Home / Azure

AzureChecklistBeginner

Secure baseline for a production Azure Storage account

Redundancy choice, network isolation, identity-based access, soft delete, versioning, immutability and lifecycle rules for a storage account that holds customer data.

Deepak Bhardwaj2 min read

Applies toAzure Storage (StorageV2 general-purpose v2), Blob and Azure Files

Redundancy (decide first, it's hard to change some combinations later)

SKU Copies Protects against
LRS 3 in one datacenter Disk/rack failure
ZRS 3 across availability zones Zone failure
GRS / RA-GRS LRS + async copy to the paired region Region outage (RA = read access to the secondary)
GZRS / RA-GZRS ZRS + async copy to the paired region Zone and region failures

Production data with a DR requirement: GZRS or RA-GZRS where available.

Network

  • publicNetworkAccess disabled, access through private endpoints (blob, file, dfs as needed).
  • If public access must stay, firewall with selected networks and trusted Microsoft services only.
  • Minimum TLS 1.2; secure transfer required.
az storage account update -g rg-data -n stcustdataprodcin \
  --public-network-access Disabled --min-tls-version TLS1_2 --https-only true \
  --allow-blob-public-access false --allow-shared-key-access false

Identity

  • Shared key access disabled where all clients support Entra ID; apps use managed identities with Storage Blob Data Reader/Contributor.
  • If SAS is unavoidable: user delegation SAS, short expiry, stored access policies.

Data protection

  • Blob soft delete (for example 14 days) and container soft delete.
  • Versioning enabled; point-in-time restore for block blobs if needed.
  • Azure Files: share soft delete + Azure Backup snapshots.
  • Immutability (time-based retention) for audit or ransomware-sensitive data.
  • Resource lock (CanNotDelete) on the account.
az storage account blob-service-properties update -g rg-data --account-name stcustdataprodcin \
  --enable-delete-retention true --delete-retention-days 14 \
  --enable-container-delete-retention true --container-delete-retention-days 14 \
  --enable-versioning true

Cost

  • Lifecycle management: move to Cool after 30 days, Cold/Archive after 180 days, delete old versions after 90 days.

Monitoring

  • Diagnostic logs (StorageRead/Write/Delete) to Log Analytics.
  • Alerts on availability, server latency and unusual delete volume.
  • Defender for Storage (malware scanning on upload if customers upload files).

Note

Geo-redundancy is asynchronous. After a failover to the secondary, writes from the last minutes may be missing; check Last Sync Time before deciding to fail over (see the storage DR post).

Related fixes