DEV Community: Ahmed Emmanuel Oluwaseyi

Exercise 03: Create and configure Azure Firewall

Ahmed Emmanuel Oluwaseyi — Tue, 29 Apr 2025 21:29:04 +0000

Scenario

Your organization requires centralized network security for the application virtual network. As the application usage increases, more granular application-level filtering and advanced threat protection will be needed. Also, it is expected the application will need continuous updates from Azure DevOps pipelines. You identify these requirements.

Azure Firewall is required for additional security in the app-vnet.
A firewall policy should be configured to help manage access to the application.
A firewall policy application rule is required. This rule will allow the application access to Azure DevOps so the application code can be updated.
A firewall policy network rule is required. This rule will allow DNS resolution.

Skilling tasks

Create an Azure Firewall.
Create and configure a firewall policy
Create an application rule collection.
Create a network rule collection.

Create Azure Firewall subnet in our existing virtual network

In the search box at the top of the portal, enter Virtual networks. Select Virtual networks in the search results.

Select app-vnet.

Select Subnets.

Select + Subnet.

Enter the following information and select Save.

Name= AzureFirewallSubnet
Address range= 10.1.63.0/26

Create an Azure Firewall

In the search box at the top of the portal, enter Firewall. Select Firewall in the search results.

Select + Create.

Create a firewall by using the values in the following table. For any property that is not specified, use the default value.

Note: Azure Firewall can take a few minutes to deploy.

Update the Firewall Policy
In the portal, search for and select Firewall Policies.

Select fw-policy.

Add an application rule

In the Settings blade, select Application rules and then Add a rule collection.

Configure the application rule collection and then select Add.

Name= app-vnet-fw-rule-collection
Rule collection type= Application
Priority= 200
Rule collection action= Allow
Rule collection group= DefaultApplicationRuleCollectionGroup
Name= AllowAzurePipelines
Source type= IP address
Source= 10.1.0.0/23
Protocol= https
Destination type= FQDN
Destination= dev.azure.com, azure.microsoft.com

Note: The AllowAzurePipelines rule allows the web application to access Azure Pipelines. The rule allows the web application to access the Azure DevOps service and the Azure website.

Add a network rule

In the Settings blade, select Network rules and then Add a network collection.

Configure the network rule and then select Add.

Name= app-vnet-fw-nrc-dns
Rule collection type= Network
Priority= 200
Rule collection action= Allow
Rule collection group= DefaultNetworkRuleCollectionGroup
Rule= AllowDns
Source= 10.1.0.0/23
Protocol= UDP
Destination ports= 53
Destination addresses= 1.1.1.1, 1.0.0.1

Verify the firewall and firewall policy status
In the portal search for and select Firewall.

View the app-vnet-firewall and ensure the Provisioning state is Succeeded. This may take a few minutes.

In the portal serach for and select Firewall policies.

View the fw-policy and ensure the Provisioning state is Succeeded. This may take a few minutes.

02: Create and configure network security groups

Ahmed Emmanuel Oluwaseyi — Tue, 29 Apr 2025 20:51:45 +0000

Create the network infrastructure for the exercise

Note: This exercise requires the Lab 01 virtual networks and subnets to be installed. A template is provided if you need to deploy those resources.

Scenario

Your organization requires the network traffic in the app-vnet to be tightly controlled. You identify these requirements.

The frontend subnet has web servers that can be accessed from the internet. An application security group (ASG) is required for those servers. The ASG should be associated with any virtual machine interface that is part of the group. This will allow the web servers to be easily managed.
The backend subnet has database servers used by the frontend web servers. A network security group (NSG) is required to control this traffic. The NSG should be associated with any virtual machine interface that will be accessed by the web servers.
For testing, a virtual machine should be installed in the frontend subnet (VM1) and the backend subnet (VM2). The IT group has provided an Azure resource manager template to deploy these Ubuntu servers.

Skilling tasks

Create a network security group.
Create network security group rules.
Associate a network security group to a subnet.
Create and use application security groups in network security group rules.

Firstly; we need to create and deploy 2 virtual machines to complete this task

In the portal search for and select virtual machines. Verify both vm1 and vm2 are Running.

Next;

Create Application Security Group

Application security groups (ASGs) let you group together servers with similar functions. For example, all the web servers hosting your application.

1, In the portal, search for and select Application security groups

2, Select + Create and configure the application security group.

