DEV Community: SULIAT

Azure Management Tasks Part 6: Cleaning Up an Azure Environment the Right Way.

SULIAT — Sun, 26 Jul 2026 08:31:54 +0000

INTRODUCTION

Every resource in this series has served its purpose, the VM has run as an FTP server, the storage account has held files and access tokens, the network has been segmented and secured. Now it's time to remove all of it, cleanly, so nothing keeps quietly costing money after we've moved on.

Before skipping ahead: if you don't run through this cleanup, Azure will keep billing for these resources indefinitely. This part matters just as much as anything else in the series.

What You'll Need

Access to the Azure portal
The resource lock created in Part 5 (VM-delete-lock)
A few minutes of waiting for deletions to actually process

Step 1: Remove delete locks.

Note: If you attempt to delete a resource with a delete lock, you’ll receive a warning that the operation failed due to a delete lock being in place. To avoid that, it’s important to clear delete locks from resources you intend to delete before issuing the delete command.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
If necessary, expand the Settings submenu.
Select Locks.
Select Delete on the line for the VM-delete-lock.
On the pop-up window, select Delete to confirm deletion of the lock. Once the delete lock is removed, you’ll be able to delete the VM. While this was the only delete lock required by the exercise, if you applied other delete locks during the exercise, remove them now. When you’re done, select Home to return to the Azure portal home page.

Step 2: Delete the project resource group

From the Azure portal home page, in the search box, enter Resource groups.
Select resource groups under services.
Select the guided-project-rg resource group.
Select Delete resource group.
Select Apply force delete…
Enter guided-project-rg in the confirmation box.
Select Delete.
On the Delete confirmation pop-up, select Delete.

Step 3: Delete the NetworkWatcherRG.

From the Azure portal home page, in the search box, enter Resource groups.
Select resource groups under services.
Select the NetworkWatcherRG resource group.
Select Delete resource group.
Enter NetworkWatcherRG in the confirmation box.
Select Delete.
On the Delete confirmation pop-up, select Delete.

CONCLUSION

That's everything. Across this series, we went from an empty Azure subscription to a fully functioning (if small-scale) environment: a resource group holding a VM, VNet, and storage account; a segmented network with its own security rules; a VM resized, relocated, and equipped with its own data disk; a storage account serving files through both containers and file shares, with access controlled and revocable via SAS tokens; and finally, tags and locks to keep it organized and protected before tearing it all down responsibly at the end.

Azure Management Tasks Part 5: Keeping an Azure Environment Organized and Protected.

SULIAT — Sun, 26 Jul 2026 06:07:10 +0000

INTRODUCTION

Everything built so far actually works, the VM is on the right network, the storage account holds real files with real access controls. But none of it is labeled, and none of it is protected from a stray click. This part fixes both of those, in about five minutes' worth of clicking.

We'll add tags to a couple of resources so it's obvious at a glance what they're for and who they belong to, and we'll add a resource lock to the VM so it can't be accidentally deleted, which matters more than it sounds like, given this VM is now serving as an FTP server.

What You'll Need

Access to the Azure portal
The VM and VNet from earlier parts of this series already deployed

Step 1: Add tags to a virtual machine.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
From the menu pane, select Tags.
On one line for Name enter Department and for Value enter Customer Service.
On the next line, for Name enter Purpose and for Value enter FTP Server.
Select Apply.
Select Home to return to the Azure portal home page.

Step 2: Add a resource lock to a VM.

If necessary, expand the Settings submenu.
Select Locks.
Select + Add.
For the name, enter VM-delete-lock.
For the Lock type, select Delete.
You may enter a note to help remind you why you created the lock.
Select OK.

Step 3: Add tags to network resources.

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet network.
From the menu pane, select Tags. Note: Notice that now you can select an existing tag to apply or add a new tag. You can also select just the name or value and apply create something new in the other field.
For the Name select Department.
For the Value enter IT.
Select Apply.

CONCLUSION

Two small governance habits, now in place: resources are labeled with who they belong to and what they're for, and the one resource that would genuinely hurt to lose is protected from accidental deletion. Neither of these took more than a few clicks, but they're the kind of thing that quietly saves a lot of pain once an environment has more than a handful of resources in it.
This wraps up the hands-on management tasks in this series from standing up the environment, to securing the network, resizing and rebuilding the VM, controlling storage access, and now tagging and locking things down. All that's left is one final part: tearing everything down cleanly so nothing keeps racking up cost after we're done.

Azure Management Tasks Part 4: How Manage the Storage Account.

SULIAT — Sun, 26 Jul 2026 04:54:25 +0000

INTRODUCTION

The VM is sorted, it's on the right network, sized properly, and shutting itself down on schedule. Now it's time to turn to the last resource from Part 1: the storage account. So far it's just been sitting there, empty. In this part, we'll actually put it to work, storing a file two different ways, controlling exactly who can access it, and learning how to cut off that access when it's no longer needed.

Storage accounts in Azure aren't a single thing they're a collection of services. We'll touch two of the most common: blob storage (via containers) and file shares. Then we'll look at how to grant temporary, revocable access to what we've stored using a shared access signature (SAS).

What You'll Need

Access to the Azure portal.
The storage account created back in Part 1, sitting inside guided-project-rg.
A file you don't mind uploading for testing,a photo works fine.

Step 1: Create a Storage Container.

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg).
On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.
In the Name field, enter storage-container.
Select Create.

Upload a file to the storage container

Select the storage container you just created.
Select Upload and upload the file you prepared.
Once the file is ready for upload, select Upload.

