Azure resources are generally secure by default, so storage access should be opened only to the level required for the workload.
The module focuses on blob storage security strategies, including SAS tokens, RBAC permissions, access controls, and encryption.
Azure storage data is replicated at least three times and encrypted at rest through Storage Service Encryption.
RBAC and SAS access
RBAC provides authenticated, user- or group-based access control, and permissions are usually assigned to groups rather than individual users.
Shared access signatures provide token-based access that can be distributed to users, but the token must be protected and constrained.
SAS tokens can be limited by permissions, start time, expiry time, IP address range, and protocol.
SAS token URLs include the storage account endpoint, container or object path, permission and time parameters, and the secure token string.
Anonymous and private access
Containers default to private access with no anonymous access, reflecting Azure's secure-by-default model.
The demonstration shows enabling anonymous access, uploading a blob, and accessing it through its public URL.
When the container is changed back to private, the object is no longer reachable and Azure returns a message indicating the object does not exist, helping reduce footprinting.
A SAS token can allow access to a private blob without changing the container to public access.
Policies, lifecycle, and tiers
Lifecycle management rules can move blobs between tiers based on conditions such as last modified date.
Stored access policies can manage access for groups of files in a container, with up to five policies available.
Immutable storage options include legal retention holds and time-based holds that retain deleted objects for a configured period.
Storage tier inheritance is demonstrated by changing the account default tier and showing how inferred blob tiers update while explicitly set tiers remain unchanged.
Replication demonstration
Object replication can copy data from one storage account container to another, either for everything, only new objects, or custom selections.
The demonstration uses only-new-object replication, so only the newly uploaded blob appears in the destination container.
Encryption keys
Storage accounts use Microsoft-managed keys by default, which handle encryption without requiring users to provide keys during normal access.
Customers can bring their own keys when policy or governance requirements demand direct control over encryption keys.
Key Vault is recommended for storing and retrieving customer-managed keys and SAS tokens.
Security best practices
Microsoft recommended practices and default values are important to remember for the AZ-104 exam.
Use HTTPS wherever possible instead of unencrypted HTTP.
Keep the number of storage policies low and delete policies that are no longer used.
Use short-lived SAS token expirations and account for time zones when sharing tokens globally.
Storage security should be understood in the context of the specific Azure service or storage role being managed.
Actiepunten
Use HTTPS for storage access wherever possible.
Store SAS tokens and customer-managed keys in Azure Key Vault when possible.
Reduce the number of storage access policies and delete policies that are no longer in use.
Set near-term expirations for SAS tokens.
Account for time zones when generating and distributing SAS tokens for global users.
Talk to a security specialist or use trusted tools to identify storage account security best practices when unfamiliar with the options.
Continue learning by watching other course videos or exploring Microsoft Learn.
