prepare” exercise.

On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.

In the Name field, enter storage-container.
Select Create.storage-container

Upload a file to the storage container

Select the storage container you just created.

Select Upload and upload the file you prepared.

Once the file is ready for upload, select Upload.

After uploading the file, you’ll see its assigned access tier. Since this file was only uploaded for testing purposes, there’s no need for it to remain in the Hot tier. In the following steps, you’ll update the file’s access tier to a more appropriate option.

Change the Access Tier

Select the file you just uploaded (the file name is a barplot.fig).

Select Change tier.

Select Cold.
Select Save.

Note: In this step, you updated the access tier for a specific blob or file. If you want to apply a default access tier across all blobs, you can configure this setting at the storage account level.

Create a File Share

Navigate to the Storage Accounts page and choose the storage account you created in the previous Prepare exercise. This should be named marchsa and linked to the guided-project-rg resource group.
Within the storage account panel, locate the Data storage section and select File shares.

Select + File share.

On the Basics tab, in the name field, enter file-share.

On the Backup tab, uncheck Enable backup.

Select Review + create.
Select Create.

Once the file share is created, select Upload.

Upload the same file you uploaded to the blob storage or a different file, it’s up to you.

The next step is to determine how to manage access to the uploaded files. Azure offers several methods for controlling file access, such as role-based access control (RBAC). However, in this case, the Azure administrator has requested the use of shared access tokens or keys.

Create a Shared Access Signature (SAS) Token

First, open the storage account you set up in the preparation exercise.
Then, in the storage account panel, navigate to the Storage browser and expand the Blob containers section.

Select the storage container you created earlier, storage-container.

Select the ellipses (three dots) on the end of the line for the image you uploaded.
Select Generate SAS.

Note: When generating a shared access signature (SAS), you must define a validity period. Once this time expires, the link will no longer function. The Start field is automatically filled with the current date and time.

Configure the settings as follows:

Set the signing method to Account key.
Choose Key 1 as the signing key.
Leave the stored access policy set to None.
Assign Read permissions.
Specify a custom start and expiry time, or keep the default values.
Restrict allowed protocols to HTTPS only.

Finally, select Generate SAS token and URL.

Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.

Once the SAS token is generated, anyone who has the link can access the file for the duration you specified. But managing access isn’t just about granting permissions—it’s also about being able to take them away when needed.

To revoke access granted through a SAS token, you must invalidate it. This is done by rotating the key that was used to create the token.

Rotating access keys:

Go to the Storage accounts page and open the storage account you created earlier.
Navigate to the Security + networking section.
Select Access keys.

For Key 1, select Rotate key.
Read and then acknowledge the warning about regenerating the access key by selecting Yes.

After the access key rotation is successful, return to the tab or window where you tested the SAS token and refresh the page. You should now see an authentication failed error, confirming that access has been revoked.

Conclusion

The Control Storage Access exercise highlighted key administrative tasks involved in managing and securing storage resources in Microsoft Azure. It included creating a storage container to organize blob data and adjusting the access tier to balance cost and performance based on how the data is used.

The exercise also covered setting up a file share to support structured storage and collaboration across different systems. To provide secure, temporary access, a Shared Access Signature (SAS) token was generated—allowing delegated access without exposing primary account keys. Additionally, rotating storage access keys demonstrated an important security practice by refreshing credentials and reducing the risk of unauthorized access.

Overall, these steps emphasize the importance of effective storage management, cost efficiency, and strong security measures when working with Azure storage services.

Update and Maintain Resources in Azure - Manage Virtual Machines

nnamdi nmarah — Tue, 24 Mar 2026 21:30:57 +0000

Scenario

Now that the network has been configured to support segmentation, the next step is to manage the virtual machine. The Azure Administrator has requested that the existing Linux virtual machine be moved to the newly created subnet from the previous exercise.

Note: This is a continuation of the project from the previous article.

Move the Virtual Machine to the New Subnet

From the Virtual Machines page in the Azure Portal, locate and select the guided-project-vm virtual machine to begin updating its network configuration.

If the virtual machine is currently running, select Stop. Some configuration changes—such as modifying the subnet—require the VM to be restarted. While you can submit the change without stopping it manually, Azure will automatically restart the VM before applying the update.
Wait until the Status field changes to Stopped (deallocated) before proceeding.

Within the Networking subsection of the menu, select Network settings.

Select the Network interface / IP configuration hyperlink for the VM.

On the IP Configurations page, update the Subnet to ftpSubnet.