Change the access tier

Select the file you just uploaded (the file name is a hyperlink).
Select Change tier. .
Select Cold.
Select Save.
Select Home to return to the Azure portal home page.

Note: You just changed the access tier for an individual blob or file. To change the default access tier for all blobs within the storage account, you could change it at the storage account level.

Step 2: Create a file share.

Reopen the storage account.
On the storage account blade, under the Data storage submenu, select File shares.
Select + File share.

Note: its ok to select classic file share if that is what pops up for you.

On the Basics tab, in the name field enter file-share.
On the Backup tab, uncheck Enable backup.
Select Review + create.
Select Create.
Once the file share is created, select Upload.
Upload the same file you uploaded to the blob storage or a different file, it’s up to you.
Select Home to return to the Azure portal home page.

Step 3: Create a shared access signature token.

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise.
On the storage account blade, select Storage browser.
Expand Blob containers. Note: Blob container is another name for the storage containers. Items uploaded to a storage container are called blobs.
Select the storage container you created earlier, storage-container.
Select the ellipses (three dots) on the end of the line for the image you uploaded or just right-click on it.
Select Generate SAS.

Note: When you generate a shared access signature, you set the duration. Once the duration is over, the link stops working. The **Start automatically populates with the current date and time.

Set Signing method to Account key.
Set Signing key to Key 1.

Tip: There are two signing keys available. You can choose either one, or create SAS tokens with different durations.

Set Stored access policy to None.
Set Permissions to Read.
Enter a custom start and expiry time or leave the defaults.
Set Allowed protocols to HTTPS only.
Select Generate SAS token and URL.
Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.
Select Home to return to the Azure portal home page.

Step 4: Rotate access keys

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise.
Expand the Security + networking submenu.
Select Access keys.
- For Key 1, select Rotate key.
Read and then acknowledge the warning about regenerating the access key by selecting Yes.
- Once you see the success message for rotating the access key, go back to the window or tab you used to check the SAS token and refresh the page. You should receive an authentication failed error.

CONCLUSION

You now have two working storage mechanisms, a blob container and a file share plus a concrete way to grant temporary access to what's stored in them, and just as importantly, a way to shut that access off on demand. Access tiers, SAS tokens, and key rotation are the kind of everyday levers that come up constantly once real files and real users are involved.

Next in the series, we'll move past individual resources and look at governance and protection. How to keep this entire environment compliant, cost-aware, and recoverable if something goes wrong.

Azure Management Tasks Part 3: Managing a Live VM in Azure.

SULIAT — Fri, 24 Jul 2026 10:27:48 +0000

INTRODUCTION

The network is in good shape now, it has a dedicated subnet for SFTP traffic, locked down by a security group that only lets the right port through. But the Virtual Machine itself is still sitting on the old network, sized for nothing in particular, with no extra storage and no plan for turning itself off. Time to fix all four of those.

This part walks through four small but common VM management tasks: moving the machine onto the new subnet, resizing it for a heavier workload, attaching a dedicated data disk, and scheduling it to shut down automatically at the end of the day. None of these are complicated on their own, but together they turn a generic VM into something purpose-built for the job it's about to do, acting as an FTP server.

What You'll Need

Access to the Azure portal
The guided-project-vm VM from Part 1
The ftpSubnet and ftpNSG you set up in Part 2

Step 1: Move the virtual machine network to the new subnet.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
If the virtual machine is running, select Stop.
Wait for the Status field to update and show Stopped (deallocated).
Within the Networking subsection of the menu, select Network settings.
Select the Network interface / IP configuration hyperlink for the VM.
On the IP Configurations page, update the Subnet to ftpSubnet.
Select Apply.
Select Home to return to the Azure portal home page.
You’ve migrated the VM from one subnet to another. Remember, the new subnet had specific network security rules applied to help it function as an FTP server. The next task from the Azure admin relates to the computing power of the VM. The admin would like you to vertically scale the machine to increase the computing power.

Step 2: Vertically scale the virtual machine.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Locate the Availability + scale submenu and select Size.
Select a new VM size D2s_v5 for example.

Note: If you don’t see the same size as shown in this tutorial, select something similar.

Select Resize.
Select Home to return to the Azure portal home page.

Step 3: Attach data disks to a virtual machine.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Locate the settings submenu and select Disks.
Select Create and attach a new disk.
Leave LUN as default.
Enter ftp-data-disk for the Disk name.
Leave the Storage type as default.
Enter 20 for the Size.
Select Apply to create the new storage disk and attach the disk to the machine.
Select Home to return to the Azure portal home page.

Step 4: Configure automatic shutdown on a virtual machine.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select the guided-project-vm virtual machine.
Under the Operations submenu, select Auto-shutdown.
In order to let late uploads finish, set the Scheduled shutdown to 7:15:00 PM.
Select Save.

Note: If your save button doesn't appear go back to the overview page and start the VM. Now go back to your auto-shutdown configuration the save button will appear after that.

Select Home to return to the Azure portal home page.

CONCLUSION

Four changes were made, each addressing a different concern: the VM is on the right network, sized appropriately for its workload, equipped with dedicated storage for uploads, and set to stop itself automatically to control costs. None of these tasks required rebuilding anything, just adjusting a running resource to better fit its actual job.

Next in the series, we'll shift from the VM to the storage account, and work through the management tasks that keep it configured and accessible the way it needs to be.

