# AZ-104 Lab 3: Create, Secure, and Manage Azure Storage (Step-by-Step)

**Series:** Week 3 of the AZ-104 Learning Labs on [jmcnairtech.com](http://jmcnairtech.com)  
**Goal:** learn how to create an Azure Storage Account, create and secure blob containers, use SAS, — all things that show up on the AZ-104 exam and in real Azure admin jobs.

## What you’ll learn

* ### **What You’ll Learn**
    
    * How to create and configure an **Azure Storage Account**
        
    * The difference between **redundancy types** (LRS, GRS, ZRS)
        
    * How to secure access using **SAS tokens**
        
    * How to upload and manage **Blob Containers**
        
    * How to revoke access by **rotating keys**
        
    * Best practices for **network security and HTTPS-only connections**
        
    
    ### Prerequisites
    
    * Azure subscription
        
    * Portal access
        
    * We’ll use **East US** for the lab (you can change it based on your location)
        
    
    ## Step 1 — Create a resource group
    
    **Why:** keeps everything in one place so you can delete it later.
    
    ### 1.1
    
    In the Azure Portal search bar, type **Resource groups** and select it.
    
    ### 1.2
    
    Click **\+ Create**.
    
    ### 1.3
    
    Fill in:
    
    * **Subscription:** your default
        
    * **Resource group:** `rg-lab3-storage`
        
    * **Region:** **East US**
        
    
    Click **Review + create → Create**.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762101568695/092d3673-3365-4861-bc11-8306d6f88028.png align="center")
    
    ## Step 2 — Create an Azure Storage Account *(Updated for new 2025 portal)*
    
    **Goal:** create a storage account that will hold your blob containers, files, and other data types — while learning the different redundancy and performance options.
    
    ### **2.1 — Open the Storage Account creation wizard**
    
    1. In the Azure Portal search bar, type **Storage accounts**.
        
    2. Click **\+ Create**.
        
    3. The new “Storage Center | Blob Storage” interface opens.
        
    
    ### **2.2 — Basics tab**
    
    **Project details**
    
    * **Subscription:** your active Azure subscription
        
    * **Resource group:** `rg-lab3-storage` (Create it first if you haven’t already.)
        
    
    **Instance details**
    
    * **Storage account name:** `storlab3mcnair`
        
        * must be all lowercase, 3–24 characters, globally unique.
            
    * **Region:** `(US) East US`
        
    * **Preferred storage type:** **Azure Blob Storage or Azure Data Lake Storage Gen 2**
        
        *Microsoft recently updated this field. Choose “Azure Blob Storage” because this lab focuses on blob containers, SAS, and lifecycle management (all AZ-104 exam topics).*
        
    * **Performance:** **Standard (General-purpose v2)**
        
        Premium is for high-throughput or low-latency scenarios; Standard keeps costs low.
        
    * **Redundancy** = LRS
        
        LRS stores three copies of your data *within one datacenter*. It’s low-cost and perfect for lab work or testing.
        
    
    Click **Next: Advanced →** at the bottom.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762102687288/07fdc6d9-3b4a-465a-83fa-269e553d157b.png align="center")
    
    ### **2.3 — Advanced tab**
    
    Leave defaults for now, but confirm:
    
    * **Minimum TLS version:** **TLS 1.2**
        
    * **Allow large file shares:** Disabled
        
    * **Enable hierarchical namespace (Data Lake Gen2):** Leave unchecked (not needed for this lab)
        
    
    Click **Next: Networking →**
    
    ### **2.4 — Networking tab**
    
    The Networking tab controls how your Storage Account is accessed — publicly, privately, or only from specific networks.
    
    For this lab, we’ll keep it open so you can test uploads, SAS links, and RBAC access later.
    