Select Apply.

The virtual machine has been moved from one subnet to another, with the new subnet configured with specific network security rules to support its role as an FTP server. The next task from the Azure administrator is to adjust the VM’s computing capacity by vertically scaling it to enhance its performance.

Vertically scale the virtual machine

From the Virtual Machine page, select the guided-project-vm virtual machine.

Locate the Availability + scale submenu and select Size.
Select a new VM size L2aos_v4, for example. (Note: If you don’t see the same size as shown in this exercise, select something similar.)
Select Resize

Now that the VM has been upgraded to a more powerful processor, it is capable of supporting its new role. However, the Azure administrator has identified that, to function effectively as an FTP server, the VM requires additional storage. To address this, a new data disk must be attached to the virtual machine.

Attach data disks to a virtual machine

From the Virtual Machine page, select the guided-project-vm virtual machine.

Locate the settings submenu and select Disks.

Select Create and attach a new disk.

Leave LUN as default.
Enter ftp-data-disk for the Disk name.
Leave the Storage type as default.
Enter 20 for the Size.
Select Apply to create the new storage disk and attach the disk to the machine.

The VM now has sufficient storage to support file uploads. The final concern for the Azure administrator is the cost of keeping the machine running շուրջ the clock. They plan to start the FTP server manually each morning, but want to set it up to automatically shut down every day at 7:00 PM Coordinated Universal Time (UTC).

Configure automatic shutdown on a virtual machine

From the Virtual Machines page, select the guided-project-vm virtual machine.
Under the Operations submenu, select Auto-shutdown.

In order to let late uploads finish, set the scheduled shutdown to 7:15:00 PM.
Select Save.

The Azure admin has completed all of the management tasks needed for the virtual machine.

Summary

In this project, we effectively managed virtual machines (VMs) by completing key operational tasks. We showed how to move a VM to a designated subnet to improve network segmentation and security. We then applied vertical scaling to align the VM’s resources with workload requirements, enhancing overall performance. In addition, we expanded storage capacity by attaching a data disk to support applications and data needs. Lastly, we configured an auto-shutdown schedule to reduce costs by ensuring the VM is turned off during non-working hours. Together, these actions demonstrate best practices in VM lifecycle management, balancing performance, scalability, and cost efficiency.

Update and Maintain Resources in Azure - Update the virtual network

nnamdi nmarah — Mon, 23 Mar 2026 04:37:28 +0000

In this scenario, you’re assisting an Azure Administrator with managing cloud resources. While you’re not handling the entire infrastructure, you’ll support by carrying out specific assigned tasks.

At the moment, there is an underutilized Linux virtual machine, and there’s a requirement to deploy another Linux VM that will function as an FTP server. To properly monitor network traffic and resource usage for this new server, the administrator has decided that a separate subnet should be created. The existing subnet will remain unchanged, as it is reserved for future virtual machine deployments.

This article builds on the previous one, and all previously created resources will be reused in this setup.

Create a New Subnet in an Existing Virtual Network

From the Azure Portal homepage, search for and select Virtual networks under Services to begin creating a new subnet within your existing VNet.

From the Azure portal home page, search for and select virtual networks under services.

-Select the guided-project-vnet virtual network.

From the guided-project-vnet blade, under settings, select Subnets.

To add a subnet, select + Subnet.

For Subnet purpose, leave it as Default.
For Name, enter: ftpSubnet.

Leave the rest of the settings unchanged and select Add.

Create a network security group

From the virtual network blade, select network security group

Select + Create.

Select the guided-project-rg resource group.

Enter ftpNSG for the network security group name.

Select Review + Create

Select Create.

Wait for the screen to refresh and display Your deployment is complete, then select Go to resource.

Create an inbound security rule

Under settings, select Inbound security rules.

Select + Add.

Change the Destination port range from 8080 to 22.

Select TCP for the protocol.

Set the name to ftpInbound.

Select Add.

Select Home to return to the Azure portal home page.

Associate a network security group to a subnet

From the Virtual network page, select the guided-project-vnet virtual network.

Under settings, select Subnets.

Select the ftpSubnet you created.

On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.
Save.

Conclusion

Creating a subnet within an existing Azure Virtual Network (VNet) allows administrators to divide the network into smaller, well-organized segments. Each subnet represents a defined IP address range, making it easier to manage resource placement and control network traffic. Once created, the subnet serves as a dedicated space where resources like virtual machines can be deployed and communicate securely within the broader network.