Azure Management Tasks Part 2: How to configure the Virtual Network (VNET)

SULIAT — Fri, 24 Jul 2026 07:20:10 +0000

INTRODUCTION

In the previous walkthrough, we put together a basic environment, creating a resource group, a VNet, a VM, and a storage account just enough infrastructure to have something real to manage. This time we're going back into that network and giving it some actual structure: a dedicated subnet for SFTP (Secure File Transfer Protocol) traffic, plus a network security group to control exactly what's allowed in and out of it.

If you haven't built the base environment yet, it's worth going back and doing that first, everything here assumes the guided-project-vnet VNet already exists.

What You'll Need

Access to the Azure portal.
The environment from Part 1 already deployed.
A rough sense of what subnets and network security groups actually do.

Step 1: Create a new subnet on an existing virtual network (vNet).

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet virtual network.
From the guided-project-vnet blade, under settings, select Subnets.
To add a subnet, select + Subnet.
For Subnet purpose leave it as Default.
For Name enter: ftpSubnet.
Leave the rest of the settings alone and select Add.
Select Home to return to the Azure portal home page.
Congratulations – you’ve completed the creation of a subnet. This subnet is only going to be used for SFTP traffic. To increase security, you need to configure a Network security group to restrict which ports are allowed on the subnet.

Step 2: Create a network security group.

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select Network security groups.
Select + Create.
Verify the subscription is correct.
Select the guided-project-rg resource group.
Enter ftpNSG for the network security group name.
Select Review + create.
Once the validation is complete, select Create.
Wait for the screen to refresh and display Your deployment is complete.
Select Go to resource.

Create an inbound security rule.

Under settings, select Inbound security rules.
Select + Add.
Change the Destination port ranges from 8080 to 22.
Select TCP for the protocol.
Set the name to ftpInbound.
Select Add.
Select Home to return to the Azure portal home page.

Step 3: Associate a network security group to the subnet.

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet virtual network.
Under settings, select Subnets.
Select the ftpSubnet you created.
On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.
Select Save.

Conclusion

What we accomplished:

Created a dedicated ftpSubnet inside the guided-project-vnet, separating SFTP traffic from the rest of the network.
Stood up a network security group, ftpNSG, to control access to that subnet.
Added an inbound rule allowing only TCP traffic on port 22 — the port SFTP actually needs
Linked the NSG to the subnet, putting those rules into effect

Why it matters:
A subnet without a security group is just an open door. By pairing the two, this subnet now only accepts the exact traffic it was designed for, and nothing else gets a free pass in.

Azure Management Tasks Part 1: How to Prepare Your Environment.

SULIAT — Fri, 24 Jul 2026 04:45:40 +0000

What is Azure Management?

Azure management refers to the tasks and processes required to maintain your business applications and the resources that support them not just in Azure, but across other clouds and on-premises environments too. Think of it as a lifecycle. Every resource you create goes through stages: it's deployed, it runs and gets maintained, and eventually it's retired. Azure management covers all of that, from start to finish.

You can't practice managing cloud resources if you don't have any resources to manage. So before diving into monitoring, governance, or security in Azure, the first job is simple: build something.

In this walkthrough, we'll stand up a small but complete environment: a resource group to hold everything, a virtual network for connectivity, a Linux virtual machine to act as our compute workload, and a storage account. Nothing fancy, just enough real infrastructure to give the later management work something to actually apply to.

Before You Start

You'll want:

A working Azure account with an active subscription.
Rough familiarity with what a VM, VNet, and storage account are (you don't need deep expertise yet).
A few minutes to click through the Azure portal.

One small piece of advice: if your subscription already has other resources sitting in it, jot down what they are. It'll save you from accidentally tearing down something important later on.

Step 1: Create a resource group

Everything we build needs a home, and in Azure that home is a resource group i.e. a logical container that groups related resources together so they're easier to manage, and easier to delete all at once when you're done.

From the Azure portal home page, in the search box, enter resource groups.
Select Resource groups under services.
Select Create.
Enter guided-project-rg in the Resource group name field.
The Region field will automatically populate. Leave the default value.
Select Review + create.
Select Create.
Return to the home page of the Azure portal by selecting Home.

Step 2: Create a virtual network with one subnet.

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select Create.
Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.
Select Review + create.
Select Create.
Wait for the screen to refresh and show Your deployment is complete.
Select Home to return to the Azure portal home page.

Step 3: Create a virtual machine.

From the Azure portal home page, in the search box, enter virtual machines.
Select virtual machines under services.
Select Create and then select Virtual machine.
Select guided-project-rg for the Resource group.
Enter guided-project-vm for the Virtual machine name.
- For the Image, select one of the Ubuntu Server options. (For example, Ubuntu Server 24.04 LTS - x64 Gen2)
Continue further on the Basics page to the Administrator account section.
Select Password for authentication type.
Enter guided-project-admin for the admin Username.
Enter a password for the admin account.
Confirm the password for the admin account.
Leave the rest of the settings as default settings. You can review the settings if you like, but shouldn’t change any.
Select Review + create.
Select Create to confirm the resource cost and create the virtual machine.
Select Home to return to the Azure portal home page.

Step 4: Create a Storage account.

From the Azure portal home page, in the search box, enter storage accounts.
Select Storage accounts under services.
Select Create.
Scroll down to the Instance details section and enter a name for the storage account. Storage accounts must be globally unique, so you may have to try a few different times to get a storage account name.
Select Review + create.
Select Create.
Wait for the screen to refresh and show Your deployment is complete. ** - Select **Home to return to the Azure portal home page.