3, Select Review + create and then select Create.

Associate the application security group to the network interface of the VM

In the Azure portal, search for and select VM1.

In the Networking blade, select Application security groups and then select Add application security groups.

Select the app-frontend-asg and then select Add.

Create and Associate the Network Security Group

Network security groups (NSGs) secure network traffic in a virtual network.

In the portal search for and select Network security group.

Select + Create and configure the network security group.

Select Review + create and then select Create.

Associate the NSG with the app-vnet backend subnet.

NSGs can be associated with subnets and/or individual network interfaces attached to Azure virtual machines.

Select Go to resource or navigate to the app-vnet-nsg resource.

In the Settings blade select Subnets.

Select + Associate

Select app-vnet (RG1) and then the Backend subnet. Select OK.

Create Network Security Group rules

An NSG use security rules to filter inbound and outbound network traffic.

In the search box at the top of the portal, enter Network security groups. Select Network security groups in the search results.

Select app-vnet-nsg from the list of network security groups.

In the Settings blade, select Inbound security rules.

Select + Add and configure an inbound security rule.

Exercise 01: Create and configure virtual networks

Ahmed Emmanuel Oluwaseyi — Tue, 29 Apr 2025 20:00:17 +0000

Skilling tasks

Create a virtual network.
Create a subnet.
Configure vnet peering.

To complete this lab you will need an Azure subscription with Contributor RBAC role assigned. In this lab, when you are asked to create a resource, for any properties that are not specified, use the default value.

Create hub and spoke virtual networks and subnets

An Azure virtual network enables many types of Azure resources to securely communicate with each other, the internet, and on-premises networks. All Azure resources in a virtual network are deployed into subnets within the virtual network.

1, Sign in to the Azure portal - https://portal.azure.com.

2, Search for and select Virtual Networks

3, Select + Create and complete the configuration of the app-vnet.
This virtual network requires two subnets, frontend and backend.

4, Leave all other settings as their defaults. When finished select “Review + create and then Create.

5, Create the Hub-vnet virtual network configuration. This virtual network has the firewall subnet.

6, Once the deployments are complete, search for and select your ‘virtual networks`.Verify your virtual networks and subnets were deployed.

Configure a peer relationship between the virtual networks

Virtual network peering enables you to seamlessly connect two or more Virtual Networks in Azure
1.Search for and select the app-vnet virtual network.
2.In the Settings blade, select Peerings.
3.+ Add a peering between the two virtual networks.
Leave all other settings as their defaults. Select “Add” to create the virtual network peering.
Once the deployment completes, verify the Peering status is Connected.

Creating Web and Console Applications with C#

Ahmed Emmanuel Oluwaseyi — Thu, 27 Mar 2025 21:04:27 +0000

C# is a versatile programming language that allows developers to build different types of applications.
Two of the most common types of applications are Console Applications and Web Applications.

In this lesson, we will explore these two application types, their use cases, and how to create them using .NET.

To start developing C# applications, you need the following tools:

Tools Required:

1, Visual Studio or Visual Studio Code :

Visual Studio is a full-featured IDE tailored for .NET development.
Visual Studio Code is a lightweight editor with extensions for C# and .NET development.
2, .NET SDK :
The .NET Software Development Kit (SDK) includes everything you need to build and run C# applications.

Steps to Set Up:
1, Download and install the latest version of .NET SDK .
2, Install Visual Studio or Visual Studio Code .
3, For Visual Studio Code, install the C# extension from the Extensions Marketplace.

Understanding Console Applications

What is a Console Application?
A 🖥️ console application is a simple application that runs in a terminal or command-line interface (CLI). It does not have a graphical user interface (GUI) and is primarily used for executing background tasks, automation, and simple programs.

📌 Use Cases

⚙️ Scripting and automation
📊 Data processing
🧪 Testing algorithms and logic
🔧 Command-line utilities

🛠️ Creating Web and Console Applications with C#

Follow this steps below;
Open the vs code app, locate the file folder at the top of the app

Select Open folder - create new folder, name the folder and open the folder

Select view and select terminal

On the Open terminal, we need to input some command prompts;
Run the following command;= dotnet new web -n MyWebApp -o MyWebApp press Enter

This command creates a new folder MyWebApp and generates the required files for an ASP.NET Core web application.
Navigate to the project directory: input=cd MyWebApp press Enter
Now we need to Run the application: input= dotnet run and press Enter

The application starts and listening on a specified port. Open a web browser copy the http:// ports displayed in the terminal, and input it on a web browser and search

Creating an Azure Kubernetes Service(AKS)Cluster in Azure Portal

Ahmed Emmanuel Oluwaseyi — Tue, 18 Mar 2025 11:54:17 +0000

Azure Kubernetes Service (AKS) is Microsoft’s managed Kubernetes offering that simplifies deploying, managing, and scaling containerized applications in the cloud.

