DEV Community: forsyth famous

How to Secure Azure Storage Using Managed Identities and RBAC

forsyth famous — Sat, 30 May 2026 07:22:39 +0000

Introduction

Modern cloud applications require secure ways to access storage resources without exposing sensitive credentials or access keys.

In Microsoft Azure, developers can secure storage accounts using Managed Identities, Role-Based Access Control (RBAC), and immutable storage policies.

In this guide, we’ll configure secure Azure Storage access while exploring identity-based authentication and protected immutable storage.

By the end of this tutorial, you’ll know how to:

Configure secure Azure Storage access
Use Managed Identities for authentication
Implement Azure RBAC
Configure immutable blob storage policies

Let’s build a more secure Azure storage environment.

What are Managed Identities and RBAC?

Managed Identities allow Azure resources to securely authenticate to other Azure services without storing credentials inside application code.

Azure Role-Based Access Control (RBAC) helps manage who or what can access Azure resources and what actions they can perform.

Together, these features help organizations:

Eliminate hardcoded credentials
Control access permissions centrally
Improve cloud security
Support least-privilege access principles

Immutable storage adds another layer of protection by preventing critical data from being modified or deleted during a retention period.

Prerequisites

Before we begin, ensure you have:

A Microsoft Azure account
An active Azure subscription
A stable internet connection
Access to the Azure Portal

Now come with me, let’s build a secure Azure storage environment.

Create the storage account and managed identity

Provide a storage account for the web app.
- In the portal, search for and select Storage accounts.
- Select + Create.
- For Resource group select Create new. Give your resource group a name and select OK to save your changes.
- Provide a Storage account name. Ensure the name is unique and meets the naming requirements.
- Move to the Encryption tab.
- Check the box for Enable infrastructure encryption.
- Notice the warning, This option cannot be changed after this storage account is created.
- Select Review + Create.
- Wait for the resource to deploy.
Provide a managed identity for the web app to use. Learn more about managed identities.
- Search for and select Managed identities.
- Select Create.
  - Select your resource group.
  - Give your managed identity a name.
- Select Review and create, and then Create.
Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.
- Search for and select your storage account.
- Select the Access Control (IAM) blade.
- Select Add role assignment (center of the page).
- On the Job functions roles page, search for and select the Storage Blob Data Reader role.
- On the Members page, select Managed identity.
- Select Select members, in the Managed identity drop-down select User-assigned managed identity.
- Select the managed identity you created in the previous step.
- Click Select and then Review + assign the role.
- Select Review + assign a second time to add the role assignment.
- Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.
- In the portal, search for and select Resource groups.
- Select your resource group, and then the Access Control (IAM) blade.
- Select Add role assignment (center of the page).
- On the Job functions roles page, search for and select the Key Vault Administrator role.
- On the Members page, select User, group, or service principal.
- Select Select members.
- Search for and select your user account. Your user account is shown in the top right of the portal.
- Click Select and then Review + assign.
- Select Review + assign a second time to add the role assignment.
- You are now ready to continue with the lab.
Create a key vault to store the access keys.
- In the portal, search for and select Key vaults.
- Select Create.
- Select your resource group.
- Provide the name for the key vault. The name must be unique.
- Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.
- Select Review + create.
- Wait for the validation checks to complete and then select Create.
- After the deployment, select Go to resource.
- On the Overview blade ensure both Soft-delete and Purge protection are enabled.
Create a customer-managed key in the key vault.
- In your key vault, in the Objects section, select the Keys blade.
- Select Generate/Import and Name the key.
- Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.
- In the portal, search for and select Resource groups.
- Select your resource group, and then the Access Control (IAM) blade.
- Select Add role assignment (center of the page).
- On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.
- On the Members page, select Managed identity.
- Select Select members, in the Managed identity drop-down select User-assigned managed identity.
- Select your managed identity.
- Click Select and then Review + assign.
- Select Review + assign a second time to add the role assignment.
Configure the storage account to use the customer managed key in your key vault.
- Return to your the storage account.
- In the Security + networking section, select the Encryption blade.
- Select Customer-managed keys.
- Select a key vault and key. Select your key vault and key.
- Select to confirm your choices.
- Ensure the Identity type is User-assigned.
- Select an identity.
- Select your managed identity then select Add.
- Save your changes.
- If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure an time-based retention policy and an encryption scope.