### **Public network access**

Select:

**Enable**  
This allows inbound and outbound traffic to your Storage Account over the public Azure network.

*Explanation:*  
Azure gives you three levels here:

* **Enable** → open access (best for labs and learning)
    
* **Disable** → blocks all network traffic except private endpoints
    
* **Secure by perimeter** → used in enterprise networks with perimeter controls
    

### **Public network access scope**

Select:

**Enable from all networks**

*Explanation:*  
This makes the Storage Account reachable from any public IP address or Azure service (perfect for practicing SAS and RBAC access).  
Later, in production or advanced labs, you’d restrict this to specific virtual networks or IP ranges.

### **Private endpoint**

Leave this section empty for now.

*Private endpoints let you connect privately to your Storage Account inside a VNet — you’ll explore that later in your AZ-104 journey (network security and hybrid connectivity modules).*

**Result:**  
Your Storage Account is configured for **public access** — allowing you to easily upload blobs, generate SAS tokens, and test access controls during this lab.  
Later on in the series, you’ll learn how to restrict access securely using Azure RBAC and private endpoints.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762105400697/403479c2-2900-484d-be8b-5b98fbadda3f.png align="center")

### **2.5 — Data protection tab**

Enable:

**Select Soft delete for blobs (7 days)**

Leave everything else default.  
Click **Next: Encryption →**

### **2.6 — Encryption tab**

Keep defaults:

* **Encryption type:** Microsoft-managed keys
    
* **Infrastructure encryption:** Off
    

Click **Review + Create →**

## Step 3 — Create a Blob Container & Upload Files *(2025 Portal Layout)*

**Goal:**  
Create a private blob container, upload a test file, and verify access before adding SAS.

### 3.1 Open your new Storage Account

1. After deployment, click **Go to resource**.
    
2. In the left-side menu, under **Data storage**, click **Containers**.
    
3. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762111421805/aabbcaa5-64be-4b2b-a280-3b30cba579f9.png align="center")
    
    ### 3.2 Create a new Blob Container
    
    1. Click **\+ Add Container**.
        
    2. Fill in the fields:
        
    
    | Field | Value | Notes |
    | --- | --- | --- |
    | **Name** | `lab3-files` | lowercase, short |
    | **Public access level** | **Private (no anonymous access)** | keeps data secure |
    | **Advanced options** | default | — |
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762111768734/0aaa4626-23f7-4f28-a074-b021ba96242e.png align="center")
    
    ### 3.3 Upload a test file
    
    1. Select `lab3-files`.
        
    2. Click **Upload** → **Browse for files**.
        
    3. Pick a small file (e.g., `test.txt` or `photo.jpg`).
        
    4. Click **Upload**.
        
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762112022631/42f36e20-4122-4a04-aa3a-a270e8052a80.png align="center")
    
    ### 3.4 Verify access behavior
    
    1. Click your uploaded blob.
        
    2. Copy the **Blob URL**.
        
    3. Paste it into a new browser tab (not signed in).
        
        * You should see a **“PublicAccessNotPermitted”** message.
            
        * That’s expected—your container is private. Private containers reject anonymous requests; you need an auth token or SAS to access them.
            
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762112456245/22e6fd8f-820c-43c5-a0ef-96d770205d54.png align="center")
    
    **Result:**  
    You’ve successfully created a **private blob container** and uploaded data securely.  
    Next, you’ll generate a **Shared Access Signature (SAS)** to grant temporary access without making the container public.
    
    ## Step 4 — Step 4 — Generate a Shared Access Signature (SAS) in Azure *(2025 Portal UI)*
    
    **Goal:**  
    Grant temporary, permission-based access to your private blob data without exposing your storage account keys.
    
    ### **4.1 —** Open the Shared Access Signature settings
    
    1. In the Azure portal, open your storage account (mine is **storlab3mcnair**.)
        
    2. In the left-hand menu, scroll to **Security + networking → Shared access signature**.
        
        Do **not** select *Access keys* — those are full-control root credentials.
        
