DEV Community: Emmanuel Banjo

How to secure Azure storage with Managed identities for a web app

Emmanuel Banjo — Sat, 13 Jun 2026 08:14:37 +0000

Introduction

Building a new app is exciting but shipping an app with poorly secured storage is a headline waiting to happen.
When developers build apps that read and write data to the cloud, the question isn't just where data lives, it's who can access it, how that access is controlled, and what happens if someone tries to tamper with critical files.
Passwords get leaked, Keys get exposed in code repositories, Shared credentials get passed around Slack until nobody knows who has access to what. These aren't hypothetical risks, they're the most common causes of data breaches in cloud applications.
This guide shows you (developers) how to do it the right way with no passwords embedded in code, no shared keys floating around, no way for even an admin to delete protected data. Just clean, auditable, role-based access backed by industry-standard encryption.
Azure Blob Storage paired with Managed Identities, Key Vault, and RBAC gives your app exactly that and it's less complicated than it sounds.

What Are We Actually Building?

A secure storage setup where:

Your app accesses storage using an identity, not a password
Encryption keys are stored in a dedicated vault, not in your app's config
Access is controlled by roles, not by sharing credentials
Test files are immutable i.e nobody can modify or delete them, not even admins
Infrastructure is double-encrypted from the moment the account is created

Let's define some terms

Managed Identity: An automatically managed account in Azure that your app uses to prove who it is without needing a username or password stored in your code.
RBAC (Role-Based Access Control): A permission system where you assign roles (like "Reader" or "Contributor") instead of handing out keys. The right people get the right access, nothing more.
Key Vault: A dedicated Azure service for storing secrets, keys, and certificates. Instead of your app holding its own encryption keys, Key Vault holds them and only hands them out to authorised identities.
Customer-Managed Key (CMK): An encryption key that you control, stored in Key Vault, used to encrypt your storage. More control than the default Microsoft-managed key.
Infrastructure Encryption: A second layer of encryption applied at the hardware level. Your data is encrypted twice; once at the service level, once at the infrastructure level.

Step 1: Create an Encrypted Storage Account

This account has infrastructure encryption enabled i.e a second layer of encryption that cannot be turned off or changed after creation.

In Microsoft azure portal, search for Storage accounts
Click + Create
Create a new resource group (name it app-storage-rg)
Give the storage account a unique name (like appstorage2026)
Go to the Encryption tab
Check Enable infrastructure encryption Notice the warning: "This option cannot be changed after this storage account is created"
Click Review + Create
Then Create
Wait for deployment and click Go to resource

Step 2: Create a Managed Identity

Instead of your app using a key or password, it uses a managed identity which is an automatically managed account that Azure handles for you.

In azure portal, search for Managed identities
Click + Create
Select your resource group
Give it a clear name (like app-storage-identity)
Click Review + create
Then Create Your app now has an identity in Azure without password, no key, no expiry to manage.

Step 3: Assign Storage Access to the Identity (RBAC)

Go to your storage account
Select Access Control (IAM) from the left menu
Click Add role assignment
Search for and select Storage Blob Data Reader
Click Next
On Members, select Managed identity
Click Select members
In the dropdown, select User-assigned managed identity
Select the identity you created in Step 2
Click Select
Then Review + assign (twice to confirm) Your managed identity can now read blobs and only read blobs. It cannot delete, modify, or list account keys.

Step 4: Assign Key Vault Administrator to Your Account

Before creating a Key Vault, you need to give yourself administrator permissions on the resource group.

Go to Resource groups and select your resource group
Select Access Control (IAM)
Click Add role assignment
Search for and select Key Vault Administrator, then Next
On Members, select User, group, or service principal
Click Select members and search for your own user account
Click Select
Then Review + assign (twice) You're now authorised to create and manage keys in Key Vault.

Step 5: Create a Key Vault

Key Vault is where your encryption keys live and it is separate from your app, storage, locked down with its own access control.

Search for Key vaults
Click + Create
Select your resource group
Give it a unique name (like app-keyvault-2026)
On the Access configuration tab, ensure Azure role-based access control (recommended) is selected
Click Review + create
Then Create
After deployment, click Go to resource
On the Overview blade, confirm both Soft-delete and Purge protection are enabled Why Soft-delete and Purge protection matter: These prevent accidental or malicious deletion of keys. If a key is deleted, soft-delete holds it for 90 days. Purge protection means nobody (not even you) can permanently delete it during that window. Your encrypted data stays recoverable.