The developers require a storage container where files can’t be modified, even by the administrator.
- Navigate to your storage account.
- In the Data storage section, select the Containers blade.
- Create a container called hold. Take the defaults. Be sure to Create the container.
- Upload a file to the container.
- In the Settings section, select the Access policy blade.
- In the Immutable blob storage section, select + Add policy.
- For the Policy type, select time-based retention.
- Set the Retention period to 5 days.
- Be sure to Save your changes.
- Try to delete the file in the container.
- Verify you are notified failed to delete blobs due to policy.
The developers require an encryption scope that enables infrastructure encryption.
- Navigate back to your storage account.
- In the Security + networking blade, select Encryption.
- In the Encryption scopes tab, select Add.
- Give your encryption scope a name.
- The Encryption type is Microsoft-managed key.
- Set Infrastructure encryption to Enable.
- Create the encryption scope.
- Return to your storage account and create a new container.
- Give the New container, a Name.
- Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Cleanup your resources

If you are working with your own subscription and have completed these labs, take a minute to delete the lab resources. This will ensure resources are freed up and cost is minimized. The easiest way to delete the lab resources is to delete the lab resource group.

In the Azure portal, select the resource group, select Delete the resource group, Enter resource group name, and then click Delete.
Using Azure PowerShell, Remove-AzResourceGroup -Name resourceGroupName.
Using the CLI, az group delete --name resourceGroupName.

Conclusion

Congratulations on successfully configuring secure Azure Storage access using Managed Identities, RBAC, and immutable storage policies.

In this lab, we explored how Azure security features can help organizations protect storage resources while simplifying authentication and access management.

Some key takeaways from this lab include:

Managed Identities eliminate the need for hardcoded credentials
Azure RBAC enables centralized access management
Immutable storage helps protect critical data from modification or deletion
Identity-based authentication improves cloud security posture

By completing this exercise, you have taken another important step in building practical Azure security and cloud administration skills.

See you in the next article.

How to Configure Azure File Shares for Secure Enterprise File Storage

forsyth famous — Tue, 19 May 2026 10:44:05 +0000

Introduction

Organizations with multiple office locations often require a centralized and secure way to share files across departments and teams.

With Azure File Shares, businesses can store and access files in the cloud while maintaining scalability, availability, and secure network access.

In this guide, we’ll configure Azure File Shares in Microsoft Azure and explore how organizations can securely share files across distributed environments.

By the end of this tutorial, you’ll know how to:

Create and configure Azure File Shares
Upload and manage files in Azure Storage
Configure secure network access
Understand Azure Files networking and access controls

Let’s build a secure enterprise cloud file sharing solution.

What are Azure File Shares?

Azure File Shares provide cloud-based file storage that can be accessed across multiple devices and locations using the SMB protocol.

Organizations can use Azure File Shares to:

Share files across departments and office locations
Centralize enterprise file storage
Improve scalability and availability
Restrict access using networking and identity controls
Replace or extend traditional on-premises file servers

Think of it as a cloud-based network drive hosted securely inside Microsoft Azure.

Scenario

The company is geographically dispersed with offices in different locations. These offices need a way to share files and disseminate information.

For example, the Finance department needs to confirm cost information for auditing and compliance.

These file shares should be easy to access and load without delay. Some content should only be accessed from selected corporate virtual networks.

Prerequisites

Before we begin, ensure you have:

A Microsoft Azure account
An active Azure subscription
A stable internet connection
Access to the Azure Portal

Now come with me, let’s build a secure cloud file-sharing solution.

Create and configure a storage account for Azure Files.

Create a storage account for the finance department’s shared files.
- In the portal, search for and select Storage accounts.
- Select + Create.
- For Resource group select Create new. Give your resource group a name and select OK to save your changes.
- Provide a Storage account name. Ensure the name meets the naming requirements.
- Set the Performance to Premium.
- Set the Premium account type to File shares.
- Set the Redundancy to Zone-redundant storage.
- Select Review and then Create the storage account.
- Wait for the resource to deploy.
- Select Go to resource.