After setting up the subnet, a Network Security Group (NSG) can be linked to it to enforce security rules. Acting as a virtual firewall, an NSG regulates both inbound and outbound traffic based on parameters such as IP addresses, ports, and protocols. When associated with a subnet, these rules are automatically applied to all resources within it, ensuring consistent protection, restricting unauthorized access, and maintaining controlled communication across the environment.

Update and Maintain Resources in Azure - Prepare

nnamdi nmarah — Mon, 23 Mar 2026 03:16:07 +0000

Updating and Maintaining Azure Resources

Keeping your resources up to date in Microsoft Azure is a core part of managing a reliable and secure cloud environment. Regular maintenance ensures that your services remain protected, performant, and aligned with best practices.

Azure offers multiple tools to handle this efficiently, including the Azure Portal, Azure CLI, and automation services. These tools allow engineers and administrators to monitor, update, and manage cloud resources with ease.

Routine maintenance tasks typically involve applying security patches, updating operating systems on virtual machines, adjusting storage and networking configurations, and tracking resource health and performance. Staying on top of these tasks helps reduce vulnerabilities, improve stability, and keep applications running smoothly.

Consistent upkeep of Azure resources also helps organizations minimize risks, control costs, and maintain a scalable, high-performing infrastructure. Taking a proactive approach is key to building a resilient and well-optimized cloud environment.

Project Overview

This project will be divided into multiple sections. In this article, I’ll focus on preparing the foundational resources required for the setup. In upcoming articles, I will cover:

Updating a virtual network and subnet

Managing virtual machines

Controlling storage access

Working with resource tags and locks

Create a Resource Group

To begin, open the Azure Portal, search for Resource groups under Services, and select it to create a new resource group for your project

Select Create.

Select Review + create.

Create a virtual network with one subnet

Search for and select virtual networks under services.

Select Create.

Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.

Select Review + create.

Wait for the screen to refresh and show Your deployment is complete.

Create a virtual machine

Search for and select virtual machines under services.

Select Create and then select Virtual machine

Select guided-project-rg for the Resource group.

Enter guided-project-vm for the Virtual machine name.

For the Image, select one of the Ubuntu Server options. (For example, Ubuntu Server 24.04 LTS - x64 Gen2)

Continue further on the Basics page to the Administrator account section.
Select Password for authentication type.

Enter guided-project-admin for the admin Username.

Enter a password for the admin account.
Confirm the password for the admin account.

Leave the rest of the settings as the default settings. You can review the settings if you like, but you shouldn’t change any.
Select Review + create.

Select Create to confirm the resource cost and create the virtual machine.Then it would deploy

Deployment complete now. Select Home to return to the Azure portal home page.

Create a Storage account

Search for and select Storage accounts under services.

Select Create.

Scroll down to the Instance details section and enter a name for the storage account. Storage accounts must be globally unique.
Select Review + create.

Wait for the screen to refresh and show that your deployment is complete.

Conclusion

Regularly updating and maintaining resources through the Azure Portal is essential for keeping cloud services stable, secure, and performing at their best. The portal offers a centralized, user-friendly interface that enables administrators to monitor resource health, apply updates, adjust configurations, and manage services in real time.

By consistently carrying out these maintenance tasks, organizations can enhance efficiency, minimize potential issues, and ensure their cloud environment remains dependable and aligned with industry best practices.

Build a Complete Azure Environment using only the Azure CLI — no Portal

nnamdi nmarah — Mon, 23 Mar 2026 02:09:54 +0000

Azure CLI

Azure CLI is a cross-platform command-line tool built by Microsoft that enables users to create, manage, and automate resources in Azure directly from the terminal.

Instead of relying on the Azure web portal, developers, cloud engineers, and system administrators can interact with Azure services using structured az commands. This makes it ideal for scripting, automation, and efficient infrastructure management across services like virtual machines, storage, networking, and resource groups.

Project Overview

In this project, I will:

Create a Resource Group

Set up a Virtual Network (VNet) and Subnet

Provision a Linux Virtual Machine

Create a Storage Account and upload files

Store secrets in Azure Key Vault

Monitor costs and configure a budget alert

Creating a Resource Group

A Resource Group acts as a logical container for organizing related Azure resources.

Services such as virtual machines, storage accounts, databases, and networks are grouped together so they can be deployed, managed, and deleted as a single unit. This helps simplify resource management and keeps your infrastructure organized.

Step 1: Define a Resource Group Variable

A variable is a named value that you can reuse throughout your commands or scripts.