What You've Got Now

At this point, your subscription contains a small but functioning environment: one resource group holding a virtual network, a virtual machine, and a storage account. It's not meant to be production-grade. It's a sandbox, purpose-built so that the next parts of this series have something real to work with.

From here, the natural next step is to go deeper into the network configuration we glossed over subnets, address spaces, and security rules which is exactly where we'll pick up next.

How to Create a Linux Virtual Machine on Azure (Step-by-Step for Beginners)

SULIAT — Fri, 24 Jul 2026 01:23:07 +0000

What is a Virtual Machine?
A Virtual Machine (VM) is essentially a computer that lives in the cloud instead of on your desk. A great way to understand why VMs matter is to think about a banking app.

Almost everyone has a bank app on their phone. If a bank tried to host that application on its own premises or in its own private data center, it would need to pay for cooling, electricity, hardware maintenance, and a dozen other operational expenses. That gets expensive fast and it doesn't scale well.

Instead, banks (and most companies today) use Infrastructure as a Service (IaaS), which gives them full control over a virtual machine without the overhead of owning and maintaining physical hardware.

In this article, we'll walk through creating your own Linux VM on Microsoft Azure, step by step.

Step 1: Create the Linux VM

Log in to the Azure Portal: Head over to the Azure Portal and sign in.
Search for Virtual Machines: In the search bar at the top, type Virtual Machines and select it.
Click "+ Create": This opens the Basics tab, where you'll configure your new VM.
Create a Resource Group: On the Basics tab, create a new resource group to keep your resources organized (e.g. MAYRG).
Name Your Virtual Machine: Under Instance Details, give your VM a name. Just like your physical laptop has a name (MacBook, ThinkPad, etc.), your cloud machine needs one too.
Choose a Region: Pick a region that's geographically close to you for better performance (e.g. Canada Central).
Availability Zone: Choose No availability option, since this isn't needed on a free-trial account (no infrastructure redundancy required for learning/testing purposes).
Security Type: Choose Standard. It's the lowest-tier option and works fine for a free-trial account.
Choose Your Image: The "Image" is essentially the operating system theme for your VM. Since we're creating a Linux VM, choose Ubuntu (any available version works).
VM Architecture and Size: Leave both the architecture and size as their default values.
Administrator Account: As a first-time user, choose Password instead of SSH Public Key for the authentication type.
Inbound Port Rules: Click Allow selected ports, then select:
- SSH (22) — enabled by default, needed to connect to your VM.
- HTTP (80) — enable this if you plan to install and serve anything on the VM.
Monitoring Tab: Click on the Monitoring tab and select Disable boot diagnostics.
Networking Tab: Click on the Networking tab:
- Create a new Virtual Network (e.g. MyLinuxVM-VNet)
- Leave everything else on this tab as default
- Click OK
Review and Create: Click Review + Create.
- Once validation passes, click Create.
- Azure will now deploy your virtual machine. Once it's done, click Go to resource to open your new VM's Overview page.
- Note: "Go to resource" simply means navigating to the thing you just created.

Step 2: Configure Idle Timeout (Important!)

When you create a VM, there's a setting that's easy to miss but can cause a lot of headaches if skipped: the idle timeout.
If you don't configure this, you might be working in your terminal and suddenly without warning your session disconnects, leaving you wondering what went wrong.
Here's how to fix it:

On the VM's Overview page, look for the **Networking **section, or find the **Public IP **address at the top of the page.
Click on the IP address. Find the idle timeout setting and drag it from the default 4 minutes up to the maximum of 30 minutes.
Click Apply.
Click the X to return to the Overview page.

Step 3: Connect to Your Linux VM

Back on the Overview page, click the Connect button and review the instructions provided there.
Click Check access to confirm you're ready.
Look for a green checkmark.
Open a terminal on your computer: Mac: Command + Space (Opens Spotlight Search. Type Terminal and press Return.)
Connect to your Linux VM using SSH: ssh azureuser@20.63.81.178
Copy this command and paste it into your terminal, then hit Enter.
- You'll be prompted with: "Are you sure you want to continue connecting?" - type yes and hit Enter.
- Next, you'll be prompted for a password. Enter the password you set earlier and hit Enter. Heads up: When typing your password, nothing will appear on the screen; no dots, no asterisks. It's not broken, it's just invisible for security reasons. Type carefully and confidently, then hit Enter.
- Once connected, your terminal prompt will change to something like: azureuser@MylinuxVm:~$ This confirms you've successfully connected to the Linux VM you created.

Step 4: Log In as Root

After connecting, the next thing to do is switch to root.

What is root? Root is the superuser account on Linux,the one account that has full admin access to everything on the system. If you want to update or install anything on your VM, you need to be operating as root.

Log in as root for the whole session: Type "sudo su". su stands for "super user." After running this and hitting Enter, your prompt will change to something like: root@MylinuxVm:/home/azureuser# This confirms you're now operating as root.

Step 5: Update the Package Index

Before installing anything, it's good practice to update the package index. This checks whether everything on your VM is running the latest available version. Type apt update hit Enter. This command updates your Linux VM's package list to the latest version available, ensuring you install up-to-date software in the next step.

Step 6: Install Something on the Linux VM (Example: nginx)

Now that your package index is up to date, let's install a package — in this example, nginx, a popular web server.
apt is the package manager for Linux, so we'll use it to install nginx: type this command in the terminal "apt install nginx".

Hit Enter, and when prompted, type Y to confirm and continue the installation.