Create and configure a file share with directory.

Create a file share for the corporate office.
- In the storage account, in the Data storage section, select the File shares blade.
- Select + File share and provide a Name.
- Review the other options, but take the defaults.
- Select Create
Add a directory to the file share for the finance department. For future testing, upload a file.
- Select your file share and select + Add directory.
- Name the new directory finance.
- Select Browse and then select the finance directory.
- Notice you can Add directory to further organize your file share.
- Upload a file of your choosing.

Configure and test snapshots.

Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.
- Select your file share.
- In the Operations section, select the Snapshots blade.
- Select + Add snapshot. The comment is optional. Select OK.
- Select your snapshot and verify your file directory and uploaded file are included.
Practice using snapshots to restore a file.
- Return to your file share.
- Browse to your file directory.
- Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.
- Select the Snapshots blade and then select your snapshot.
- Navigate to the file you want to restore,
- Select the file and the select Restore.
- Provide a Restored file name.
- Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.
- Search for and select Virtual networks.
  - Select Create. Select your resource group. and give the virtual network a name.
  - Take the defaults for other parameters, select Review + create, and then Create.
  - Wait for the resource to deploy.
  - Select Go to resource.
- In the Settings section, select the Subnets blade.
  - Select the default subnet.
  - In the Service endpoints section choose Microsoft.Storage in the Services drop-down.
  - Do not make any other changes.
  - Be sure to Save your changes.
The storage account should only be accessed from the virtual network you just created.
- Return to your files storage account.
- In the Security + networking section, select the Networking blade.
  - Change the Public network access to Enabled from selected virtual networks and IP addresses.
  - In the Virtual networks section, select Add existing virtual network.
  - Select your virtual network and subnet, select Add.
  - Be sure to Save your changes.
- Select the Storage browser and navigate to your file share.
- Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

Conclusion

Congratulations on successfully configuring Azure File Shares in Microsoft Azure.

In this lab, we explored how Azure File Shares can provide centralized, scalable, and secure cloud-based file storage for geographically distributed organizations.

We also configured network restrictions to help protect sensitive organizational data and control access from approved virtual networks.

Some key takeaways from this lab include:

Azure File Shares provide centralized cloud file storage
Azure networking controls help secure sensitive data
Azure Files supports distributed enterprise workloads
Cloud-based file services improve accessibility and scalability

By completing this exercise, you have taken another important step in building practical Azure storage and cloud administration skills.

See you in the next article.

How to Deploy a Linux Virtual Machine in Microsoft Azure and Connect Using SSH

forsyth famous — Fri, 15 May 2026 17:02:08 +0000

Introduction

Linux Virtual Machines are widely used in cloud computing for hosting applications, managing servers, running development environments, and practicing cloud administration.

In this guide, we’ll deploy a Linux Virtual Machine in Microsoft Azure using the Azure Portal and securely connect to it using SSH authentication with a username and password.

By the end of this tutorial, you’ll know how to:

Deploy a Linux Virtual Machine in Azure
Configure SSH access
Connect securely using SSH
Understand the basics of Azure Linux Virtual Machines

Let’s build your first Linux cloud machine.

What is a Linux Virtual Machine?

A Linux Virtual Machine (VM) is a Linux-based computer running inside the cloud instead of on physical hardware.

With Azure Linux Virtual Machines, you can:

Host applications and web servers
Run development and testing environments
Practice Linux administration
Access your server remotely from anywhere
Learn cloud and infrastructure management

Think of it as renting a Linux server from Microsoft’s datacenter whenever you need one.

And today, we’re building one from scratch.

Scenario

A company requires a Linux-based cloud server for administration, testing, and application hosting.

The solution must allow administrators to securely connect remotely using SSH while maintaining proper networking and security configurations.

Prerequisites

Before we begin, ensure you have:

A Microsoft Azure account
An active Azure subscription
A stable internet connection
A terminal application
- Windows Terminal / PowerShell
- macOS Terminal
- Linux Terminal

Now come with me, let’s build your first Linux cloud machine.

Create the Linux Virtual Machine.