Key Points:

Managed Kubernetes:
Microsoft manages the Kubernetes control plane (master nodes), which reduces your operational overhead. You focus on deploying and managing your application workloads.
Integrated with Azure Ecosystem:
AKS seamlessly integrates with other Azure services (like Azure Monitor, Azure Active Directory, and Azure DevOps), making it easier to implement monitoring, security, and CI/CD pipelines.
Scalability and Reliability:
With features like auto-scaling, self-healing, and load balancing, AKS provides the necessary tools to handle variable workloads and ensure high availability.
Simplified Operations:
The service automates tasks such as upgrades, patching, and scaling, which streamlines cluster management.

Use Cases:

Microservices Architecture: Ideal for running distributed microservices-based applications where each service runs in its own container. Dev/Test Environments: Quickly spin up clusters for testing and development with minimal administrative overhead. Production Workloads: Leverage enterprise-grade features (security, monitoring, scaling) for running critical applications.

In this lesson, we will delve into the process of creating an Azure Kubernetes Service (AKS) cluster in the Azure Portal. AKS is a managed Kubernetes service provided by Microsoft Azure that simplifies the deployment, management, and scaling of containerized applications using Kubernetes. To create an AKS cluster, follow these steps:

1, Log in to the Azure Portal using your credentials.

2, Navigate to the Create a resource option..

3, Search for Kubernetes Service

4, Click on Kubernetes Service and then select Create

5, Fill in the required information such as subscription, resource group, AKS cluster name, region, and Kubernetes version.

6, Configure additional settings like node size, node count, and authentication method

7, Review the settings and click on Review + create

8, Once validation is successful, click on Create to provision the AKS cluster.

9, Monitor the deployment progress in the Azure Portal.

After the AKS cluster is successfully created, you can interact with it using kubectl commands or through the Azure Portal interface. This lesson provides a foundational understanding of how to create an AKS cluster in the Azure Portal, which is essential for deploying and managing containerized applications in a Kubernetes environment.

Further Learning:
For more in-depth details, you can refer to the official Azure Kubernetes Service documentation which covers setup, configuration, best practices, and more.

In summary, AKS provides a robust platform for container orchestration on Azure by handling much of the underlying complexity of Kubernetes management, allowing you to focus on building and running your applications.

Virtual Machine Scale Set

Ahmed Emmanuel Oluwaseyi — Tue, 18 Mar 2025 07:10:16 +0000

A virtual machine scale set (VMSS) consists of a group of identical virtual machines that are load-balanced, enabling automatic scaling of workloads. This set can be set up to flexibly change the number of virtual machines based on defined conditions. Furthermore, we can manually adjust it to efficiently allocate computing resources for workload management.

Steps to create a VMSS

Sign in to the Azure portal.
Click “Create a resource” on the top left corner of the portal.
Search for “Virtual Machine Scale Set” in the search bar.
Click on the “Virtual Machine Scale Set” result. Click the “Create” button
On the Basic Tab, The first section is that of Project details select the “subscription”, “resource group”. Take a look at the Scale set details section. The next section is the Orchestration that allows us to select the “orchestration mode“ and also “security”. The next section is instance details.
In the Administrator account section, select your “authentication type.”
For the purpose of the exercise, we will select “Password” instead of SSH public key and this means you will need to create a username and a password.
Check the “Licensing” option.
Click on the Blue “Review + Create” Button.
Create
Wait for the deployment to be completed. Deployment will take some time to be completed typically between 3-5 minutes.
Click on the “go to resource” button to access the newly created Azure VMSS.
Check the status of the VMSS.
This is supposed to show succeeded.

Thank you

AZURE LOAD BALANCER

Ahmed Emmanuel Oluwaseyi — Fri, 07 Mar 2025 21:06:17 +0000

Azure Load Balancer is a fully managed network service in Azure that distributes incoming and outgoing traffic among healthy instances of your applications, ensuring high availability and scalability.

