# AZ-104 Lab 4 — Week 4: Connect an Azure VM to Azure Storage Using Managed Identity (2025 Portal UI)

## Series: Week 4 of the AZ-104 Learning Labs on [jmcnairtech.com](http://jmcnairtech.com)

**Goal:** Learn how to connect an Azure Virtual Machine to Azure Storage *securely* using **Managed Identities** and **RBAC** — no access keys, no SAS tokens, no secrets.

This is an important task as a real-world Azure Administrator skill and a key part of the **AZ-104 exam**.

## **What You’ll Learn This Week**

* create a new Azure Storage Account using the 2025 portal interface
    
* create a private Blob container and upload a file
    
* deploy a Virtual Machine using the modern VM creation UI
    
* enable a System-Assigned Managed Identity on a VM
    
* assign RBAC permissions such as Storage Blob Data Reader
    
* access Blob Storage from inside the VM using identity-based authentication
    
* download blobs inside the VM with Azure CLI or PowerShell using
    

## **Prerequisites**

* Active Azure subscription
    
* Basic familiarity with the Azure Portal
    
* We’ll use **East US** as the region (you can choose your own)
    

## **Lab Scenario (Real Azure Admin Task)**

You are an Azure Administrator responsible for supporting a line-of-business application that processes files uploaded by employees.  
These files—images, PDFs, and documents—are stored in an Azure Blob Storage container.

Your application server runs on a Virtual Machine, and the VM needs to:

* download files from the Blob container
    
* process or analyze those files (for example: resize images, scan PDFs, extract text, run scripts, etc.)
    
* upload results or processed outputs back to storage
    

Instead of using storage account keys or SAS tokens (which are hard to manage and insecure), you’ll give the VM a **System-Assigned Managed Identity** and assign it the **Storage Blob Data Reader** role.

This allows the VM to access Blob Storage securely using Azure AD authentication — **no keys, no secrets, no passwords.**

### **Step 1 — Create a Resource Group**

Resource groups help you organize all related resources so you can clean up easily at the end.

## **1.1**

In the Azure Portal search bar, type **Resource groups** and select it.

## **1.2**

Click **\+ Create**.

### **1.3 Fill in:**

* **Subscription:** your default
    
* **Resource group name:** `rg-week4-lab`
    
* **Region:** East US
    

Click **Review + create → Create**.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762707276140/aeda2871-9a73-49e2-a49c-0cdc7dd864bd.png align="center")

## **Step 2 — Create a New Azure Storage Account**

This storage account will hold the files that your Virtual Machine needs to access securely using its Managed Identity.

### **2.1 — Navigate to the Storage Center**

1. In the Azure Portal search bar, type **Storage accounts**.
    
2. Select **Storage accounts** from the results.
    

You will now see the new **Storage Center** (with tiles for different storage types).

### **2.2 — Choose the Storage Type (Required in 2025 UI)**

* From the Storage Center categories, select **Object storage**.
    
* Then select **Blob Storage**.
    
* The **Create** button will now appear.
    
* Click **\+ Create** to begin the Storage Account wizard.
    

### **2.3 — Basics tab**

### **Project details**

* Subscription: your active subscription
    
* Resource group: **rg-week4-lab**
    

### **Instance details**

* Storage account name: **storweek4mcnair**
    
* Region: **East US**
    
* Preferred storage type: **Azure Blob Storage**
    
* Performance: **Standard**
    
* Redundancy: **LRS (Locally Redundant Storage)**
    

Click **Next: Advanced →**

### **2.4 — Advanced tab**

* Minimum TLS version: **TLS 1.2**
    
* Enable hierarchical namespace: **Off**
    
* SFTP, NFS, and large file shares: **Off**
    
* All other settings: leave defaults
    

Click **Next: Networking →**

### **2.5 — Networking tab (Updated for 2025 Portal)**

### **Public network access**

* Enable: **Yes**
    

### **Public access scope**

* Enable from all networks
    

### **Routing preference**

* Microsoft network routing (default)
    

### **Private endpoints**

* Leave empty
    

Click **Next: Data protection →**

### **2.6 — Data protection tab**

* Enable soft delete for blobs: **7 days**
    
* Leave all other options at default
    

Click **Next: Encryption →**

### **2.7 — Encryption tab**

* Encryption type: Microsoft-managed keys
    
* Enable support for customer-managed keys: Blobs and files only
    
* Enable infrastructure encryption: Unchecked
    

Click **Review + Create → Create**

After deployment completes, your new Storage Account is ready to use.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762709389847/32d02062-5b21-42d3-ab1f-c23d512b0b29.png align="center")

## **Step 3 — Create a Blob Container & Upload a Test File (2025 UI)**

**In this step, you will create a secure container inside your Storage Account and upload a sample file that your VM will access later using its Managed Identity.**

### **3.1 — Open your new Storage Account**

* After deployment finishes, click **Go to resource**  
    *or search for your storage account name:*
    
    * `storweek4mcnair`
        
* In the left-hand menu, scroll to the **Data storage** section.
    