Confirm the Installation

To verify that nginx installed successfully:

Grab your VM's public IP address.
Paste it into your web browser.
You should see the default "Welcome to nginx!" page, confirming nginx has been successfully installed on your Linux VM.

Wrapping Up

That's it, you've successfully provisioned a Linux VM on Azure, secured your session from unexpected timeouts, connected to it via SSH, switched to root, updated the package index, and installed your first package (nginx). From here, you can keep exploring, host applications, experiment with server administration, or install anything else you need, all without touching physical hardware.

Happy building.

How to Secure Azure Files and Blob Storage Using Managed Identities.

SULIAT — Wed, 10 Jun 2026 07:30:55 +0000

INTRODUCTION

Keeping cloud storage safe means more than just setting a password. When applications need access to storage resources, the real challenge is making sure that access is controlled, auditable, and free from hardcoded credentials that can be leaked or misused.
Azure addresses this through a combination of Managed Identities, Role-Based Access Control (RBAC), and Key Vaults. These tools work together to give you fine grained control over who and what can touch your data.
This article walks you through building that secure environment from the ground up, starting with a properly encrypted storage account and finishing with policies that prevent data from being tampered with or deleted.

What Are Managed Identities, RBAC, and Key Vaults?

Managed Identities

Managed Identity is an automated access control mechanism that eliminates the need for human intervention in managing permissions for a storage account. Instead of manually approving or denying requests, the system itself handles all authentication and authorization decisions determining who or what is allowed to enter or exit the storage account. It grants or restricts access to people and applications automatically, using either a system-assigned managed identity (fully automated by the system) or a user-assigned managed identity (a manually created identity that can be shared across resources). In essence, managed identity streamlines the approval and permission process by letting the system autonomously govern all incoming and outgoing access to the storage account.

Azure Role-Based Access Control (RBAC)

Not everyone in an organization needs the same level of access, and the same principle applies to cloud resources. RBAC lets you define exactly what each identity is allowed to do. A storage reader can view data but cannot delete it. An administrator can manage keys but may not have access to the data itself. Each role is scoped precisely, so nothing gets more permission than it actually needs.

Key Vault

Encryption keys, certificates, and application secrets all need somewhere secure to live. Azure Key Vault provides that central location, keeping sensitive values out of your codebase and making them available to authorized services at runtime with full logging of every access.

In this article, the objectives are to secure storage for Azure Files and Azure Blob Storage by walking through four essential steps which are creating the storage account and managed identity, securing access with a Key Vault and key, configuring a customer-managed key, and setting up a time-based retention policy and encryption scope.

Create the storage account and managed identity.

Step 1: Create a Storage Account with Infrastructure Encryption.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab. Check the box for Enable infrastructure encryption. Notice the warning, This option cannot be changed after this storage account is created.

Select Review + Create.

Wait for the resource to deploy.

Step 2: Provide a managed identity for the web app to use.

Search for and select Managed identities.

Select Create.

Select your resource group.

Give your managed identity a name.

Select Review and create, and then Create.

Step 3: Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

Search for and select your storage account.

Select the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select the managed identity you created in the previous step.

Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

Step 1: To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.

Select Select members.

Search for and select your user account. Your user account is shown in the top right of the portal.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

Step 2: Create a key vault to store the access keys.

In the portal, search for and select Key vaults.

Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

Step 3: Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.

Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

Step 1: In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select your managed identity.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

Step 2: Configure the storage account to use the customer managed key in your key vault.

Return to your the storage account.

In the Security + networking section, select the Encryption blade.

Select Customer-managed keys.

Select a key vault and key. Select your key vault and key.

Select to confirm your choices.

Ensure the Identity type is User-assigned.

Select an identity.

Select your managed identity then select Add.

Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure a time-based retention policy and an encryption scope.

Step 1: The developers require a storage container where files can’t be modified, even by the administrator.

Navigate to your storage account.

In the Data storage section, select the Containers blade.

Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.

In the Immutable blob storage section, select + Add policy.

For the Policy type, select time-based retention.

Set the Retention period to 5 days.

Be sure to Save your changes.

Try to delete the file in the container.

Verify you are notified failed to delete blobs due to policy.

Step 2: The developers require an encryption scope that enables infrastructure encryption.

Navigate back to your storage account.

In the Security + networking blade, select Encryption.

In the Encryption scopes tab, select Add.

Give your encryption scope a name.

The Encryption type is Microsoft-managed key.

Set Infrastructure encryption to Enable.

Create the encryption scope.

Return to your storage account and create a new container.

Notice on the New container page, there is the Name and Private access level.

Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Conclusion

Securing Azure Storage is not just about setting a password. It's about building layered, identity-driven protection where every component has only the permissions it needs and no more.
By combining Managed Identities, RBAC, Key Vaults, Customer-Managed Keys, immutable storage policies, and encryption scopes, you've built a storage environment that mirrors real-world enterprise security requirements.

Have questions or want to share what you built? Drop a comment below.

Configuring Shared File Storage for a Geographically Dispersed Company Using Azure

SULIAT — Mon, 01 Jun 2026 07:56:59 +0000

INTRODUCTION

Some companies do not use paper anymore. This means that if something is announced from headquarters, it has to stay somewhere and everyone involved has to get access to it. For a company that is geographically dispersed with offices in different locations, this becomes a real challenge. These offices need a way to share files and disseminate information across the board. One of the ways to get access to files and keep everyone on the same page is to use cloud storage and create a file share that everyone can access. The Finance department, for example, needs to confirm cost information for auditing and compliance, and that information needs to be stored somewhere that is easy to access and loads without delay. Some content, however, should only be accessed from selected corporate virtual networks to keep sensitive information secure.