Rather than typing the same value repeatedly (like a resource name or configuration), you assign it to a variable once and reference it whenever needed. This improves readability, reduces errors, and makes your workflow more efficient.

Create the Resource Group

This step creates a resource group named mylab-rg in the East US region. All resources used in this lab will be deployed into this group, making them easier to manage and remove when no longer needed.

verify it was created in the Azure Portal

Build a Virtual Network (VNet) & Subnet

1. Create a VNet

A Virtual Network (VNet) is a private, isolated network within Azure that allows cloud resources to communicate securely.

It handles IP address allocation, provides network isolation, and ensures secure connectivity between services like virtual machines and databases running in your Azure environment.

Create a Virtual Network with a broad 10.0.0.0/16 IP address space.

2. Create a Subnet

A subnet is a smaller division of a virtual network’s IP address range.

It helps organize resources, improve security, and control traffic flow between services by creating isolated sections within the larger network.

In this step, you’ll create a subnet using the 10.0.1.0/24 range, which is a smaller portion of your VNet, dedicated specifically for hosting your virtual machines.

3. Create a Network Security Group (NSG)

A Network Security Group (NSG) is a collection of security rules in Azure that manage the flow of inbound and outbound traffic to your virtual network resources.

It acts like a virtual firewall, allowing or blocking traffic based on IP address, port, or protocol, helping secure and isolate your resources.

In this step, you’ll create an NSG that can later be associated with your subnet or virtual machines.

4. Open Port 22 (SSH) & 80 (HTTP)

Port 22 (SSH) is used for secure, encrypted remote access to your Linux VM. Opening this port allows administrators to log in and manage the server safely.

Port 80 (HTTP) is the standard port for web traffic. Opening this port lets your server respond to unencrypted web requests from browsers or clients.

In this step, we will add inbound rules to your NSG, giving priority to SSH access, followed by HTTP, so your VM can be accessed and serve web pages.

Allow SSH (Port 22)

Allow HTTP (Port80)

5. Attach NSG to Subnet

Associating a Network Security Group (NSG) with a subnet ensures that all virtual machines within that subnet automatically follow the NSG’s rules.

This provides consistent network-level protection for every resource in the subnet, so you don’t have to apply rules individually to each VM.

Confirm resources are created from Azure Portal

Provision a Linux Virtual Machine

A Virtual Machine (VM) is a software-based computer that runs an operating system and applications just like a physical machine. Instead of using physical hardware, it operates on virtualized resources provided by a cloud platform.

In Microsoft Azure, VMs give you on-demand access to CPU, memory, storage, and networking. This allows you to deploy and manage servers quickly without owning physical hardware.

In this step, we’ll create an Ubuntu VM with a public IP address inside your VNet so it can be accessed from the internet.

1. Allocate a Public IP

A public IP allows your VM to be reachable from outside the VNet (e.g., your browser or SSH client). Without it, the VM can only be accessed internally or via a VPN.

2. Create the Virtual Machine

We will create a B1s Ubuntu VM using auto-generated SSH keys. This VM will be connected to your existing subnet and protected by the Network Security Group (NSG).

This VM is your actual cloud compute instance, where your web application and services will run.

3. Retrieve the public IP

Fetch the VM’s public IP address from Azure so you can use it to SSH into the machine or access any hosted web services.

4. Verify the VM is running

Check that the VM is active by querying its status and displaying it neatly in a table; this ensures the VM is running before you try to connect.

5. SSH Into your VM and Install Nginx

Connect to your VM using SSH, install the Nginx web server via APT, and start its service. A new VM is typically empty, so Nginx allows you to verify that HTTP traffic on port 80 is accessible.

Create a Resource Group in Azure using Visual Studio Code

nnamdi nmarah — Mon, 16 Mar 2026 07:34:49 +0000

In this project, I will go through the following steps to create a resource group in Microsoft Azure using Visual Studio Code:

Install the Azure CLI
Sign in to the Azure portal
Create a resource group in the Azure portal

Install Azure CLI and Sign In

The goal of this step is to set up the Azure CLI on your computer and log in to your Azure subscription.

Step 1: Install on Windows (using Winget)**

This step installs the Azure CLI through Windows’ package manager, Winget.

The Azure Command-Line Interface (CLI) is a cross-platform tool that lets you manage Azure resources directly from your local machine. On Windows, it can be installed using an MSI or ZIP package, allowing access via PowerShell or the Command Prompt (cmd.exe).