Use the top search box to search for and select Virtual machines.
Click + Create, and then select in the drop-down virtual machine. Notice your other choices.
On the Basics tab, continue completing the configuration:
- Subscription: Select the name of your Azure subscription
- Resource group: Click Create new, give the resource group a name and click Ok
- Virtual machine names: Select any name for your virtual machine.
- Region: Select a preferred region.
- Availability options: Select No infrastructure redundancy required
- Security type: Select Standard (review your other choices)
- Image: Click on see all images, to have an overview and variety of images to choose from and select Ubuntu Server 24.04 LTS -x64 Gen2
- Size: Choose Standard_B4as_v2 (use See all sizes to view the CPU and memory) Authentication type: Select Password.
- Username: Give it a Username. For example "azureuser"
- Password: Select a Password you can remember and repeat the password in the confirm password tab below.
- Public inbound ports: Choose Allow selected ports
- Select inbound ports: Choose your desired allowed ports, please note that for a linux vm like the one we are creating by default SSH port 22 is selected, you can choose to add HTTP(80) and HTTPS(443)
Navigate to the monitoring tab, and under boot diagnostics of the Diagnostics section, select disable. Leave others with their default values
Click Review + Create.
After the validation passes, click Create.

Increase the Idle Timeout on the Public IP address of your Virtual Machine.

select Go to resource.
From the Overview blade, ensure the virtual machine Status is Running, and the public IP address is visible under the Networking section and also on the Primary NIC public IP section.
Click on Public IP under the Networking section on the VM overview page
Set the Idle timeout bar in the configuration section to the maximum (30) and click apply

Connect to the Linux VM Using SSH.

On the Overview tab of the VM, in the top menu, select Connect and Connect in the drop-down.
In the Native SSH page, select the Check access button to make sure port 22 is available.
Make a note of the public IP address and copy the SSH command. You will need this to connect to the virtual machine. Close the Native SSH page.
Open a CMD/Terminal window and paste the SSH command you copied from the azure portal.
You'll be prompted with an Are you sure you want to continue connecting? Please type Yes and press enter.
Please type in the password you created while deploying the VM. Please note that in Linux, when you are entering the password the screen is still going to be blank, just continue typing the right password and hit enter and you'll successfully connect to the vm.
Change to root user: type this command to change to root user "sudo su."
Fetch the list of available OS updates and install updates with "sudo apt update". When prompted, type yes to continue. Each command must complete successfully.

Install the Nginx web service and test to ensure it is working

Install the Nginx service with "sudo apt install nginx". When prompted indicate Y to continue the install.
Start the Nginx service with "sudo systemctl start nginx".
Configure Nginx to launch on boot. This is optional but good practice with "sudo systemctl enable nginx".
Check to ensure the Nginx service is active (running) with "service nginx status"
Launch the Nginx welcome page. Open the Nginx default page in a browser, http://public_ip_address.Be sure to substitute your virtual machine public IP address.

Conclusion

Congratulations on successfully deploying and connecting to your first Linux Virtual Machine in Microsoft Azure.

In this lab, we explored the core concepts behind Azure Linux Virtual Machines, including compute provisioning, networking, authentication, and secure remote access using SSH.

Linux Virtual Machines provide a flexible and scalable way to host applications, practice Linux administration, and build cloud infrastructure without relying on physical hardware.

Some key takeaways from this lab include:

Azure Linux Virtual Machines provide on-demand cloud computing resources
SSH enables secure remote administration of Linux servers
Azure networking and NSGs help control inbound SSH access
Linux VMs are commonly used for hosting, administration, automation, and development workloads
Cloud infrastructure can be deployed within minutes using the Azure Portal

By completing this exercise, you have taken another important step in building practical cloud engineering and Linux administration skills with Microsoft Azure.

See you in the next article.

How to Deploy a Windows 10 Virtual Machine in Microsoft Azure

forsyth famous — Fri, 15 May 2026 12:32:13 +0000

Introduction

Cloud computing doesn’t have to be boring.

In this guide, we’ll deploy a Windows 10 Virtual Machine (VM) in Microsoft Azure using the Azure Portal, step by step.

By the end of this tutorial, you’ll know how to:

Create a Windows 10 Azure VM
Configure remote access
Connect using RDP
Understand the basics of Azure Virtual Machines

Let’s build your first cloud machine.

