Implement & Manage Storage — MOC
MS Learn path: Implement and manage storage in Azure · Every service you deploy persists data; storage fundamentals underpin them all.
Map / Canvas
The core idea
Azure Storage is the platform’s durable data core. A storage-account is the container with configurable redundancy and access tiers. Inside it: blobs (objects/files for apps), file shares (SMB/NFS), tables, and queues. Security is via access keys, SAS tokens, and network rules. Tooling: azcopy and the Azure Storage browser.
Concepts (linked from here)
Accounts & config
- Storage account
- Redundancy: LRS/ZRS/GRS/GZRS
- Access tiers: hot/cool/archive
- Performance: Standard vs Premium
Data services
- Azure Blob storage
- Object replication
- Blob versioning & soft delete
- Azure Files snapshots
- Azure Files
- Azure File Sync
- Table storage
- Queue storage
Security & access
- Access keys & connection strings
- Shared Access Signatures
- Stored access policy
- Storage encryption at rest
- Storage firewall & private endpoints
- Immutability & retention
Tooling
Modules in this path
(one module note per module, grounded in MS Learn learning objectives)
- Configure storage accounts
- Configure Azure Blob Storage
- Configure Azure Files & File Sync
- Configure Azure Storage security
- Copy / migrate data with AzCopy
Skills measured (current exam blueprint)
- Configure access: firewall/VNet rules, SAS and stored access policies, keys, and Azure Files identity access.
- Configure accounts: account settings, redundancy, object replication, encryption, Storage Explorer, and AzCopy.
- Configure Files and Blob Storage: shares/containers, tiers, soft delete, snapshots, lifecycle management, and versioning.
Practice questions
- Q: redundancy choice
- Q: SAS vs access key
- Q: archive tier
- Q: blob type for VHDs
- Q: VNet-only storage access
- Q: stored access policy
- Q: Azure Files identity access
- Q: lifecycle and recovery
Ordered practice route
- Complete storage-accounts, then storage account and Azure Files configuration. You should now understand the account as the boundary for endpoints, redundancy, access, and billing, and a file share as a protocol-specific data service.
- Complete storage-security, then delegated access and key rotation. You should now be able to select a narrow SAS and diagnose its signing and revocation path.
- Complete configure-blob-storage, then blob recovery, versions, and lifecycle. You should now be able to recover a test object and explain why lifecycle work is time-based.
- Complete replication and customer-managed encryption. You should now be able to state replication prerequisites and trace the identity that grants Azure Storage access to a CMK.
Conceptual checkpoint
Explain the sequence in this path using one workload scenario: identify the boundary being changed, the identity or tool acting on it, the expected evidence, and the failure that would change your decision.
Sources and re-audit
- AZ-104 course overview, checked 2026-08-31.
- AZ-104 study guide, checked 2026-08-31.
Re-audit when the AZ-104 course path, study-guide effective date, or the services and permissions taught here change.