To achieve all of this, the objectives are to create a storage account specifically for file shares, configure a file share and directory, configure snapshots and practice restoring files, and restrict access to a specific virtual network and subnet.
I will show you the steps on how to do this. The first thing you need to do is open the Azure portal and log in, and then follow the steps below. When choosing your storage option, always choose Premium and Premium only, because it is the only tier that offers low latency, meaning files load fast and without delay no matter where in the world your staff are connecting from.

Create and configure a storage account for Azure Files.

Create a storage account for the finance department’s shared files.
- In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements i.e the name must be unique.

Set the Performance to Premium. Set the Premium account type to File shares.

Set the Redundancy to Zone-redundant storage.

Select Review and then Create the storage account.

Wait for the resource to deploy.

Select Go to resource.

Create and configure a file share with directory.

1. Create a file share for the corporate office.

In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.

Review the other options, but take the defaults. Select Create.

2. Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.

Name the new directory finance.

Select Browse and then select the finance directory.

Notice you can Add directory to further organize your file share.

Upload a file of your choosing.

Configure and test snapshots.

1. Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots.

Select your file share.

In the Operations section, select the Snapshots blade.

Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

2. Practice using snapshots to restore a file.

Return to your file share.

Browse to your file directory.

Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore, Select the file and select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

1. This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

Search for and select Virtual networks.

Select Create. Select your resource group, and give the virtual network a name.

Take the defaults for other parameters, select Review + create, and then Create.

Wait for the resource to deploy.

Select Go to resource.

In the Settings section, select the Subnets blade.

Select the default subnet.

In the Service endpoints section choose Microsoft.Storage in the Services drop-down.

Do not make any other changes. Be sure to Save your changes.

2. The storage account should only be accessed from the virtual network you just created.

Return to your files storage account.

In the Security + networking section, select the Networking blade.

Change the Public network access to Enabled from selected virtual networks and IP addresses.

In the Virtual networks section, select Add existing virtual network.

Select your virtual network and subnet, select Add.

Be sure to Save your changes.

Select the Storage browser and navigate to your file share.

Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

CONCLUSION

Setting up shared file storage for a geographically dispersed company does not have to be complicated. With a Premium Azure Files storage account, we built a secure, low-latency file share complete with snapshots for file recovery and network restrictions to keep sensitive data safe.

Setting Up Private Storage for Internal Company Documents

SULIAT — Sun, 24 May 2026 00:31:29 +0000

Introduction:

In my previous post, we explored Azure Storage and created a public website together. We established that a public website is one where all content is openly visible and accessible to anyone on the internet, just like Amazon, Temu, or Shein. When you visit Amazon to shop, every product image, description, and listing you see is publicly available. No login, no permission, and no special access is required. That is what makes it public.
Today, we are moving in a different direction. We are focusing on private storage for internal company documents, content that is not meant for everyone, but only for those who are specifically granted access. To achieve this, we will create a storage account, set up a container with restricted access inside it, configure a Shared Access Signature for partners, back up our public website storage, and implement lifecycle management to automatically move content to the cool tier.

Setting Up and Managing Private Storage

Before we dive in, it helps to understand Azure Storage's structure. Think of a storage account as a warehouse containers are the sections inside it that organize everything stored. Every file must live inside a container, you cannot store anything without one. The container we are creating today has restricted access, meaning unlike a public container where anyone with a link can view content, this one requires explicit permission. We will also back up the public website storage created previously, ensuring your content can be restored if anything goes wrong.
Equally important is lifecycle management. Think of how Amazon handles slow-selling products after weeks of inactivity, the algorithm quietly moves them away from prominent results without deleting them. Azure Storage works the same way. By default, content sits in the hot tier, designed for frequent access. When content goes untouched for a set period, such as 30 days, a lifecycle rule automatically moves it to the cool tier, which is more cost-effective for rarely accessed content. Nothing is deleted it simply moves to a more appropriate tier, quietly and automatically.
Since this is a private storage account, access requires a SAS token (Shared Access Signature). Rather than exposing your entire storage account, a SAS token grants specific access to one file for a limited window say, 12 hours after which it expires automatically. This gives external collaborators controlled, temporary access to private content without compromising your storage account's security.
Now, let us walk through the steps on how to set all of this up:

Create a storage account and configure high availability.

1. Create a storage account for the internal private company documents.

In the portal, search for and select Storage accounts.
Select + Create.

Select the Resource group created in the previous lab.

Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.

Select Review, and then Create the storage account.

Wait for the storage account to deploy, and then select Go to resource.

2. This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Geo-redundant storage (GRS) is selected.

Refresh the page.

Review the primary and secondary location information.

Save your changes.

Create a storage container, upload a file, and restrict access to the file.

1. Create a private storage container for the corporate data.

In the storage account, in the Data storage section, select the Containers blade.

Select + Container.

Ensure the Name of the container is private. Ensure the Public access level is Private (no anonymous access).

As you have time, review the Advanced settings, but take the defaults.

Select Create.

2. For testing, upload a file to the private container. he type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publicly accessible.

Select the container.

Select Upload.

Browse to files and select a file.

Upload the file.

Select the uploaded file.

On the Overview tab, copy the URL.

Paste the URL into a new browser tab.

Verify the file doesn’t display and you receive an error.

3. An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).

Select your uploaded blob file and move to the Generate SAS tab.

