DEV Community: Werneline Nashilongo

Providing private storage for internal company documents using Azure cloud

Werneline Nashilongo — Sun, 24 May 2026 15:10:02 +0000

In this article, we will be providing private storage to different departments of an online content hosting company. The content is private to the company and shouldn’t be shared without consent. The storage will also be used as a backup to the public website. Thus, the storage requires high availability in case of a disaster occurrence.

Create a storage account and configure high availability.

1. Create a storage account for the internal private company documents.

In the portal, search for and select Storage accounts.
Select + Create.

Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.
Select Review, and then Create the storage account.
Wait for the storage account to deploy, and then select Go to resource.

2. This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Geo-redundant storage (GRS) is selected.
Refresh the page.
Review the primary and secondary location information.
Save your changes.

GRS replicates data to a secondary region without read access.

Create a storage container, upload a file, and restrict access to the file.

1. Create a private storage container for the corporate data.

In the storage account, in the Data storage section, select the Containers blade.
Select + Container.
Ensure the Name of the container is private.
Ensure the Public access level is Private (no anonymous access).
As you have time, review the Advanced settings, but take the defaults.
Select Create.

2. Upload a file to the private container to test that the file isn’t publicly accessible.

Select the container.
Select Upload.
Browse to files and select a file.
Upload the file.
Select the uploaded file.

On the Overview tab, copy the URL.
Paste the URL into a new browser tab.

Verify the file doesn’t display, and you receive an error.

The error message displays that "Public access is not permitted on this storage account." This means that the storage is only accessible to employees' devices/ IP addresses.

3. An external partner requires read access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).

SAS (Shared Access Signature) enables secure, delegated access to storage account resources with detailed control over permissions and access duration. Thus, enhancing data security while allowing clients to interact with storage without needing full account permissions.

There are three types of SAS:
User delegation SAS - Secured with Microsoft Entra credentials.
Service SAS - Secured with the storage account key, limited to one service.
Account SAS - Secured with the storage account key, allows access across multiple services.

Select your uploaded blob file and move to the Generate SAS tab.
In the Permissions drop-down, ensure the partner has only Read permissions.
Verify the Start and expiry date/time is for the next 24 hours.
Select Generate SAS token and URL.

In the image above Allowed IP address allows you to control which external devices can have access to the company's private content.

Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

1. To save on costs, after 30 days, move blobs from the hot tier to the cool tier.

Implementing lifecycle management policies optimizes storage costs by automating the management of blob data according to its lifecycle, enhancing efficiency and reducing expenses

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade.
Select Add rule.

Set the Rule name to movetocool.
Set the Rule scope to Apply rule to all blobs in the storage account.
Select Next.

Ensure Last modified is selected.
Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.
Add the rule.

The rule is added as an IF THEN condition.

2. The public website files need to be backed up to another storage account.

In your storage account, create a new container called backup. Use the default values.

Navigate to your publicwebsite storage account. This storage account was created in the previous post, "Providing storage for a public website".

In the Data management section, select the Object replication blade.
Select Create replication rules.

Set the Destination storage account to the private storage account.
Set the Source container to public and the Destination container to backup.
Create the replication rule.

Whenever a blob is uploaded on the public storage account, it will be replicated in the private backup storage account. This is how data can be backed up in Azure Cloud.

In this walkthrough, you configured a private Azure storage solution covering geo redundancy, access restriction, SAS tokens for external partners, lifecycle cost management, and cross account replication for backup. These foundational Azure Blob Storage features work together to keep company data secure, available, and cost efficient, even at scale.

Feel free to leave a reaction, drop a comment with any questions, or share it with someone who's just getting started with Azure storage!

Providing storage for a public website using Azure cloud

Werneline Nashilongo — Mon, 18 May 2026 19:45:25 +0000

In this article, we will be providing Azure cloud storage for a company website that hosts product images, videos, marketing literature, and customer success stories. Customers are located worldwide and demand is rapidly growing. The content is mission-critical and requires low latency load times. It’s important to keep track of the document versions and to quickly restore documents if they’re deleted.

Creating a storage account with high availability

1. Create a storage account to support the public website.

In the portal, search for and select Storage accounts.

In the dropdown menu, you will also see "classic storage account." Do not use this option, as it is an outdated version.

Select + Create.