Step 6: Create a Customer-Managed Encryption Key

In your Key Vault, go to Objects → Keys
Click Generate/Import
Give your key a name (like storage-encryption-key)
Keep all other settings as default
Click Create

Step 7: Give the Identity Permission to Use the Key

Before linking the key to your storage, the managed identity needs permission to use it for encryption operations.

Go to Resource groups → your resource group → Access Control (IAM)
Click Add role assignment
Search for and select Key Vault Crypto Service Encryption User then Next
On Members, select Managed identity
Click Select members → choose User-assigned managed identity
Select your managed identity
Click Select
Then Review + assign (twice)

Step 8: Configure Storage to Use Your Key Vault Key

Go back to your storage account
Navigate to Security + networking → Encryption
Select Customer-managed keys
Click Select a key vault and key
Choose your Key Vault and the key you created
Confirm your selection
Ensure Identity type is set to User-assigned
Click Select an identity and choose your managed identity
Click Add, Then Save

Step 9: Create an Immutable Container for Testing

Developers need a container where files can't be changed or deleted not even by an admin. This is critical for testing environments where file integrity must be guaranteed.

In your storage account, go to Data storage → Containers
Click + Container
Name it hold
Keep the defaults and click Create
Upload any test file to the container
Go to Settings → Access policy
In the Immutable blob storage section, click + Add policy
Set Policy type to Time-based retention
Set the Retention period to 5 days
Click Save

Test if it works:

Try to delete the file you uploaded
You should get "Failed to delete blobs due to policy" That error is the right result. The file is protected for 5 days

Step 10: Create an Encryption Scope

The developers require an encryption scope that enables infrastructure encryption.

In your storage account, go to Security + networking → Encryption
Select the Encryption scopes tab
Click + Add
Give it a name (like secure-scope)
Keep Encryption type as Microsoft-managed key
Set Infrastructure encryption to Enable
Click Create

Apply it to a new container:

Go to Data storage → Containers
Click + Container
Give it a name (securencrypt)
In the Advanced section, select your encryption scope
Click Create Every blob in this container now gets its own dedicated encryption layer on top of the account-level encryption.

Common issues

Identity does not have the correct permissions" when saving encryption: Role assignments take 1-2 minutes to propagate across Azure. Wait, then try again.
Failed to delete blobs due to policy: This is correct behaviour. The immutable policy is working as intended. Wait for the retention period to expire, or test with a shorter period.
Managed identity not appearing in dropdown: Make sure you created a User-assigned managed identity, not a system-assigned one. They appear in different drop-downs.
Key Vault key not visible when selecting for storage encryption: Confirm you assigned the Key Vault Crypto Service Encryption User role to the managed identity, not just the administrator role.

What part of this took longest to configure in your environment? The RBAC roles, the Key Vault setup, or the immutable policy? Share in the comments. It helps other developers know where to slow down.

How I setup Azure File Shares for Secure Enterprise File Storage

Emmanuel Banjo — Sat, 13 Jun 2026 08:14:20 +0000

Introduction

Picture this: a company with offices scattered across cities, countries, even continents. London needs a file, New York has the file, Tokyo edited it and Dubai is waiting on it.
That's the reality for thousands of growing companies and it's a logistical nightmare without the right tools.
Teams need a central place to store, share, and access files instantly without any email chains, no waiting, no "which version is the right one?" This is especially critical for departments like Finance, where documents carry legal and compliance weight. Auditors don't accept "I couldn't find the file."
The answer to this is Azure File Share which is a fully managed, cloud-based file sharing solution that works across every office, every device, and every timezone. And the best part? Some content can be locked down so only people on your trusted corporate network can ever touch it.

What You're About to Build

A shared file system where:

Everyone sees the same files (no version confusion)
Deleted files can be recovered (accidents happen!)
Only trusted people can access it (security matters)
Files are backed up automatically

Definition of Terms

File Share: A cloud folder that multiple people can access at the same time.
Snapshot: A freeze-frame of your files at a specific moment. Like a save point in a video game. If something goes wrong, you reload from the snapshot.
Virtual Network: Your company's private internet. Only people connected to it can reach your files.
Service Endpoint: A connection point that lets your virtual network talk to Azure storage securely.

Step 1: Create a Premium Storage Account

This is your vault. Premium means fast and reliable.