Key Features:

Traffic Distribution: It balances network traffic at the transport layer (Layer 4), supporting both TCP and UDP protocols.
Types:

Public Load Balancer: Routes external Internet traffic to your backend resources.
Internal Load Balancer: Distributes traffic within an Azure virtual network, ideal for private applications.

Health Probes: Regularly checks the health of your backend VMs or services, ensuring that only healthy endpoints receive traffic.
Scalability & Performance: Designed to handle high throughput with low latency, and can scale to meet changing traffic demands.
Integration: Works seamlessly with Azure Virtual Networks, Availability Sets, and Availability Zones to deliver high resilience.
Configuration Flexibility: Allows custom load balancing rules, NAT configurations, and session persistence options to match application needs.

To Create Azure Load Balancer

Login into your Azure portal, on the search bar, input load balancer then select

On the overview page scroll to load balancer and select create

Select all that applies and click Next

on the next page select +add Frontend IP configurationinput your configuration details and save

select review + create

Overall, Azure Load Balancer is essential for designing robust and resilient cloud architectures by effectively managing traffic, optimizing resource utilization, and ensuring a seamless experience for end users.

Thank you

How to Create an Azure Compute Gallery and capture the image of the Virtual Machine

Ahmed Emmanuel Oluwaseyi — Tue, 04 Mar 2025 07:23:24 +0000

⁠Create an Azure Compute Gallery and capture the image of the VM in step one,
make sure that state of the VM is specialized, if you choose to generalize it explain why;

Azure Compute Gallery (formerly known as Shared Image Gallery) is a service in Azure designed to simplify the management, distribution, and versioning of custom VM images. It provides a centralized and scalable repository where you can:

Manage Custom Images: Store and organize your VM images along with their metadata.
Version Control: Maintain multiple versions of an image, making it easier to update and roll back if needed.
Regional Replication: Replicate images across multiple Azure regions to ensure high availability and reduce deployment latency.
Streamlined Sharing: Securely share images across subscriptions and even across different Azure Active Directory tenants.
Scalable Deployments: Support large-scale deployments and integration with virtual machine scale sets, ensuring consistent and reliable environments.

This service is particularly useful for organizations that need to deploy standardized images across diverse environments, ensuring consistency, compliance, and efficient management of virtual machine images.

To start; we have to launch the azure search bar and input azure compute gallery

click on +create

select your resource group, give gallery a name and select a region, then review + create

click on Go to resource

Now we go back to our previously created virtual machine and select capture tab on the drop down select the image

When saving an image it is either; Generalized or Specialized

Generalized: VMs created from this image require hostname, admin user, and other VM related setup to be completed on first boot
Specialized: VMs created from this image are completely configured and do not require parameters such as hostname and admin user/password

For this task i will choose specialized; because i want it to be easily accessible.

I will choose all that applies, then proceed to Review + create

Note; before an image will be created it will automatically stop a running virtual machine.

Downloading

Give it a while to complete the creation process

We can use a Captured image to create Two things which are; virtual machine and virtual machine skill set

Thank you

How To Add A Data Disk To A Virtual Machine

Ahmed Emmanuel Oluwaseyi — Tue, 04 Mar 2025 05:13:21 +0000

A data disk in Azure is a virtualized storage device that you attach to an Azure virtual machine (VM) to store application data, files, databases, or other persistent data. Unlike the OS disk—which holds the operating system—a data disk is used solely for data storage and can be managed independently.

Key Points

Persistence: Data disks provide persistent storage that remains available even if the VM is stopped or restarted.
Scalability: You can attach multiple data disks to a VM to meet your storage requirements.
Performance Options: Data disks come in various types (such as Standard HDD, Standard SSD, and Premium SSD) that offer different performance levels to match your workload needs.
Flexibility: They can be detached and reattached to other VMs if needed, making it easier to manage data and scale resources.

This separation of storage helps optimize performance and reliability by isolating the operating system from the data storage workload.