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762113202382/ea325bd2-87af-4c42-b7fe-38c2bfe2f154.png align="center")
    
    ### **4.2 Configure your SAS parameters**
    
    | Section | Setting | Description |
    | --- | --- | --- |
    | **Allowed services** | Blob | Only generate SAS for Blob Storage. |
    | **Allowed resource types** | Service, Container, Object | Grants access at every blob level. |
    | **Allowed permissions** | Read, List | Lets users read and list files (add Write/Delete only for testing). |
    | **Blob versioning permissions** | Enable deletion of versions | Safe default; controls old version cleanup. |
    | **Allowed blob index permissions** | Read/Write, Filter | Enables metadata queries (new 2025 feature). |
    | **Start date/time** | Today (e.g., 11/2/2025 2:41 PM) | Optional; blank = now. |
    | **End date/time** | \+ 1 hour (e.g., 11/2/2025 3:41 PM) | Sets expiry window. |
    | **Time zone** | (UTC-05:00) Eastern Time (US & Canada) | Adjust to your local zone. |
    | **Allowed IP addresses** | *(leave blank)* | Allows all IPs for this lab. |
    | **Allowed protocols** | **HTTPS only** | Secures all traffic in transit. |
    | **Preferred routing tier** | **Basic (default)** | Uses standard routing tier (Microsoft network routing is disabled until published). |
    | **Signing key** | **key1** | Key used to sign the token; key rotation will revoke SAS. |
    
    Click **Generate SAS and connection string.** Azure will display two outputs:
    
    * **SAS token:** the long string starting with `?sv=...`
        
    * **Blob service SAS URL:** your blob endpoint + token
        
    
    ### **4.3 Copy your SAS and test it**
    
    * Copy the **Blob service SAS URL**.
        
    * Paste it into a browser’s address bar.
        
        * You’ll see an XML-style listing error or empty page → That’s expected!
            
        * This SAS works at the *account* level; it isn’t pointing to your file yet.
            
    * You may want to keep this SAS token handy if you plan to use it later in Azure CLI or automation.
        
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762114464856/0ca90e41-f9fc-4c3f-98ff-1b075f92eb52.png align="center")

### 4.4 — Generate a SAS for a specific blob (to actually view the file)

1. Navigate to **Data storage → Containers → lab3-files**.
    
2. Click your uploaded blob (e.g., `photo.jpg`).
    
3. Click the link on the file and choose select **Generate SAS** or **Generate SAS token and URL**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762114771829/2debb2a0-4345-4701-9a2a-0948fa43bdfe.png align="center")

4. Click **Generate** → Copy the **Blob SAS URL** which should look similar to the example link below.
    
    [https://storlab3mcnair.blob.core.windows.net/lab3-files/photo.jpg?sv=](https://storlab3mcnair.blob.core.windows.net/lab3-files/photo.jpg?sv=)...
    
5. Open a **Private/Incognito** browser window and paste the URL.  
    Your image or file should open or download instantly.
    
    ### **4.5 – (Optional) Revoke the SAS**
    
    If you accidentally shared a SAS link or just want to demonstrate revocation, you can instantly invalidate it by rotating the key it was signed with.
    
    1. In the Azure Portal, go to **Security + networking → Access keys**
        
    2. Find the key used for your SAS (for example **key1**)
        
    3. Click **Rotate key** → then **Regenerate**
        
        Every SAS signed with that key immediately becomes invalid.  
        This is a powerful security feature for when credentials are exposed, or a link was shared publicly.
        
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762115137197/57ea004e-7e2b-4217-8e9e-362c421326db.png align="center")
    
    ## **Lab 3 Complete — Secure Azure Storage with SAS Tokens**
    
    You’ve now:
    
    * Built an Azure Storage Account from scratch
        
    * Created a private blob container
        
    * Uploaded and verified data access
        
    * Generated time-limited **SAS tokens** for secure sharing
        
    * Learned how to **revoke access instantly** by rotating keys
        
    
    These are core AZ-104 administrator skills — you can now explain and demonstrate how Azure protects data at rest and in transit.