To install the Azure CLI, open the Visual Studio Code terminal and run the following command:

winget install Microsoft.AzureCLI

NOTE: After the installation is complete, you must close and reopen any active terminal window to use the Azure CLI.

Step 2: Verify the installation.

To verify the installation, run the Azure CLI command az --version command

This gives details of the Azure version in use.

Step 3: Sign In and Select Subscription

Execute the command az login in the terminal. This will open a web browser for interactive authentication and automatically configure your active Azure subscription.

Be aware that the browser window may open behind other windows or on the side of your screen, so if you don’t see it immediately, try minimizing or rearranging your open windows.

Step 4: Then Sign in and select Next.

Because I was already signed in, it came up

This step is necessary because Azure needs to identify who is executing the commands and determine which subscription (billing account) will be used.

It also ensures security by verifying that only authenticated and authorized users can access and manage cloud resources.

Step 5: To confirm my active subscription, I entered 1, because it is the only active subscription I have. If you have more than one subscription, enter the number that corresponds to your subscription.

Test the command: az account show to view account details.

Step 6: To make a subscription your active one, use the following command:

az account set --subscription "Your Subscription ID"

While you can specify the subscription by name, this may cause an error if multiple subscriptions share the same name in your Azure environment. Using the subscription ID is more reliable, as it is always unique.

Step 7: To confirm your active subscription run this command: az account show

Notice that the isDefault field for the subscription is now set to true. This means that this subscription is saved as your default, so you won’t need to log in again each time you restart Visual Studio Code.

Create a Resource Group

In this section, the goal is to create a resource group, which will serve as the logical container for all resources in this lab environment.

Step 1: Define variables for the resource group
It’s a good practice to store the resource group name and region in variables. This reduces the risk of typos and makes your script easier to reuse.
RG="azurecli-labnamz-rg"
This creates a shell variable RG holding the resource group name, which can be referenced later as $RG
LOCATION="eastus"

Create a Resource Group

In this section, the goal is to create a resource group, which will serve as the logical container for all resources in this lab environment.

Step 1: Define variables for the resource group**

It’s a good practice to store the resource group name and region in variables. This reduces the risk of typos and makes your script easier to reuse.
RG="azurecli-labnamz-rg"

This creates a shell variable RG holding the resource group name, which can be referenced later as $RG.
LOCATION="eastus"

This creates a shell variable LOCATION with the region, which can be referenced later as $LOCATION.

Step 2: Create the Resource Group

Now, create a resource group in the East US region. All resources for this lab will be placed here, which makes it easier to manage and clean up later.

Creating a resource group is required because every Azure resource must belong to one. Resource groups help you organize, monitor, and delete all related resources together.

It’s also a best practice for operational excellence, as grouping related resources improves manageability and makes cost tracking simpler.

Run the following command: az group create --name $RG --location $LOCATION
This will create a resource group named $RG, which acts as a logical container for all Azure resources in this lab.

Provide storage for a new company app

nnamdi nmarah — Mon, 02 Mar 2026 09:23:03 +0000

Azure Storage, Identity & Encryption Project

As part of my journey to strengthen my cloud engineering and security skills, I decided to build a hands-on project focused on secure storage and identity management in Microsoft Azure.

Rather than just learning theory, this project walks through real-world cloud configuration tasks that demonstrate how to design secure, production-ready storage solutions using identity-based access control and encryption best practices.

In this step-by-step guide, I will implement and document the following:

Create a secure Storage Account
Configure a User-Assigned Managed Identity
Configure a System-Assigned Managed Identity
Set up a Key Vault with a customer-managed key
Configure a Blob Container with Immutable Storage
Configure a custom Encryption Scope

This project focuses on core cloud security principles including:

Identity-based access control

Encryption at rest with customer-managed keys

Data immutability for compliance

Separation of responsibilities

Secure resource configuration

By the end of this walkthrough, I will have built a secure storage architecture that reflects real enterprise cloud scenarios — and documented the entire process as part of my growing cloud portfolio.

If you're learning Azure, preparing for cloud certifications, or building your own portfolio, this guide will help you understand not just how to configure these services

Create the storage account and managed identity

Provide a storage account for the web app.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab.

Check the box for Enable infrastructure encryption.

Notice the warning, This option cannot be changed after this storage account is created.

Select Review + Create.

Wait for the resource to deploy.

Provide a managed identity for the web app to use. Learn more about managed identities.

Search for and select Managed identities.

Select Create.

Select your resource group.

Give your managed identity a name.

Select Review and create, and then Create.

Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs. Learn more about how to assign Azure roles.