Search for Storage accounts in Azure Portal
Click + Create
Create a new resource group (name it shared-files-team)
Name your storage account (like teamfiles2026)
Set Performance to Premium
Set Premium account type to File shares
Set Redundancy to Zone-redundant storage
Click Review
Then Create
Wait for deployment and click Go to resource

Step 2: Create Your Shared File Share

Your actual shared folder lives here.

Go to Data storage → File shares
Click + File share
Give it a name (like team-docs)
Take the defaults and click Create Boom! You have a shared folder in the cloud.

Step 3: Organize with Folders

Real life has departments and projects. Your file share should too.

Click on your file share
Click + Add directory
Name it finance (or whatever makes sense for your team)
Click OK

Step 4: Upload a Test File

Click into the finance folder
Click Upload
Choose any file from your computer
Click Upload Your first shared file is now live. Your team can see it immediately.

Step 5: Create a Snapshot

A snapshot is like taking a photo of everything right now. If disaster strikes tomorrow, you'll have this backup.

Go back to your file share
Click Snapshots
Click + Add snapshot
Add a comment if you want (optional: like "Before Q4 cleanup")
Click OK You just created an insurance policy for your files!

Step 6: Test Restoring a Deleted File

Let's practice losing something so you're not panicked when it actually happens.
Delete the file

Go back to your file share
Navigate to the finance folder
Find your uploaded file
Click Delete and confirm

Restore the file

Click Snapshots
Select your snapshot
Navigate to the finance folder
Find your file and click Restore
Give it a new name
Click OK Your file reappears from thin air. You're a hero. 🎉

Step 7: Create a Virtual Network

Create the network

Search for Virtual networks
Click + Create
Select your resource group
Name it team-network
Click Review + create
Then Create
Wait and click Go to resource Connect storage to this network
Go to Settings → Subnets
Click the default subnet
Find Service endpoints
In Services dropdown, select Microsoft.Storage
Click Save You just created a private connection between your network and storage.

Step 8: Lock Down the Storage

Go back to your file storage account
Click Security + networking → Networking
Under Public network, Click Manage
Change Public network access to Enabled from selected virtual networks and IP addresses
Click Add existing virtual network
Select your team-network and the default subnet
Click Add
Click Save

Step 9: Test the Lock (Verify It Actually Works)

Try to access your file share from the portal You'll see: "not authorized to perform this operation" Perfect!

what it means:
You (trying from the public internet) can't access it ✅
People on the company network CAN access it ✅

And its a wrap!
You just built the same file infrastructure that top companies use.
Your team will go from email chaos to organized collaboration. all because you spent 30 minutes following this guide.

Not bad for a day.

What would you store in Azure Files first? Company handbook? Project files? Financial records? Tell me in the comments, I want to know how people actually use this!

How to create highly available private storage account for company documents

Emmanuel Banjo — Tue, 09 Jun 2026 12:13:52 +0000

Introduction

Every company has data it simply cannot afford to lose or expose such as internal documents, financial records, HR files, department reports which live at the heart of how a business operates. But when your company spans multiple offices across different regions, keeping that data private, protected, and always available becomes a real challenge.
The Finance team in one city needs to confirm cost data for an audit. The Operations team in another needs last quarter's reports. An external partner needs temporary access to a single file. Meanwhile, your public website is quietly generating data that needs backing up every single day.
One missing file, one regional outage, one accidental leak and the consequences ripple across departments, auditors, and clients.

This guide fixes all three problems which are private storage, high availability, and automated backup all step by step.

What You're Building
By the end of this guide you'll have:

✅ A private storage account nobody can access without permission
✅ Geo-redundant backup across two Azure regions
✅ A locked-down container for company documents
✅ Temporary partner access via expiring links (no shared passwords)
✅ Automatic file tiering to cut costs after 30 days
✅ Automated backup replication from your public website storage

Step 1: Create the Private Storage Account

This is your company's secure vault in the cloud.

In Azure Portal, search for Storage accounts
Click + Create
Select your existing resource group
Name it private plus a unique identifier (like private2026)
Choose Azure blob storage for primary service
Click Review
Then Create
Wait for deployment, then click Go to resource

Step 2: Set Up Geo-Redundant Storage (GRS)

One copy of your data is not enough. GRS keeps a second copy in a completely separate Azure region so that a regional outage doesn't take your data with it.