For resource group select new. Give your resource group a name and select OK.

Set the Storage account name to a unique name with a numeric identifier.
Take the defaults for other settings.
Select Review and then Create.

Wait for the storage account to deploy, and then select Go to resource.

2. This storage requires high availability in the event of a regional outage. Additionally, enable read access to the secondary region.

Redundancy in Azure Storage refers to maintaining multiple copies of data across different locations, ensuring that in the event of a disaster, your data remains accessible and is not lost.

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Read-access Geo-redundant storage is selected.
Review the primary and secondary location information.

As shown in the image above, there are different Azure Storage redundancy options:

Locally Redundant Storage (LRS): Replicates data within a single datacenter, offering lower cost and durability.

Zone-Redundant Storage (ZRS): Replicates data across multiple availability zones for higher availability.

Geo-Redundant Storage (GRS): Asynchronously replicates data to a secondary region for disaster recovery.

Geo-Zone-Redundant Storage (GZRS): Combines ZRS and geo-replication for maximum durability and availability.

3. Information on the public website should be accessible without requiring customers to login.

Blob Storage allows users to effectively store and manage large volume of unstructured data, enhancing data accessibility and analysis capabilities.

In the storage account, in the Settings section, select the Configuration blade.
Ensure the Allow blob anonymous access setting is enabled.
Be sure to save your changes.

There are three types of blobs:

Block blob, which stores text and binary data.
Append blobs are made up of blocks like block blobs, and are ideal for scenarios such as logging data from virtual machines.
Page blobs store large random access files. Page blobs store virtual hard drive (VHD) files and serve as disks for Azure virtual machines.

Create a blob storage container with anonymous read access

1. The public website has various images and documents. Create a blob storage container for the content.

In your storage account, in the Data storage section, select the Containers blade. -Select + Container.

Ensure the Name of the container is public.
Select Create.

2. Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs.

Select your public container.

On the Overview blade, select Change access level.

Ensure the Public access level is Blob (anonymous read access for blobs only).

Read Access helps users secure their data while allowing necessary access to specific content, thereby balancing usability and security.

Select OK.

Practice uploading files and testing access.

1. For testing, upload a file to the public container. The type of file doesn’t matter. A small image or text file is a good choice.

Ensure you are viewing your container.
Select Upload.
Browse to files and select a file. Browse to a file of your choice.
Select Upload.

Close the upload window, Refresh the page and ensure your file was uploaded.

2. Determine the URL for your uploaded file. Open a browser and test the URL.

Select your uploaded file.
On the Overview tab, copy the URL.
Paste the URL into a new browser tab.

If you have uploaded an image file, it will display in the browser.

Configure soft delete

1. It’s important that the website documents can be restored if they’re deleted. Configure blob soft delete for 21 days.

Soft delete protects data from accidental deletion by allowing recovery within a specified retention period. This further enhances data protection, allowing users to recover deleted containers and their contents, thus preventing data loss.

Go to the Overview blade of the storage account.
On the Properties page, locate the Blob service section.
Select the Blob soft delete setting.

Ensure the Enable soft delete for blobs is checked.
Change the Keep deleted blobs for (in days) setting to 21.
Notice you can also Enable soft delete for containers.
Save your changes.

2. If a file is accidentally deleted, you need to practice using soft delete to restore the file.

Navigate to your container where you uploaded a file.
Select the file you uploaded and then select Delete.
Select OK to confirm deleting the file.

On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.

Select your deleted file, and use the ellipses on the far right, to Undelete the file.

Configure blob versioning

1. It’s important to keep track of the different website product document versions.

Go to the Overview blade of the storage account.
In the Properties section, locate the Blob service section.
Select the Versioning setting.

Ensure the Enable versioning for blobs checkbox is checked.
Notice your options to keep all versions or delete versions after.
Save your changes.

Blob versioning allows users to maintain previous versions of blobs when modified or deleted. This helps users recover data from previous versions, enhancing data protection and management in Azure Blob storage.

In this walkthrough, we configured an Azure Blob Storage account tailored for a high traffic public website with a global audience. By enabling Read Access Geo Redundant Storage, we ensured the content remains available even during a regional outage. Setting up anonymous blob access allows customers worldwide to access images and documents without needing to log in, keeping the experience seamless.