Search for and select your storage account.

Select the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

-Select the managed identity you created in the previous step.

Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. Learn more about how to provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.

Select Select members.

Search for and select your user account. Your user account is shown in the top right of the portal.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

You are now ready to continue with the lab.

Create a key vault to store the access keys.

Azure Key Vault is a secure cloud service provided by Microsoft Azure that allows you to safely store and manage sensitive data. This includes:

Secrets such as passwords, connection strings, and API keys
Cryptographic keys like RSA and ECC keys used for encryption and digital signing
Certificates, including SSL/TLS certificates

Azure Key Vault helps safeguard your application’s confidential information and cryptographic assets by keeping them protected in a secure, centralized location

In the portal, search for and select Key vaults.

Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

-Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.

Select Generate/Import and Name the key.

-Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity. Learn more about how to use a system-assigned managed identity to authorize access

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select your managed identity.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault. Learn more about customer managed keys on an existing storage account.

Return to your the storage account.

In the Security + networking section, select the Encryption blade.

Select Customer-managed keys.

Select a key vault and key. Select your key vault and key.

Select to confirm your choices.

Ensure the Identity type is User-assigned.

Select an identity.

Select your managed identity then select Add.

Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.

The developers require a storage container where files can’t be modified, even by the administrator. Learn more about blob immutable storage.

Navigate to your storage account.

In the Data storage section, select the Containers blade. Create a container called hold. Take the defaults. Be sure to Create the container.

Create a container called hold. Take the defaults. Be sure to Create the container

Upload a file to the container.

In the Settings section, select the Access policy blade.

In the Immutable blob storage section, select + Add policy.

For the Policy type, select time-based retention.

Set the Retention period to 5 days.

Be sure to Save your changes.

Try to delete the file in the container.

Verify you are notified failed to delete blobs due to policy

The developers require an encryption scope that enables infrastructure encryption. Learn more about infrastructure encryption.

Navigate back to your storage account.

In the Security + networking blade, select Encryption.

In the Encryption scopes tab, select Add.

Give your encryption scope a name.

The Encryption type is Microsoft-managed key.

Set Infrastructure encryption to Enable.

Create the encryption scope.

Return to your storage account and create a new container.

Notice on the New container page, there is the Name and Public access level.

Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Conclusion

A secure storage architecture in Microsoft Azure is built by integrating Storage Account, Managed Identity, Key Vault, and Encryption Scope into a unified security framework.

The Storage Account provides scalable, highly durable data storage. Managed Identity enables secure, passwordless authentication through Azure AD, removing the need to embed credentials within applications. Key Vault safeguards and manages cryptographic keys and secrets in a centralized location, enforcing strict access controls and comprehensive auditing. Encryption Scope adds fine-grained encryption management by allowing specific containers or blobs to be protected with designated customer-managed keys (CMKs).

Collectively, these services implement the principle of least privilege, strengthen cryptographic control, and isolate encryption boundaries—creating a robust, compliant, enterprise-level storage security solution.

Provide shared file storage for the company offices

nnamdi nmarah — Tue, 24 Feb 2026 18:53:01 +0000

### Provide Shared File Storage for Company Offices (Using Microsoft Azure)

As organizations expand across multiple offices and remote teams, maintaining a centralized and secure file storage system becomes essential. When files are stored locally or shared manually, it often leads to version conflicts, limited accessibility, and security risks. Cloud computing solves this problem by providing scalable, secure, and highly available shared storage accessible from anywhere.

In this guide, we’ll explore how to implement shared file storage using Microsoft Azure—a powerful cloud platform that enables businesses to build secure and scalable infrastructure.

Using services like:

Azure Files for fully managed SMB file shares in the cloud
Azure Blob Storage for scalable object storage
Azure Virtual Network for secure network connectivity
Azure Active Directory for identity and access control

You can create a centralized file storage solution that connects multiple company offices securely and efficiently.

By the end of this post, you’ll understand the architecture, setup process, and best practices for deploying shared storage on Azure—while strengthening your cloud computing skills along the way.

Create and configure a storage account for Azure Files

Create a storage account for the finance department’s shared files. Learn more about storage accounts for Azure Files deployments.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements.

Set the Performance to Premium.

Set the Premium account type to File shares.

Set the Redundancy to Zone-redundant storage.

Select Review and then Create the storage account.

Wait for the resource to deploy.

Select Go to resource.

Create and configure a file share with directory.

Create a file share for the corporate office. Learn more about Azure File tiers.