In the Permissions drop-down, ensure the partner has only Read permissions.

Verify the Start and expiry date/time is for the next 24 hours.

Select Generate SAS token and URL.

Copy the Blob SAS URL to a new browser tab.

Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

To save on costs, after 30 days, move blobs from the hot tier to the cool tier.
- Return to the storage account.

In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade.

Select Add rule.

Set the Rule name to movetocool.

Set the Rule scope to Apply rule to all blobs in the storage account and select Next.

Ensure Last modified is selected.

Set More than (days ago) to 30.

In the Then drop-down select Move to cool storage.

As you have time, review other lifecycle options in the drop-down. Add the rule.

2. The public website files need to be backed up to another storage account.

In your storage account, create a new container called backup.

Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.

In the Data management section, select the Object replication blade.

Select Create replication rules.

Set the Destination storage account to the private storage account.

Set the Source container to public and the Destination container to backup.

Create the replication rule.

Upload a file to the public container. Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.

Conclusion:

With these steps, your private storage environment is fully configured. You have built a storage environment that is secure, organized, and cost-aware. Your private container is configured, your public storage is backed up, lifecycle management is running automatically, and SAS tokens are in place to control external access.

Deploying Azure Virtual Machines the GUI Way: A Step-by-Step Guide

SULIAT — Fri, 15 May 2026 11:11:40 +0000

What is a Virtual Machine?

A Virtual Machine (VM) is like a computer within a computer in the cloud. A VM uses software to create a computer that can run its own operating system separately from your actual device. A VM is basically a software-based computer that runs inside another computer. For example, on a MacBook, you can have your main operating system, and run Windows or Linux inside a virtual machine at the same time, while having its own storage, processing power, memory (RAM), and operating system.

Before deploying a virtual machine on Azure, there are two essential prerequisites to have in place:

An active Azure account: Log in to the Azure Portal using your credentials. If you do not have an account yet, you can sign up for a free trial account on the Microsoft's Azure website.
A Resource Group: A resource group serves as a logical container that organizes and holds related Azure resources together. It is the foundation of any Azure workflow, meaning it is always the first thing you set up before anything else.

With everything in place, we will walk through the process step by step, beginning with creating a resource group and then deploying the virtual machine, all through the Azure Portal's Graphical User Interface(GUI).

1. Create and deploy a resource group to hold all your project resources.

In the Azure portal, search for and select Resource groups.

Select + Create.

Give your resource group a name. Select a region. Use this region throughout the project.

Select Review and create to validate the resource group.

Select Create to deploy the resource group.

2. Create and deploy a Virtual Machine to host your application in the cloud.

In the Azure portal, search for and select Virtual Machines.

Select + Create. Click on Virtual machine. This will take you to the basics tab.

On the Basics tab, head over to the Project Details section, where you will select your Subscription and the Resource group deployed in the previous step."

On the Basics tab, scroll down to the Instance Details section and configure the following settings:

i. Virtual Machine Name: Give the virtual machine a name. Every computer has a name, so the next logical thing to do is to give the VM a name.

ii. Region: Select a region where you want the VM to be hosted.

iii. Availability Options: Since it is a free trial account subscription, select No Infrastructure Redundancy Required.

iv. Security Type: Select Trusted Launch Virtual Machine.

v. Image: Select Windows 10. In regards to a VM, the image refers to your choice of operating system.

vi. Leave the rest of the settings under Instance Details at their default values.

Still on the Basics tab, scroll down to the Administrator Account section and configure the following: Username and Password. Since all computers have a username and password, the next logical thing to do is to give the virtual machine a username and password.

Further down on the Basics tab, scroll down to the Inbound Port Rules section and configure the following: Select the Public inbound ports, select inbound ports HTTP (80) and the default RDP (3389). These ports will allow you to connect the VM to the internet.

Further down on the Basics tab, locate the Licensing section and check the box to confirm your licensing agreement before proceeding.

Having completed the Basics tab, scroll back up and click on the Monitoring tab. Under the Boot Diagnostics blade, select Disable. Disabling boot diagnostics ensures that your local device does not monitor or track the activity on the VM every time it is restarted.

Select Review and create to validate the Virtual machine.

Select Create to deploy the Virtual machine.

Wait for the Virtual machine to deploy and then Go to resource.

3. Configuring the IP Address.

Once the deployment is complete, click on Go to Resource to open the virtual machine. Navigate to the Networking or Essentials section to locate the IP Address, then click on it to begin configuration.

Under the IP address settings, locate the Idle Timeout option and change the default time from 4 minutes to 30 minutes. This ensures that the VM does not disconnect or time out prematurely during periods of inactivity, keeping your session active and stable for longer.

Select Apply.

With the IP address configured, navigate back to the virtual machine and click the Connect button.

From the dropdown, click on the Check Access blade, once you are checked in, the VM is good to go.

Select Download RDP File to download the connection file to your actual device. Note for macOS Users Unlike Windows, macOS does not support RDP files. If you are using a Mac, you will need to download the Windows App from the Apple App Store first before you can open and run the RDP file to connect to your virtual machine.

Once the RDP file has been downloaded, click on the Download icon located at the top right of your browser. Locate the RDP file you just downloaded and click the Connect button directly in front of it to initiate the connection.

Enter the username and password you set up earlier in the Administrator Account section. Click Continue to proceed.

A security certificate warning will appear. Click **Continue **to accept and continue.

At this point, your virtual machine is fully configured and ready for use.

Complete with the Start menu confirming that your VM is fully up and running.