We have to create a virtual machine first on Azure portal, learn more about how to create a virtual machine in my previous videos https://dev.to/sheyitex/creating-a-windows-vitual-machine-in-azure-48m1

On the VM creation page we will select Disk tab

By default, windows already selected a disk for us

We can start our disk creation below, but i will want to run through the VM first, before I will add a new disk

select the monitoring tab and disable diagnostic

come to Tags tab and select add tags, give it a name then review and create

We will go to resource on the VM we create, go to the settings tab an select disk, once we select disk we will see that there are no values in the data disk section, its empty...
we will click on the + create and attach a new disk tab

give the disk a name, select storage type and size then proceed to apply

we have our data disk created, but we cannot access it, to gain access to the disk we will close this lab at the top right corner X, and we will have to connect to back to the virtual machine,

connect to the virtual machine, stretch the idle time to the maximum so it will not log you out when you are working on the VM and select Save

Now we will click on connect

select native rdp, wait for it to configure and click on download

put in your credentials and proceed;

on the window bar type in Data disk management this will pop up with the description below

Select OK88

The new disk is still **unallocated because we are yet to format the disk

click next

The data disk is now ready for use

Thank you for reading through..

How To Create System-Assigned App managed identities.

Ahmed Emmanuel Oluwaseyi — Fri, 28 Feb 2025 21:36:37 +0000

Skilling tasks

Create the storage account and managed identity.
Secure access to the storage account with a key vault and key.
Configure the storage account to use the customer managed key in the key vault
Configure a time-based retention policy and an encryption scope.

STEPS

Create the storage account and managed identity

1, Provide a storage account for the web app

In the portal, search for and select Storage accounts.
Select + Create.
For Resource group select Create new. Give your resource group a name and select OK to save your changes.
Provide a Storage account name. Ensure the name is unique and meets the naming requirements.
Move to the Encryption tab.
Check the box for Enable infrastructure encryption.
Notice the warning, This option cannot be changed after this storage account is created.
Select Review + Create.
Wait for the resource to deploy.

2, Provide a managed identity for the web app to use. Learn more about managed identities

Search for and select Managed identities.
Select Create.
Select your resource group.
Give your managed identity a name.
Select Review and create, and then Create.

3, Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs. Learn more about how to assign Azure roles.

Search for and select your storage account.
Select the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Storage Blob Data Reader role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select the managed identity you created in the previous step.
Click Select and then Review + assign the role.
Select Review + assign a second time to add the role assignment.
Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. Learn more about how to provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Key Vault Administrator role.
On the Members page, select User, group, or service principal.
Select Select members.
Search for and select your user account. Your user account is shown in the top right of the portal.
Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.
You are now ready to continue with the lab.

Create a key vault to store the access keys.

In the portal, search for and select Key vaults.
Select Create.
Select your resource group.
Provide the name for the key vault. The name must be unique.
Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.
Select Review + create.
Wait for the validation checks to complete and then select Create.
After the deployment, select Go to resource.
On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.
Select Generate/Import and Name the key.
Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity. Learn more about how to use a system-assigned managed identity to authorize access

In the portal, search for and select Resource groups.
Select your resource group, and then the Access Control (IAM) blade.
Select Add role assignment (center of the page).
On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.
On the Members page, select Managed identity.
Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select your managed identity.
Click Select and then Review + assign.
Select Review + assign a second time to add the role assignment.

Configure the storage account to use the customer managed key in your key vault. Learn more about customer managed keys on an existing storage account.

Return to your the storage account.
In the Security + networking section, select the Encryption blade.
Select Customer-managed keys.
Select a key vault and key. Select your key vault and key.
Select to confirm your choices.
Ensure the Identity type is User-assigned.
Select an identity.
Select your managed identity then select Add.
Save your changes.
If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure a time-based retention policy and an encryption scope.

The developers require a storage container where files can’t be modified, even by the administrator. Learn more about blob immutable storage.

Navigate to your storage account.
In the Data storage section, select the Containers blade.
Create a container called hold. Take the defaults. Be sure to Create the container.
Upload a file to the container.
In the Settings section, select the Access policy blade.
In the Immutable blob storage section, select + Add policy.
For the Policy type, select time-based retention.
Set the Retention period to 5 days.
Be sure to Save your changes.
Try to delete the file in the container.
Verify you are notified failed to delete blobs due to policy.

2.The developers require an encryption scope that enables infrastructure encryption. Learn more about infrastructure encryption.