In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.

Review the other options, but take the defaults.

Select Create

Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.

Name the new directory finance.

Select Browse and then select the finance directory.

Notice you can Add directory to further organize your file share.
Upload a file of your choosing.

Configure and test snapshots.

Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots. Learn more about file snapshots.

Select your file share.

In the Operations section, select the Snapshots blade.

Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

Practice using snapshots to restore a file.

Return to your file share.

Browse to your file directory.

Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore,

Select the file and the select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

Search for and select Virtual networks.

Select Create. Select your resource group. and give the virtual network a name.

Take the defaults for other parameters, select Review + create, and then Create.

Wait for the resource to deploy.

Select Go to resource.

In the Settings section, select the Subnets blade.

Select the default subnet.

In the Service endpoints section choose Microsoft.Storage in the Services drop-down.

Do not make any other changes.
Be sure to Save your changes.

The storage account should only be accessed from the virtual network you just created. Learn more about using private storage endpoints..

Return to your files storage account.

In the Security + networking section, select the Networking blade.

Change the Public network access to Enabled from selected virtual networks and IP addresses.

In the Virtual networks section, select Add existing virtual network.

Select your virtual network and subnet, select Add.

Be sure to Save your changes.
Select the Storage browser and navigate to your file share.
Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

conclusion

In conclusion, implementing shared file storage across company offices is a crucial step toward improving collaboration, consistency, and operational efficiency. By following the setup process outlined in this guide, you can create a centralized, secure, and scalable storage solution that ensures teams in every location have reliable access to the files they need. This not only reduces duplication and version conflicts but also strengthens data governance and business continuity. With the right configuration and maintenance practices in place, your organization can support seamless cross-office workflows and set a strong foundation for future growth.

Setting Up and Connecting to an Amazon EC2 Instance

nnamdi nmarah — Sun, 22 Feb 2026 20:05:47 +0000

Amazon Elastic Compute Cloud (EC2)

Amazon EC2 is a fundamental Infrastructure-as-a-Service (IaaS) solution provided by Amazon Web Services. It delivers scalable, on-demand virtual servers in the cloud, allowing users to run applications without the need to buy or manage physical hardware. These virtual servers, known as instances, can be quickly launched, resized, or terminated, making EC2 well-suited for workloads with changing performance or capacity requirements.

EC2 supports various operating systems, including Linux and Windows. It seamlessly integrates with AWS services such as networking through VPC, storage solutions like EBS and S3, security services including IAM and Security Groups, as well as automation tools. The service operates on a pay-as-you-use pricing model, ensuring cost efficiency based on actual usage.

Create and deploy an EC2 instance

In the AWS portal, search for and select EC2

On the EC2 dashboard, select launch instance

Give your EC2 instance a name

Choose an operating system or machine image for your instance

-Create a key pair

Leave other settings at default, then select launch

Verify that your instance has launched successfully, then click Connect to instance.

On the Connect to instance page, keep the default connection settings and click Connect.

I am now successfully connected to the server.

First, I enter the sudo su command. This command switches to the root user by default, providing full administrative privileges on the instance.

Notice the Ubuntu@ip changed to root@ip after the sudo su command

Next, type the apt update command. This is an essential operation on Ubuntu-based EC2 instances that refreshes the local package index. It connects to the repositories listed in /etc/apt/sources.list and any files within /etc/apt/sources.list.d/, downloading the latest information about available packages, versions, and dependencies. Updating this metadata ensures that future package management commands such as apt upgrade or apt install can correctly access and install the most recent software versions.

Conclusion

Deploying an Ubuntu EC2 instance on AWS offers a powerful and flexible cloud computing solution that eliminates the need to manage physical infrastructure. The process is simple, from choosing an Ubuntu AMI to configuring security settings and launching the instance. This approach provides scalable computing resources with a pay-as-you-go model, making it suitable for both development and production environments.

By following the outlined steps, you can quickly set up a secure Linux-based server that takes advantage of the broader AWS ecosystem. With appropriate security configurations and system hardening, your Ubuntu EC2 instance can serve as a reliable foundation for various cloud-native applications.

Virtual Machines

nnamdi nmarah — Sat, 21 Feb 2026 10:17:23 +0000

What is a virtual Machine?

A virtual machine is a software-based emulation of a physical computer. It behaves like a real machine, complete with its own CPU, memory, storage, and operating system — but instead of running on physical hardware directly, it runs on top of a virtualization layer called a hypervisor.