Conclusion

Creating a virtual machine on Azure through the graphical user interface is a straightforward process that does not require any command-line experience. By following the steps outlined in this article, you have successfully deploy a fully functional Windows 10 virtual machine in the cloud.

How to Setup Storage for a Public Website.

SULIAT — Sun, 03 May 2026 11:39:22 +0000

what is a Public Website?

A public website is one that anyone in the world can open and browse without needing to sign in. Think of websites like Amazon, Temu, or Shein, you land on the page and you immediately see products, photos, videos, and reviews. No login required, that is what makes them "public." For a website like this to work well, the images, videos, and customer stories it shows must be stored somewhere reliable, fast, and accessible to everyone.
That "somewhere" is called a Storage Account. The storage account holds everything the website needs to display, and it makes those files available to anyone who visits the site, wherever they are in the world.

In this article, I will show you how to set up a storage account for a public website. By the time we are done, you will know exactly how to get your content online, keep it accessible to everyone, and protect it from accidental loss. To get there, we will be working through the following five steps:

1. Create a storage account with high availability:

Since customers are located worldwide and demand is rapidly growing, we need this storage account to be set up with high availability. This means the storage account is built to stay online and keep serving content even if something goes wrong on one server.
a) Create a storage account to support the public website.

In the portal, search for and select Storage accounts.
Select + Create.

For resource group select new. Give your resource group a name and select OK.

Set the Storage account name to publicwebsite. Make sure the storage account name is unique by adding an identifier.

Take the defaults for other settings.

Select Review and then Create.

Wait for the storage account to deploy, and then select Go to resource.

b) This storage requires high availability if there’s a regional outage. Additionally, enable read access to the secondary region.

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Read-access Geo-redundant storage is selected.

Review the primary and secondary location information.

c) Information on the public website should be accessible without requiring customers to login.

In the storage account, in the Settings section, select the Configuration blade.

Ensure the Allow blob anonymous access setting is Enabled.

Be sure to Save your changes.

2. Create a blob storage container with anonymous read access:

With the storage account ready and open to the public, the next step is to create a container inside it, and this step is non-negotiable. You cannot just throw files loosely into a storage account. Containers are used for storing Blobs. Think of the storage account as a fridge and the container as the bowl you put food into before placing it in the fridge that way everything stays neat, organized, and easy to find. Without the bowl, everything is a mess and hard to manage. A blob storage container works exactly the same way. The container keeps Blobs organized and structured.
a) The public website has various images and documents. Create a blob storage container for the content.

In your storage account, in the Data storage section, select the Containers blade.

Select + Container.

Ensure the Name of the container is public.

Select Create.

b) Customers should be able to view the images without being authenticated. Configure anonymous read access for the public container blobs.

Select your public container.

On the Overview blade, select Change access level.

Ensure the Public access level is Blob (anonymous read access for blobs only).

Select OK.

3. Practice uploading files and testing access.

a) For testing, upload a file to the public container. The type of file doesn’t matter. A small image or text file is a good choice.

Ensure you are viewing your container.

Select Upload.

Browse to files and select a file. Browse to a file of your choice.

Select Upload.

Close the upload window, Refresh the page and ensure your file was uploaded. b) Determine the URL for your uploaded file. Open a browser and test the URL.
Select your uploaded file.

On the Overview tab, copy the URL.

Paste the URL into a new browser tab.

If you have uploaded an image file it will display in the browser. Other file types should be downloaded.

4. Configure soft delete:

Accidents happen. Someone might delete an important product image or video by mistake. Soft delete is a safety feature that makes sure a deleted file is not gone forever. Instead, when a file is removed, the system quietly holds onto it in the background for a set number of days. During that time, you can go back and restore it with just a few clicks. It is like retrieving something from the recycling bin before it is permanently emptied. I will show you the steps on how to enable and retrieving soft delete for blobs.
a) It’s important that the website documents can be restored if they’re deleted. Configure blob soft delete for 21 days.

Go to the Overview blade of the storage account.
On the Properties page, locate the **Blob service **section.

Select the Blob soft delete setting.

Ensure the Enable soft delete for blobs is checked.

Change the Keep deleted blobs for (in days) setting to 21.

Notice you can also Enable soft delete for containers.

Don’t forget to Save your changes.

b) If something gets deleted, you need to practice using soft delete to restore the files.

Navigate to your container where you uploaded a file.

Select the file you uploaded and then select Delete.

Select OK to confirm deleting the file.
On the container Overview page, toggle the slider Show deleted blobs. This toggle is to the right of the search box.

Select your deleted file, and use the ellipses on the far right, to Undelete the file.

Refresh the container and confirm the file has been restored.

5. Configure blob versioning:

The final step is enabling versioning. Versioning means that every time we update a file, the old version is saved too. you always have a history of your files and can go back to an older version at any time if something goes wrong.
a) It’s important to keep track of the different website product document versions.

Go to the Overview blade of the storage account.

In the Properties section, locate the Blob service section.

Select the Versioning setting.

Ensure the Enable versioning for blobs checkbox is checked.

Notice your options to keep all versions or delete versions after.

Don’t forget to Save your changes.

b) As you have time experiment with restoring previous blob versions.

Upload another version of your container file. This overwrites your existing file.

Your previous file version is listed on Show deleted blobs page.

By following the steps outlined in this guide, you have now built a storage setup that is fully functional, secure, ready to power a real, live, public website. Starting from creating a high-availability storage account, all the way through to enabling soft delete and versioning.