We also put two important data protection measures in place, soft delete gives a 21-day recovery window in case files are accidentally removed, while blob versioning ensures that previous versions of documents are preserved whenever changes are made. Together, these features provide a resilient, accessible, and well-managed storage solution that meets the demands of a mission-critical public website.

Creating and Configuring an Azure Storage Account for IT Teams

Werneline Nashilongo — Tue, 28 Apr 2026 20:52:53 +0000

Whether you are stepping into cloud computing or looking to move from physical storage infrastructure, Azure Storage is one of the best places to start. Managing data on local hardware comes with constant headaches, hardware failure, maintenance costs, and limited scalability. Azure storage solves all that by providing flexible, internet based storage that you can set up in minutes.

In this guide, you'll learn how to set up an Azure Storage Account from scratch, the right way. We'll walk through creating a resource group, deploying a storage account, and configuring key security and network settings, all tailored for an IT department running employee training materials. By the end, you'll have a fully configured, secure storage environment ready to use

What is Azure Storage

In simple terms, an Azure storage account refers to space in the form of containers that is rented on the internet for the storage of data (mostly unstructured data), instead of having physical servers and storage hardware that need constant maintenance. Examples of unstructured data that can be stored on Azure Storage include PDFs, Images, audio files, etc.

Prerequisites

You will need to sign into your Azure account.
Next, you need to create and deploy a resource group.

Creating a resource group and a storage account.

Step 1: Create a resource group.

Resource Group - this is a space/container that holds related resource solutions.

In your Azure portal, search for and select Resource groups
Select + Create
Give your resource group a name, select a region. Select Review and create to validate the resource group.
Once you are satisfied, select Create to deploy the resource group.
Once the Resource Group is created, it should look like the image below.

Step 2: Create and deploy a storage account.

In the Azure portal, search for and select Storage accounts. When selecting Storage account, you will encounter a classic storage account, this is an old version/build.
Select + Create.
On the Basics tab, select your Resource group,
and provide a Storage account name. The storage account name must be unique in Azure. Set the Performance to Standard, there is a Premium option that requires more cost because it provides low latency. Select Review, and then Create.

Wait for the storage account to deploy and then go to resource.

Configure simple settings in the storage account.

Step 1: Set redundancy to locally-redundant storage (LRS)

Since this storage account holds employee training materials rather than critical business data, LRS is the most cost effective option, it keeps one copy of your data within a single datacenter without paying for geo-redundancy you don't need.

In your storage account, in the Data management section, select the Redundancy blade.
Select Locally-redundant storage (LRS) in the Redundancy drop-down. By default, it is set to Read-access geo-redundant storage.

Locally redundant storage (LRS) replicates the data within your storage accounts to a single physical datacenter in the primary region of your choice.

Save your changes.
Refresh the page and notice the content only exists in the primary location.

Step 2: Enable secure transfer.

Enabling secure transfer ensures that all communication with your storage account happens securely, protecting data from being intercepted in transit, especially important when employees are accessing training files over a corporate network.

In the Settings section, select the Configuration blade.
Ensure Secure transfer required is Enabled.

Step 3: Set the minimum TLS version to 1.2

TLS 1.2 ensures that only modern, secure connections are accepted.

TLS (Transport Layer Security) is an encryption protocol between a client application and an Azure Storage account that ensures privacy and data integrity between clients over the internet.

In the Settings section, select the Configuration blade.
Ensure the Minimal TLS version is set to Version 1.2.

Step 4: Disable storage account key access.

Disabling key access temporarily locks down the storage account so no one can read or write data while it's not in active use.

In the Settings section, select the Configuration blade.
Ensure Allow storage account key access is Disabled.
Save your changes.

Step 5: Configure public network access

Since this storage account needs to be reachable by employees across different locations and devices, enabling public network access ensures they can access the training materials over the internet.

In the Security + networking section, select the Networking blade.
Ensure Public network access is set to Enabled from all networks.
Once you click on manage, you can enable the Public network access. Be sure to save your changes.

And just like that, we've set up a fully configured Azure Storage Account. We created a resource group to organise your resources, deployed a storage account for your IT department's training materials, and locked it down with the right security settings: LRS redundancy, enforced HTTPS, TLS 1.2, and controlled network access.

Let's engage in the comments section and share more knowledge on this topic.