Navigate back to your storage account.
In the Security + networking blade, select Encryption.
In the Encryption scopes tab, select Add.
Give your encryption scope a name.
The Encryption type is Microsoft-managed key.
Set Infrastructure encryption to Enable.
Create the encryption scope.
Return to your storage account and create a new container.
Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Key takeaways

Azure has built-in RBAC roles for Azure storage. These roles include: Storage Account Contributor, Storage Blob Data Owner, and File Data SMB Share Contributor.
You can use your own encryption key to protect the data in your storage account. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data.
Immutable storage ensures data can’t be modified or deleted for a user-specified interval. There are two types of immutable policies: time-based and legal hold.
Infrastructure encryption can be enabled for the entire storage account, or for an encryption scope within an account. Infrastructure encryption is recommended for scenarios where doubly encrypting data is necessary for compliance requirements.

Thank you for reading, I am open for further conversations, please leave a question, suggestions in the comments

HOW TO CREATE AN APP SERVICE AND DEPLOYMENT WITH AZURE

Ahmed Emmanuel Oluwaseyi — Sun, 23 Feb 2025 22:56:31 +0000

App Service Web Apps lets you quickly build, deploy, and scale enterprise-grade web, mobile, and API apps running on any platform. Meet rigorous performance, scalability, security and compliance requirements while using a fully managed platform to perform infrastructure maintenance.

I will run you through the Steps to create a web app service on Azure portal

1, Launch the Azure portal and search for and select App services from the search bar.

2, Click on +Create Tab select Web app you might need to wait for some seconds for it to open

3, To Create a Web App service you will need 3 vital things which are;

A Resource group
Empty web app
A plan

Give your Resource group a name and select all that applies.

4, Review and Create

5, Create on the next tab and let it validate

6, Click on Go to Resource

Now we have our Web app created and it comes with a default domain

we can click on the default domain, it will show us an empty web app that needs to be uploaded with content

To upload content into the app we will need to type and select advance tools in the search bar area and click on the Go to, this will take us to another page

on the Kudu+ app click on the Debug tab and select CMD select site
Select Root folder
Select the pencil icon
Remove every code on the tab and input your own java script code
To get a java script code, I will launch ChatGPT and generate code for a business journal, you can generate codes for anything
Copy and paste the codes into the Kudu+ then save
I will go back to my App service and click on the default domain to launch my app
Now I have app up and running

Thank you for reading

Provide and configuring private storage for internal company documents

Ahmed Emmanuel Oluwaseyi — Fri, 21 Feb 2025 05:07:49 +0000

*The company needs storage for their offices and departments. This content is private to the company and shouldn’t be shared without consent. This storage requires high availability if there’s a regional outage. The company wants to use this storage to back up the public website*

Create a storage account and configure high availability.

In the storage account, in the Data management section, select the Redundancy blade.
Ensure Geo-redundant storage (GRS) is selected.
Refresh the page.
Review the primary and secondary location information.
Save your changes.

Create a storage container, upload a file, and restrict access to the file.

Create a private storage container for the corporate data.
In the storage account, in the Data storage section, select the Containers blade.
Select + Container.
Ensure the Name of the container is private.
Ensure the Public access level is Private (no anonymous access).
As you have time, review the Advanced settings, but take the defaults.
Select Create.
For testing, upload a file to the private container. he type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publicly accessible.
Select the container.
Select Upload.
Browse to files and select a file.
Upload the file.
Select the uploaded file.
On the Overview tab, copy the URL.
Paste the URL into a new browser tab.
Verify the file doesn’t display and you receive an error.

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS). Learn more about Shared Access Signatures.
``Select your uploaded blob file and move to the Generate SAS tab.
In the Permissions drop-down, ensure the partner has only Read permissions.
Verify the Start and expiry date/time is for the next 24 hours.
Select Generate SAS token and URL.
Copy the Blob SAS URL to a new browser tab.
Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.
Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier. Learn more how manage the Azure Blob storage lifecycle.

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.
In the Data management section, select the Lifecycle management blade.
Select Add rule.
Set the Rule name to movetocool.
Set the Rule scope to Apply rule to all blobs in the storage account.
Select Next.
Ensure Last modified is selected.
Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.
As you have time, review other lifecycle options in the drop-down.
Add the rule.

## The public website files need to be backed up to another storage account.[Learn more about object replication.

In your storage account, create a new container called backup. Use the default values. Refer back to Lab 02a if you need detailed instructions.
Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.
In the Data management section, select the Object replication blade.
Select Create replication rules.
Set the Destination storage account to the private storage account.
Set the Source container to public and the Destination container to backup.
Create the replication rule.
Optionally, as you have time, upload a file to the public container. Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.