Azure Lock & Key: Controlling Storage Access

Introduction

Azure Storage Accounts are the backbone of file and object management in the cloud. From blobs to file shares, Azure makes it easy to store and share data across applications and teams. But as files move to the cloud, managing who can access them, how they are shared, and for how long becomes critical.

In this hands-on guide, we’ll walk through:

• Creating a storage container and uploading a blob.
• Changing access tiers to optimize costs.
• Creating and using a file share.
• Generating a Shared Access Signature (SAS) to control temporary file access.
• Rotating keys to revoke access when needed.

By the end, you’ll know how to securely store files, share them with the right people, and manage access effectively.

🎯 Skilling Objectives

• Create and configure an Azure Storage container.
• Upload files and manage access tiers.
• Create a file share and upload files.
• Generate SAS tokens for temporary, secure file access.
• Revoke access by rotating keys.

Step 1: Create a Storage Container

💡 What is a Storage Container?
A container organizes blobs (files) within a storage account, much like a folder in a file system.

Steps:

1. Log in to the Azure Portal.

2. Search for Storage accounts and select your account.
   

3. Under Data storage, select Containers → + Add container.

4. Name it storage-container and click Create.
   

✅ Your first storage container is ready.

Step 2: Upload a File to the Container

1. Open the container you created.

2. Click Upload, choose a local file (e.g., an image), and upload it.
   
   

3. Once uploaded, notice the Access tier is set by default.

💡 Access tiers help balance cost and performance:

• Hot → Frequently accessed data.
• Cold → Infrequently accessed data.

Step 3: Change the Access Tier

1. Select the uploaded file.
2. Click Change tier → select Cold → Save.

✅ You’ve optimized the cost for infrequently used data.

Step 4: Create a File Share

💡 What is a File Share?
Azure File Shares provide SMB (Server Message Block) storage in the cloud, making it easy to share files across VMs or users.

Steps:

1. From your storage account, select File shares → + File share.
   

2. Name it file-share.
   

3. Disable backup (for now) → Review + Create → Create.
   
   

4. Open the file share → click Upload → add a file.
   
   

✅ You now have both blob storage and a file share.

Step 5: Create a Shared Access Signature (SAS)

💡 What is a SAS Token?
A Shared Access Signature (SAS) provides temporary, controlled access to files without exposing the storage account keys.

Steps:

1. In your storage account, go to Storage browser → Blob containers.

2. Select your storage-container.
   

3. Find the uploaded file → click the ellipsis (…) → Generate SAS.
   

4. Configure:

   • Signing method: Account key
   • Permissions: Read
   • Allowed protocols: HTTPS only

5. Set start/expiry time → Generate SAS token & URL.
   

6. Copy the Blob SAS URL → open it in a browser → your file loads!
   

✅ You’ve just shared a file securely with a time-limited link.

Step 6: Rotate Access Keys to Revoke Access

💡 Why rotate keys?
If a SAS token is compromised, rotating the underlying access key immediately invalidates all dependent SAS tokens.

Steps:

1. Go to Access keys under Security + networking.

2. For Key 1, click Rotate key → acknowledge warning → Yes.
   
   

3. Try refreshing your SAS URL, you’ll get an authentication error.
   

✅ Access successfully revoked.

Conclusion

In this project, you’ve learned how to:

• Create containers and file shares.
• Upload and manage files in Azure Storage.
• Control file access with SAS tokens.
• Revoke access instantly by rotating keys.

These are essential skills for cloud security and cost management. Whether you’re working in enterprise IT, DevOps, or cloud engineering, mastering storage access control helps protect sensitive data while keeping your storage strategy efficient and secure.

🔑 Key takeaway: In Azure, storage security isn’t just about giving access, it’s about controlling, limiting, and revoking access when needed.