What is a Virtual Machine (VM)?

A Virtual Machine (VM) is a computer that runs inside the cloud instead of physical hardware.

With Azure Virtual Machines, you can:

Run Windows or Linux operating systems
Install applications
Test environments
Practice cloud administration
Access your machine remotely from anywhere

Think of it as renting a computer from Microsoft’s datacenter whenever you need one.

And today, we’re building one from scratch.

Scenario

A company requires a cloud-hosted Windows 10 environment for remote administration, testing, and secure access to internal applications.

The solution must allow administrators to securely connect to the machine remotely while maintaining proper network and security configurations.

Prerequisites

Before we begin, ensure you have:

A Microsoft Azure account
An active Azure subscription
A stable internet connection
A Remote Desktop application

Now come with me, let’s build your first cloud machine.

Use the Azure portal to create the Windows 10 Virtual Machine.

Use the top search box to search for and select Virtual machines.
Click + Create, and then select in the drop-down virtual machine. Notice your other choices.
On the Basics tab, continue completing the configuration:
- Subscription: Select the name of your Azure subscription
- Resource group: Click Create new, give the resource group a name and click Ok
- Virtual machine names: Select any name for your virtual machine.
- Region: Select a preferred region.
- Availability options: Select No infrastructure redundancy required
- Security type: Select Standard (review your other choices)
- Image: Click on see all images, to have an overview and variety of images to choose from and select Windows 10 enterprise version 22H2 -x64 Gen2
- Size: Choose Standard_B4as_v2 (use See all sizes to view the CPU and memory)
- Username: Give it a Username. For example "azureuser"
- Password: Select a Password you can remember and repeat the password in the confirm password tab below.
- Public inbound ports: Choose Allow selected ports
- Select inbound ports: Choose your desired allowed ports, please note that for windows vm like the one we are creating by default RDP port 3389 is selected, you can choose to add HTTP(80) and HTTPS(443)
- Licensing: Check the licensing box ✅
Navigate to the monitoring tab, and under boot diagnostics of the Diagnostics section, select disable. Leave others with their default values
Click Review + Create.
After the validation passes, click Create.

Increase the Idle Timeout on the Public IP address of your Windows 10 Virtual Machine.

select Go to resource.
From the Overview blade, ensure the virtual machine Status is Running, and the public IP address is visible under the Networking section and also on the Primary NIC public IP section.
Click on Public IP under the Networking section on the VM overview page
Set the Idle timeout bar in the configuration section to the maximum (30) and click apply

Connect to the virtual machine.

On the Overview tab of the VM, in the top menu, select Connect and Connect in the drop-down.
In the Native RDP page, select the Check access button to make sure port 3389 is available.
Select Download RDP file to download the connection file to your computer.
Open the downloaded RDP file and click Connect/Continue when prompted.
You may receive a certificate warning during the sign-in process. Click Yes or Continue to create the connection.
Now you have access to your azure windows 10 VM, lets play some super mario.

Conclusion

Congratulations on successfully deploying and connecting to your first Windows 10 Virtual Machine in Microsoft Azure.

In this lab, we explored the core concepts behind Azure Virtual Machines, including compute provisioning, authentication, and secure remote access using RDP.

Azure VMs provide a flexible and scalable way to run workloads in the cloud without managing physical hardware, making them ideal for testing, administration, development environments, and enterprise workloads.

Some key takeaways from this lab include:

Azure Virtual Machines provide on-demand cloud computing resources
Remote Desktop Protocol (RDP) enables secure remote administration
Virtual Machines can be used for learning, testing, development, and production workloads
Cloud infrastructure can be deployed within minutes using the Azure Portal

By completing this exercise, you have taken another important step in building practical cloud engineering skills with Microsoft Azure.

See you in the next article.

How to Secure Private Documents with Azure Blob Storage | Step-by-Step Azure Guide

forsyth famous — Tue, 12 May 2026 08:54:43 +0000

Introduction

In my previous article, I walked through how to host a public website using Azure Blob Storage. While public access is useful for static websites and publicly available content, not every file stored in the cloud should be accessible to everyone.