In your storage account, go to Data management → Redundancy
Select Geo-redundant storage (GRS) from the dropdown
Click Save
Refresh page You'll now see two locations listed; your primary region and a secondary region. Your data lives in both. If one disappears, the other keeps your business running.

Step 3: Create a Private Container

Containers are how you organise files within your storage account. This one is strictly private.

Go to Data storage → Containers
Click + Container
Set the name to private
Keep Public access level as Private (no anonymous access)
Click Create

Step 4: Upload a File and Confirm It's Private

Let's test that privacy actually works.

Click on your private container
Click Upload and choose any file from your computer
Click Upload
Click on the uploaded file
Copy the URL from the Overview tab
Open a new browser tab and paste the URL You should see an error like "ResourceNotFound" or "Public access is not permitted." That error is the correct result. Your file is private. 🔒

Step 5: Grant Temporary Partner Access via SAS

Your external partner needs to view one file for 24 hours. You don't want to give them an account, a password, or permanent access. SAS tokens are the answer. A self-expiring link that works once, for a set time, then stops.

Click on your uploaded file
Go to the Generate SAS tab
Set Permissions to Read only
Check that the expiry is set to 24 hours from now
Click Generate SAS token and URL
Copy the Blob SAS URL
Paste it in a new browser tab The file loads! But exactly 24 hours later, the same link will not work.

Step 6: Auto-Move Old Files to Cool Storage

Files you haven't touched in 30 days cost the same as files you use every day. That's wasteful and this rule fixes it automatically.

In your storage account, go to Data management → Lifecycle management
Click Add rule
Name it movetocool
Set the scope to Apply rule to all blobs in the storage account
Click Next
Keep Last modified selected
Set **More than (days ago) **to 30
In the Then dropdown, select Move to cool storage
Click Add Files sit in hot storage while active, then quietly move themselves to the cheaper cool tier after a month.

Step 7: Create a Backup Container

Before setting up automatic replication, you need somewhere to receive the backup files.

In your private storage account, go to Data storage → Containers
Click + Container
Name it backup
Keep the defaults and click Create This container will receive automatic copies of your public website files.

Step 8: Set Up Automatic Website Backup (Object Replication)

Your public website storage has files that need backing up. Instead of doing it manually, set up a replication rule that copies files automatically in the background.

Go to your public website storage account (from your previous setup, check my older articles if you need guide)
Navigate to Data management → Object replication
Click Create replication rules
Set Destination storage account to your private storage account
Set Source container to public
Set Destination container to backup
Click Create From now on, any file uploaded to your public website container will automatically appear in your private backup container within a few minutes.

Test the Replication (Optional)

Go to your public website storage account
Upload any file to the public container
Wait 3-5 minutes
Go back to your private storage account
Open the backup container Your file appears there automatically.

You've got a live backup running in the background. ✅

Common Issues

Seeing "Public access not permitted" error when testing: That's correct, it means your privacy settings are working. Only your SAS URL should load the file.
SAS URL not working: Check the expiry time, it may have already passed. Generate a new one.
Replication not showing up in backup container: Give it 5-10 minutes. Object replication isn't instant. If it still doesn't appear after 15 minutes, verify both containers exist and the rule is enabled.

Which department in your company would benefit most from this setup first? Finance, HR, or IT? Drop it in the comments, I'd love to know what you're protecting.

How to setup a Linux Virtual machine on Azure Portal

Emmanuel Banjo — Fri, 15 May 2026 19:43:21 +0000

Introduction

I always thought Linux servers were complicated and only for experts. Turns out, setting one up in Azure is pretty straightforward.
This guide shows you exactly how to create a Linux VM in Azure, connect to it from your computer, and run your first commands. No prior Linux experience needed, I also learned as I went!

Step 1: Create a Resource Group

In azure portal, search Resource group and hit ENTER!

Click on create button

Name your resource group
Choose your preferred region (choose one closest to you)
Click Review and create

Then click create

Step 2: Start Creating Your Linux VM

Go to Azure Portal and search for Virtual machines

Click + Create → Azure virtual machine

Under project details, Select your resource group

Step 3: Configure basic instance details

Virtual machine name: Type something like mylinuxvm
Region: Pick one close to you
Availability options: Choose No infrastructure redundancy required
Security type: Standard Image: Choose your Linux flavor: Ubuntu Server 24.04 LTS ← I recommend this for beginners
Size: I chose D2s version