With virtualization platforms like VMware Workstation, VirtualBox, or enterprise solutions such as Microsoft Hyper-V, you can create multiple isolated virtual computers on a single physical machine. Each VM can run a different operating system — Windows, Linux, macOS (with limitations), or others — completely independent from your main system.

Step 1: In the Azure portal, search for and select Virtual Machines

Step 2: Select + Create.

Step 3: Select Virtual Machine.

Step 4: Create a new Resource Group and give it a name. This helps to keep your work organized. Then select OK

Step 5: Select Availability zone. Notice you can select more than one zone, but this increases your bill

Step6 Give your virtual machine a name, it must be globally unique. Select a region.

Step 7: Select an image. It's a template that contains everything needed to start a server instantly. We'll choose a windows version because we want to install a windows virtual machine

Step 8: Give your virtual machine a username. Just a your physical computer has a name, the virtual machine also has. Notice the characteristics a username must possess.

Step 9: Provide a password and confirm it.

Step 10: On the inbound port rules section, select Allow selected ports. Notice the caution. We'll select it because we need to test the virtual machine.

If we select None, notice all internet will be blocked.

Configure inbound ports to RDP for windows operating system. HTTP (80) is the port that helps you communicate with the internet.

Step 11: On the Monitoring tab, disable boot diagnostics. Boot Diagnostics takes actual screenshots of the VM's console, it could theoretically capture sensitive information, so it's best practice to disable it.

Step 12: On the Tags tab, enter a name/value pair to help categorize your resources. Enter as many as you need, maximum is 14.

Step 13: Select Review + create to validate the virtual machine.

Step 14: Now that it has passed validation, select Create to deploy the virtual machine. Notice the price.

Step 15: Wait for the virtual machine to deploy, then select Go to resources.

Configure simple settings in the virtual machine and then connect it

Step 1: Under the settings section, select configuration and adjust the idle timeout to 30 minutes by sliding.

Step 2: Click "Connect" in the Azure VM blade.

Step 3: Select download RDP file

Step 4 Open RDP file and then enter your credentials to login

Now we are connected to the virtual machine

Provide private storage for internal company documents

nnamdi nmarah — Wed, 18 Feb 2026 19:59:25 +0000

What is a Private Storage?

Private storage is a storage system designed to keep data restricted to authorized users only. It is not publicly accessible over the internet, requires authentication and access controls, and is used to securely store internal or sensitive information, such as company documents, records, or proprietary data.

Create a storage account and configure high availability

Create a storage account for the internal private company documents.

In the portal, search for and select Storage accounts

Select + Create

Select the Resource group created in the previous lab

Set the Storage account name to private. Add an identifier to the name to ensure the name is unique

Select Review, and then Create the storage account

Wait for the storage account to deploy, and then select Go to resource

This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Geo-redundant storage (GRS) is selected

Refresh the page

Review the primary and secondary location information

Save your changes

Create a storage container, upload a file, and restrict access to the file

Create a private storage container for the corporate data

In the storage account, in the Data storage section, select the Containers blade

Select + Container

Ensure the Name of the container is private

Ensure the Public access level is Private (no anonymous access)

As you have time, review the Advanced settings, but take the defaults
Select Create.

For testing, upload a file to the private container. he type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.

Select the container

Select Upload

Browse to files and select a file

Upload the file

Select the uploaded file

On the Overview tab, copy the URL

Paste the URL into a new browser tab.

Verify the file doesn’t display and you receive an error

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS). Learn more about Shared Access Signatures

Select your uploaded blob file and move to the Generate SAS tab

In the Permissions drop-down, ensure the partner has only Read permissions.

Verify the Start and expiry date/time is for the next 24 hours

Select Generate SAS token and URL

Copy the Blob SAS URL to a new browser tab

Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier. Learn more how manage the Azure Blob storage lifecycle.

Return to the storage account.

In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade

Select Add rule.

Set the Rule name to movetocool.

Set the Rule scope to Apply rule to all blobs in the storage account.

Select Next.

Ensure Last modified is selected.

Set More than (days ago) to 30.

In the Then drop-down select Move to cool storage.

As you have time, review other lifecycle options in the drop-down.

Add the rule

The public website files need to be backed up to another storage account.[Learn more about object replication.

In your storage account, create a new container called backup. Use the default values. Refer back to Lab 02a if you need detailed instructions.

Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.

In the Data management section, select the Object replication blade.

Select Create replication rules.

Set the Destination storage account to the private storage account.

Set the Source container to public and the Destination container to backup.

Create the replication rule.