In many real-world environments, organizations need a secure way to store internal documents, sensitive files, backups, and private company data while still maintaining scalability and availability in the cloud.

In this article, we will build on the same Azure environment from the previous lab by reusing the existing Resource Group and Storage Account setup. If you did not follow the previous article, you can access it here:

forsyth famous

Apr 29

How to Host a Public Website Using Azure Blob Storage

#cloud #microsoft #azure #microsoftcloud

Comments 1

7 min read

For this lab, we will configure private Azure Blob Storage, restrict anonymous access, generate secure Shared Access Signature (SAS) access, and implement lifecycle management and replication policies for better storage optimization and resiliency.

By the end of this guide, you will understand how to securely manage private documents in Azure Blob Storage using industry-standard cloud practices.

Scenario

A company requires secure cloud storage for internal office and departmental documents. Since the data contains private organizational information, it must not be publicly accessible without authorization.

The storage solution must also provide high availability in the event of a regional outage while supporting backup and replication for the company’s public website storage.

In this lab, we will configure Azure Blob Storage to meet these requirements using private containers, Shared Access Signatures (SAS), lifecycle management, and object replication.

Create a storage account and configure high availability.

Create a storage account for the internal private company documents.
- In the portal, search for and select Storage accounts.
- Select + Create.
- Select the Resource group created in the previous lab.
- Set the Storage account name to private. Add an identifier to the name to ensure the name is unique (i added eazi).
- Select Review, and then Create the storage account.
- Click on create.
- Wait for the storage account to deploy, and then select Go to resource.
This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.
- In the storage account, in the Data management section, select the Redundancy blade.
- Ensure Geo-redundant storage (GRS) is selected.
- Refresh the page.
- Review the primary and secondary location information.
- Save your changes.

Create a storage container, upload a file, and restrict access to the file.

Create a private storage container for the corporate data.
- In the storage account, in the Data storage section, select the Containers blade.
- Select + Container.
- Ensure the Name of the container is private.
- Ensure the Public access level is Private (no anonymous access).
- As you have time, review the Advanced settings, but take the defaults.
- Select Create.
For testing, upload a file to the private container. he type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publicly accessible.
- Select the container.
- Select Upload.
- Browse to files and select a file.
- Upload the file.
- Select the uploaded file.
- On the Overview tab, copy the URL.
- Paste the URL into a new browser tab.
- Verify the file doesn’t display and you receive an error.
An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).
- Select your uploaded blob file and move to the Generate SAS tab.
- In the Permissions drop-down, ensure the partner has only Read permissions.
- Verify the Start and expiry date/time is for the next 24 hours.
- Select Generate SAS token and URL.
- Copy the Blob SAS URL to a new browser tab.
- Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier.
- Return to the storage account.
- In the Overview section, notice the Default access tier is set to Hot.
- In the Data management section, select the Lifecycle management blade.
- Select Add rule.
- Set the Rule name to movetocool.
- Set the Rule scope to Apply rule to all blobs in the storage account.
- Select Next.
- Ensure Last modified is selected.
- Set More than (days ago) to 30.
- In the Then drop-down select Move to cool storage.
- As you have time, review other lifecycle options in the drop-down.
- Add the rule.
The public website files need to be backed up to another storage account.
- In your storage account, create a new container called backup. Use the default values. Refer back to Lab 02a if you need detailed instructions.
- Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.
  - In the Data management section, select the Object replication blade.
  - Select Create replication rules.
  - Set the Destination storage account to the private storage account.
  - Set the Source container to public and the Destination container to backup.
  - Create the replication rule.
- Optionally, as you have time, upload a file to the public container. Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.

Conclusion

Congratulations on completing the lab.

In this exercise, we explored how to secure internal company documents using Azure Blob Storage by implementing private access controls and secure sharing mechanisms. We also looked at additional storage management features such as lifecycle policies and object replication to improve both cost optimization and data resiliency.

Some key takeaways from this lab include:

Azure Blob Storage can securely store private organizational data.
Containers can be configured to block anonymous public access.
Shared Access Signatures (SAS) provide controlled and temporary access to files.
Lifecycle management helps automate storage tier optimization.
Object replication improves backup and disaster recovery capabilities.