Step 4: Set Up Your Login Method and configure Network Access

Here's where it gets interesting. You have two options:
- SSH Key (More Secure)
- Password (Simpler for first timers)
I went with Password because it's less complicated

Create a username (like adminuser)
Create a strong password (write it down!)
Public inbound ports: Select Allow selected ports
Select inbound ports: Choose HTTP (80) and SSH (22)

Step 5: Configure Monitoring, Validate and create

Scroll back to the top and choose the Monitoring tab
Disable boot diagnostics
Click Review and create

Your configurations are now Validated and your Virtual machine is ready to come alive, click create

Wait 2-3 minutes for deployment, then click Go to resource

Step 6: Verify your VM created and Connect

In your Linux VM resource, you would notice the public IP in the overview tab, This is what you would need to connect. Before connecting, we would need to increase the idle time of our virtual machine

Click on the Public IP

Increase the Idle time to 30 (max), then Apply

Back to the overview page, click Connect

Check network access, click check access

Once we verify the connection, then we need to connect to our Linux virtual machine. Copy the SSH command

In your terminal (for macs) or Powershell (windows), paste this SSH command and run. When it runs successfullly, it requests confirmation and ask for your password (remember the password we set in step 4).
Enter your password (usually this doesn't show up, so accuracy is important) Your linux VM connection is successful

When operating linux, we need to run commands as a root user or add "sudo" to every command. In order to make commands work smoothly, we can change the user to a root user and update our linux server.

run the command "sudo su"
run the command "apt update" apt (Advanced Package Tool) is a powerful, interactive command-line utility for managing software on Debian-based Linux distributions, such as Ubuntu and Linux Mint. It handles installation, removal, upgrading, and dependency management of .deb packages by automating retrieval from online repositories.

Step 7: Install applications on your server

Now that our linux server is up-to-date, we would proceed with installing some applications. In this exercise, I would be installing Vim and Nginx

Vim is a highly configurable text editor built to make creating and changing any kind of text very efficient.
NGINX is open-source web server software used for reverse proxy, load balancing, and caching
- Install vim with the command "apt install vim
- when prompted, confirm with a Y

Lastly, install nginx with the command "apt install nginx"
When prompted, confirm with Y

Our linux Virtual machine now has a software installed on it. Let's check it out.

Copy the Public IP in Step 6
Paste in your browser tab and hit ENTER!

If everything else is correct, you should be presented with this nice screen here!

You just created and connected to a real Linux server running in Microsoft's datacenter. The same technology that powers Netflix, Spotify, and thousands of companies.
The best part? You can destroy it and create a new one anytime.
Remember: Stop your VM when you're done playing. Future you will appreciate the lower bill!

What did you install on your Linux VM? Share in the comments! And if you got stuck anywhere, let me know; I probably hit the same issue when I started.

How to setup Virtual Machine on Azure Portal

Emmanuel Banjo — Fri, 15 May 2026 08:55:02 +0000

Introduction

I needed a computer in the cloud, something I could access from anywhere, spin up for testing, and shut down when I'm done. That's exactly what an Azure Virtual Machine (VM) is.
This guide walks you through creating your first VM, connecting to it, and understanding what you just built. No complex terminology, just the steps that worked for me.

Step 1: Create a Resource Group

In azure portal, search Resource group and hit ENTER!
Click on create button

Name your resource group
Choose your preferred region based on location
Click Review and create

Then click create

Now that you have a Resource group to place your Virtual machine, let's take one step further to create the Virtual machine resource.

Step 2: Create a Virtual Machine

Search for Virtual machines in Azure Portal and hit ENTER!

Click + Create → Azure virtual machine

Under the Project details tab, Select your resource group

Under the Instance details tab, name your VM something simple like myFirstVM
Choose a Region (pick one close to you)
Being a test, we don't want redundancy so we would choose No infrastructure redundancy required under Availability options
Select an Image (I chose Windows 11 pro)
Pick a Size ( I chose a standard D2s type)

Under the Administrator account tab, Create a username and password (write these down!)
For Windows: Check Allow selected ports → Select RDP (3389) and HTTP port (80) to connect over the internet
Check the box for Licensing

Scroll back to the top and choose the Monitoring tab
Disable boot diagnostics
Click Review and create

Your configurations are now Validated and your Virtual machine is ready to come alive, click create

Wait 2-3 minutes for deployment, then click Go to resource

Step 3: Connect to Your VM

In the Resource overview, click Connect (Note that your VM has an associated public IP

Under the connect tab and using Native RDP connection, click Check access

Once the connection has been confirmed, click Download RDP file

Open the downloaded file, Enter your username and password
Note: If you are using another computer other than Windows, you need to download/Install the Windows app for your RDP file to work.
After successful connection, you should have a Windows screen just like this!

