storage-security

Configure Azure Storage security

MS Learn module: Configure Azure Storage security · Learning objectives: configure a shared access signature (SAS) including the URI and SAS parameters; configure Azure Storage encryption; implement customer-managed keys; recommend opportunities to improve Azure Storage security.

Overview (why this module matters)

Storage accounts hold sensitive data, so securing access is paramount. This module covers how to let people in safely: SAS delegation vs keys, plus encryption at rest (Microsoft-managed vs customer-managed keys), and overall best practices for defense-in-depth.

Units / lessons covered

• Introduction
• Review Azure Storage security strategies
• Create shared access signatures
• Identify URI and SAS parameters
• Determine Azure Storage encryption
• Create customer-managed keys
• Apply Azure Storage security best practices
• (Interactive lab simulation) / Knowledge check / Summary & resources

Concepts introduced (link each term note)

• Shared Access Signatures — account/service/user-delegation, stored access policy
• Access keys & connection strings (the shared-key baseline)
• Storage firewall & private endpoints
• Immutability/retention as a security posture
• Encryption: Storage Service Encryption (SSE) — Azure-managed keys by default, customer-managed keys (CMK) via Azure Key Vault
• RBAC for identity-based data access (e.g., Storage Blob Data Reader)

Key terms / commands

# generate a service SAS (CLI returns the token + URL)
az storage container generate-sas --name <c> --permissions rwl --expiry <ISO> --account-name <sa> --account-key <key>
# enable customer-managed keys (set on the storage account, referencing a Key Vault key)

Hands-on / what to try

• Create an account SAS and a service SAS with a stored access policy; inspect the sig/sp/st/se URI params.
• Rotate an account key and observe SAS invalidation.
• Enable customer-managed keys (Azure Key Vault) and encrypt the account; test disabling public network access.
• Apply best-practice RBAC roles instead of shared keys.

Exam focus

• SAS = delegated, granular, time-limited; memorize the 3 S’s (Sign / Specify / Send) and the URI params.
• SSE is on by default (Microsoft-managed); CMK shifts key control to your Key Vault.
• Regenerating keys invalidates shared-key based SAS.
• Defense-in-depth: network rules + keys/SAS + RBAC + encryption + immutability.

Related

Path MOC · sas-token · storage-access-keys · storage-network-rule · immutable-storage · rbac