This lab also demonstrates the importance of designing cloud storage solutions based on business requirements, balancing security, accessibility, scalability, and cost efficiency.

If you followed my previous article on hosting a public website using Azure Blob Storage, you have now seen both sides of Azure Storage, public access for web hosting and private access for secure internal storage.

See you in the next article.

How to Host a Public Website Using Azure Blob Storage

forsyth famous — Wed, 29 Apr 2026 17:00:18 +0000

What is Hosting a Website in Azure Storage?

Before deploying a public website, it’s important to understand what this means in the context of Azure.

In Microsoft Azure, Blob Storage isn’t just for storing files, it can also serve static content directly over the internet.

This allows you to host content such as:

HTML pages
CSS stylesheets
JavaScript files
Images and media

All without needing to manage a traditional web server.

Think of it as turning your storage account into a lightweight, globally accessible web host.

Why This Matters

Hosting a static website using Azure Storage is:

Cost-effective – no need for virtual machines or app services
Scalable – Azure handles traffic automatically
Simple to deploy – upload files and go live

But here’s the catch, just like we discussed in my previous post, storage accounts are globally accessible by default unless configured otherwise. That means the moment you enable public access, you’re making content available to anyone with the link.

If you haven’t already, check out my previous article where I break down what a storage account is and how to create one:

forsyth famous

Apr 24

Provide storage for the IT department testing and training

#cloud #microsoftcloud #azure #learning

Comments

4 min read

That foundation will make the concepts in this guide much easier to follow, especially when working with containers and access levels.

Setting Up the Scenario

Now that we understand the concept, let’s get practical.

The goal isn’t just to get a website running or exposing a file or image to the internet from a storage account, it’s about understanding how to do it securely and responsibly in a real-world cloud environment.

Now let’s walk through how to actually set this up step by step.

Create a storage account with high availability.

Create a storage account to support the public website.
- In the portal, search for and select Storage accounts.
- Select + Create.
- For resource group select new. Give your resource group a name and select OK.
- Set the Storage account name to publicwebsite. Make sure the storage account name is unique by adding an identifier.
- Take the defaults for other settings.
- Select Review and then Create.
- Wait for the storage account to deploy, and then select Go to resource.
This storage requires high availability if there’s a regional outage. Additionally, enable read access to the secondary region.
- In the storage account, in the Data management section, select the Redundancy blade.
- Ensure Read-access Geo-redundant storage is selected.
- Review the primary and secondary location information.
Information on the public website should be accessible without requiring customers to login.
- In the storage account, in the Settings section, select the Configuration blade.
- Ensure the Allow blob anonymous access setting is Enabled.
- Be sure to Save your changes.

Create a blob storage container with anonymous read access

The public website has various images and documents. Create a blob storage container for the content.
- In your storage account, in the Data storage section, select the Containers blade.
- Select + Container.
- Ensure the Name of the container is public.
- Select Create.
Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs.
- Select your public container.
- On the Overview blade, select Change access level.
- Ensure the Public access level is Blob (anonymous read access for blobs only).
- Select OK.

Practice uploading files and testing access.

For testing, upload a file to the public container. The type of file doesn’t matter. A small image or text file is a good choice.
- Ensure you are viewing your container.
- Select Upload.
- Browse to files and select a file. Browse to a file of your choice.
- Select Upload.
- Close the upload window, Refresh the page and ensure your file was uploaded.
Determine the URL for your uploaded file. Open a browser and test the URL.
- Select your uploaded file.
- On the Overview tab, copy the URL.
- Paste the URL into a new browser tab.
- If you have uploaded an image file it will display in the browser. Other file types should be downloaded.

Configure soft delete

It’s important that the website documents can be restored if they’re deleted. Configure blob soft delete for 21 days.
- Go to the Overview blade of the storage account.
- On the Properties page, locate the Blob service section.
- Select the Blob soft delete setting.
- Ensure the Enable soft delete for blobs is checked.
- Change the Keep deleted blobs for (in days) setting to 21.
- Notice you can also Enable soft delete for containers.
- Don’t forget to Save your changes.
If something gets deleted, you need to practice using soft delete to restore the files.
- Navigate to your container where you uploaded a file.
- Select the file you uploaded and then select Delete.
- then delete the file.
- Select OK to confirm deleting the file.
- On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.
- Select your deleted file, and use the ellipses on the far right, to Undelete the file.
- Refresh the container and confirm the file has been restored.