Understanding what was built

A complete computer with CPU, RAM, and storage
It has its own IP address
It's running 24/7 (until you stop it)

Important: Running VMs cost money per hour. Stop them when not in use!

Congratulations! You just created a computer in the cloud. You can access it from your laptop, your phone, anywhere with internet.
This is the same technology companies use to run their applications, websites, and services.
Remember: stop it when you're done playing around. Your wallet will thank you!

Got stuck on any step? Drop a comment and let me know.

How to setup Virtual Machine on Azure Portal

Emmanuel Banjo — Fri, 15 May 2026 08:55:02 +0000

Introduction

Step 1: Create a Resource Group

In azure portal, search Resource group and hit ENTER!
Click on create button

Name your resource group
Choose your preferred region based on location
Click Review and create

Then click create

Now that you have a Resource group to place your Virtual machine, let's take one step further to create the Virtual machine resource.

Step 2: Create a Virtual Machine

Search for Virtual machines in Azure Portal and hit ENTER!

Click + Create → Azure virtual machine

Under the Project details tab, Select your resource group

Under the Instance details tab, name your VM something simple like myFirstVM
Choose a Region (pick one close to you)
Being a test, we don't want redundancy so we would choose No infrastructure redundancy required under Availability options
Select an Image (I chose Windows 11 pro)
Pick a Size ( I chose a standard D2s type)

Under the Administrator account tab, Create a username and password (write these down!)
For Windows: Check Allow selected ports → Select RDP (3389) and HTTP port (80) to connect over the internet
Check the box for Licensing

Scroll back to the top and choose the Monitoring tab
Disable boot diagnostics
Click Review and create

Your configurations are now Validated and your Virtual machine is ready to come alive, click create

Wait 2-3 minutes for deployment, then click Go to resource

Step 3: Connect to Your VM

In the Resource overview, click Connect (Note that your VM has an associated public IP

Under the connect tab and using Native RDP connection, click Check access

Once the connection has been confirmed, click Download RDP file

Open the downloaded file, Enter your username and password
Note: If you are using another computer other than Windows, you need to download/Install the Windows app for your RDP file to work.
After successful connection, you should have a Windows screen just like this!

Understanding what was built

A complete computer with CPU, RAM, and storage
It has its own IP address
It's running 24/7 (until you stop it)

Important: Running VMs cost money per hour. Stop them when not in use!

*Got stuck on any step? Drop a comment and let me know. *

How I Set Up Azure Storage for My First Public Website

Emmanuel Banjo — Sat, 02 May 2026 09:19:33 +0000

Introduction

I needed a place to store images and files for a website project. Azure Blob Storage turned out to be perfect. it's basically a file system in the cloud that anyone can access via a URL.
This guide shows you exactly how to set it up, make files publicly accessible, and add some safety features so you don't lose your work if something gets deleted.

Create the Storage Account

Search for Storage accounts in Azure Portal
Click + Create
Create a new resource group (name it something like website-storage)
Name your storage account publicwebsite plus some numbers (like publicwebsite2024)
Click Review then Create
Wait for deployment, then click Go to resource

Set Up High Availability

This makes sure your files are backed up in multiple locations.

Go to Data management → Redundancy
Select Read-access geo-redundant storage You'll see two locations: primary and secondary Now if one region goes down, your files are still available. Cool, right?

Allow Public Access

By default, storage is locked down. We need to open it up for public website files.

Go to Settings → Configuration
Turn on Allow Blob anonymous access
Click Save

Create Your Container

Containers are like folders that hold your files.

Go to Data storage → Containers
Click + Container
Name it public
Click Create

Make Files Publicly Accessible

Click on your public container
Click Change access level
Select Blob (anonymous read access for blobs only)
Click OK

Now anyone with the URL can view your files!

Upload and Test a File

In your container, click Upload
Choose any image or text file
Click Upload
After upload, click on your file
Copy the URL from the Overview tab
Paste it in a new browser tab If you see your file, it worked! 🎉

Set Up Soft Delete (The Undo Button)

This is like having a recycle bin. If you accidentally delete something, you can get it back for 21 days.