Configure blob versioning

It’s important to keep track of the different website product document versions.
- Go to the Overview blade of the storage account.
- In the Properties section, locate the Blob service section.
- Select the Versioning setting.
- Ensure the Enable versioning for blobs checkbox is checked.
- Notice your options to keep all versions or delete versions after.
- Don’t forget to Save your changes.
As you have time experiment with restoring previous blob versions.
- Upload another version of your container file. This overwrites your existing file.
- Your previous file version is listed on Show deleted blobs page.

Conclusion

Hosting a public website with Azure Blob Storage is simple, but doing it the right way is what really matters.

You’ve seen how easy it is to make content accessible over the internet, but also why understanding access levels and data protection features like soft delete and versioning is important.

At this point, you’re not just uploading files, you’re thinking about security, accessibility, and real-world usage.

See you in the next one, where we take this a step further.

Provide storage for the IT department testing and training

forsyth famous — Fri, 24 Apr 2026 20:23:46 +0000

What is an Azure Storage Account?

Before we dive into creating and securing a storage account, it’s important to understand what it actually is.

In Microsoft Azure, a storage account is a fundamental resource that acts as a secure, scalable container for your data in the cloud. It provides a unified namespace to store and manage different types of data, all under one roof.

Think of it as a cloud-based data hub where you can store:

Blobs → for unstructured data like images, videos, backups, logs
Files → managed file shares accessible via SMB/NFS
Queues → for messaging between application components
Tables → NoSQL structured data

Each storage account is uniquely named and globally accessible (unless restricted), making it a critical entry point that must be properly secured.

Setting Up the Environment.

Now that you know what a storage account is, let’s get our hands dirty.

In this guide, we’ll create and secure an Azure Storage Account for an IT department testing and training environment, keeping things practical, straightforward, and (hopefully) a bit fun along the way.

And if you’re the type who likes to dig deeper, I’ve included a link to the official Microsoft documentation so you can explore Azure Storage in more detail.
https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview

Create a resource group and a storage account.

Create and deploy a resource group to hold all your project resources.
- In the Azure portal, search for and select Resource groups.
- Select + Create.
- Give your resource group a name. For example, storagerg.
- Select a region. Use this region throughout the project.
- Select Review and create to validate the resource group.
- Select Create to deploy the resource group.
Create and deploy a storage account to support testing and training.
- In the Azure portal, search for and select Storage accounts.
- Select + Create.
- On the Basics tab, select your Resource group.
- Provide a Storage account name. The storage account name must be unique in Azure.
- Set the Performance to Standard.
- Select Review, and then Create.
- Then Create.
- Wait for the storage account to deploy and then Go to resource.

Configure simple settings in the storage account.

The data in this storage account doesn’t require high availability or durability. A lowest cost storage solution is desired.
- In your storage account, in the Data management section, select the Redundancy blade.
- Select Locally-redundant storage (LRS) in the Redundancy drop-down.
- Be sure to Save your changes.
- Refresh the page and notice the content only exists in the primary location.
The storage account should only accept requests from secure connections.
- In the Settings section, select the Configuration blade.
- Ensure Secure transfer required is Enabled.
Developers would like the storage account to use at least TLS version 1.2.
- In the Settings section, select the Configuration blade.
- Ensure the Minimal TLS version is set to Version 1.2.
Until the storage is needed again, disable requests to the storage account.
- In the Settings section, select the Configuration blade.
- Ensure Allow storage account key access is Disabled.
- Be sure to Save your changes.
Ensure the storage account allows public access from all networks.
- In the Security + networking section, select the Networking blade.
- Ensure Public network access is set to Enabled from all networks.
- Be sure to Save your changes.

Conclusion

And that’s it, you’ve just deployed and secured your first Azure Storage Account.

What started as a simple setup turned into a solid foundation for a secure IT department testing and training environment. More importantly, you’ve seen how small configuration choices can make a big difference when it comes to protecting your data.

Keep experimenting, keep building, and most importantly, keep securing your resources.