Go back to your storage account overview
Find Properties → Blob service section
Click Blob soft delete
Check Enable soft delete for blobs
Set it to 21 days
Click Save

Testing Soft Delete

Go to your container
Select a file and click Delete
Toggle Show deleted blobs (top right)
Select the deleted file
Click the three dots and choose Undelete

Your file is back!

Enable Versioning

This keeps a history of your file changes, like version control for your files.

Back in storage account Properties
Find Blob service → Versioning
Check Enable versioning for blobs
Click Save

Now when you upload a new version of a file, the old one is saved automatically.

You just set up cloud storage that's accessible from anywhere on the internet. This is the same technology that powers file hosting for major websites and apps.

One Important Warning
Since you made this publicly accessible, never upload sensitive information. Anything you put here can be accessed by anyone with the URL. No passwords, no private data, no confidential documents.

Got stuck anywhere? Drop a comment and I'll help you out. We're all figuring this stuff out together! Please like and share!!!

Setting Up Your First Azure Storage Account

Emmanuel Banjo — Sat, 25 Apr 2026 08:44:49 +0000

Introduction

Starting with Azure can feel overwhelming. There are so many options, settings, and configurations that it's hard to know where to begin. But here's the good news: setting up a storage account doesn't have to be complicated.
I recently went through the process of creating my first Azure Storage Account for a learning project, and I want to share what I learned. This guide will walk you through each step in plain language.
We'll create a storage account that's perfect for learning and testing i.e one that's secure, won't rack up unexpected charges, and follows good practices from the start. No prior Azure experience needed!

Step 1: Creating a Resource Group

What's a Resource Group?
Think of a resource group like a folder on your computer. Just like you'd put all your vacation photos in one folder, you put all your related Azure resources in one resource group. It makes everything easier to organize and manage.
The cool part? When you delete the resource group later, everything inside gets deleted too. No hunting down individual items. Perfect for learning projects!

Let's Create One quickly

Open the Azure Portal and type Resource groups in the search bar

Click the + Create button

Give it a simple name like my-storage-project or learning-storage
Pick a region (like East US or West Europe)just choose one close to you
Click Review and create

then Create

Creating Your Storage Account
Now let's create the actual storage account

Search for Storage accounts in the Azure Portal

Click + Create

Select the resource group you just created
Give your storage account a name (it needs to be unique across all of Azure, so try something like mystoragelearn123)
Keep Performance set to Standard (this is the cheaper option and perfect for learning)
Click Review + Create

Then Create

Wait a minute for it to deploy, then click Go to resource

Done! You now have your own storage account in the cloud.

Step 2: Choosing How Your Data is Stored

What's Redundancy?
When you store data in Azure, it automatically makes copies in case something goes wrong. The question is: how many copies do you need?

LRS **(Locally Redundant Storage): Makes 3 copies in one location - cheapest option
**ZRS, GRS, GZRS: More copies in more places - costs more money

For learning and testing, LRS is perfect. You save money and still have backup copies.

Setting it to LRS

In your storage account, find Data management on the left menu, then click Redundancy

Change the dropdown to Locally-redundant storage (LRS)
Click Save

That's it! You just cut your storage costs significantly.

Step 3: Making It Secure

Now let's make sure your storage is secure. Don't worry, it's just a few simple settings.

Use HTTPS (Keep Your Data Safe in Transit)
You want all your data to travel securely over the internet, like using HTTPS on a website.
- Go to Settings → Configuration
- Make sure Secure transfer required says Enabled

That's it. Now all your data travels encrypted.

Use Modern Security (TLS 1.2)
This is like saying "only let in people with new security badges,

not old ones that can be faked."
- Still in Settings → Configuration
- Check that Minimum TLS version is set to Version 1.2

Control Who Can Access It
If you're not using the storage right now, you can turn off access:
- In Settings → Configuration
- Find Allow storage account key access and set it to Disabled
- Click Save

You can always turn this back on when you need it.

Step 4: Allow Network Access

Go to Security + networking → Networking
Make sure Public network access is set to Enabled from all networks
Click Save

Congratulations! You just set up your first Azure Storage Account. I know it might have seemed like a lot of steps, but you did it!

Did this guide help you? Drop a comment and let me know how your setup went! And if you got stuck anywhere, ask away. we're all learning together.

Helpful Links

What is Azure Storage? - Official Microsoft docs
Azure Free Account - Get free credits to practice with