* Click **Containers**
    

This opens the Blob Containers page.

### **3.2 — Create a new Blob Container**

* Click **\+ Add Container** (top-left)
    
* Fill in the container details:
    
    * **Name:** `lab4-files`
        
        * lowercase
            
        * no spaces
            
    * **Public access level:** **Private (no anonymous access)**
        
        * This ensures files can only be accessed through RBAC, identity, or SAS.
            
* Click **Create**
    

### **3.3 — Upload a test file**

Inside your container:

* Click **lab4-files**
    
* Click **Upload** at the top
    
* Browse your computer for a small sample file, for example:
    
    * `test.txt`
        
    * `document.pdf`
        
* Click **Upload**
    

The file will now appear inside your container.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762709782013/5743cf9f-174c-4a94-987e-05169ba24e15.png align="center")

### **3.4 — Confirm the container is private**

You can verify private access by:

* Clicking the file you uploaded
    
* Copying the **Blob URL**
    
* Pasting it into a new browser tab
    

You should see: “Public access not permitted”

This is expected — the container is private and cannot be accessed without identity-based authentication or a SAS token.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762710092227/24006918-4797-4209-a075-35cf5c10c4cf.png align="center")

## **Step 4 — Create a Virtual Machine with a System-Assigned Managed Identity**

This VM will act as your application or processing server.  
Later in the lab, it will authenticate to Blob Storage *without* keys or SAS tokens — using Azure AD and RBAC instead.

### **4.1 — Open the VM creation blade**

* In the Azure Portal search bar, type **Virtual machines**
    
* Click **Virtual machines**
    
* Click **\+ Create → Azure virtual machine**
    

This opens the modern VM creation wizard.

### **4.2 — Basics Tab**

Fill out the fields as follows:

### **Instance details**

* **Virtual machine name:** `vm-week4-client`
    
* **Region:** `(US) East US`
    
* **Availability options:**
    
    * Select **No infrastructure redundancy required**  
        *(This avoids zone restrictions and keeps the lab simple.)*
        

### **Security type**

* **Standard**  
    *(Trusted Launch is not needed for this scenario.)*
    

### **Image**

* Click **See all images**
    
* Search for and select:  
    **Windows Server 2025 Datacenter: Azure Edition (Gen 2)**  
    *(Easier for RDP and PowerShell testing.)*
    

### **VM architecture**

* **x64**
    

### **Size**

* Click **See all sizes**
    
* Choose:
    
    * **Standard\_B2s** (recommended), or
        
    * **Standard\_B1s** (cheapest option)
        

### **Administrator account**

* **Username:** `azureuser`
    
* **Password:** a strong password you will remember
    

### **Inbound port rules**

* **Public inbound ports:** Allow selected ports
    
* **Select inbound ports:** RDP (3389)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762710679668/5d1e444e-1648-4503-8337-0d55e6828a15.png align="center")

Click **Next: Disks**

### **4.3 — Disks Tab**

* **OS disk type:** Standard SSD
    
* Leave all other settings at default
    

Click **Next: Networking**

### **4.4 — Networking Tab**

* **Virtual network:** auto-created default VNet
    
* **Subnet:** default
    
* **Public IP:** Enabled
    
* **NIC network security group:** Basic
    
* **Inbound port:** RDP (3389)
    

Click **Next: Management**

### **4.5 — Management Tab (Enable Managed Identity)**

Scroll to the **Identity** section:

* **System-assigned managed identity:** **On**
    

**This identity allows the VM to authenticate to Azure Storage securely later in the lab.**

**Leave all other settings at default:**

Click **Review + Create**  
Then click **Create**

Deployment will complete in 1–3 minutes.

**Your VM is now deployed and has a system-assigned managed identity enabled.**  
This identity is what will securely access the Blob Storage container in the next steps.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762711408421/db1ea886-893f-4a2a-8326-ab016b5f2ba3.png align="center")

## **Step 5 — Assign the VM Access to Blob Storage (RBAC)**

Now that your VM has a **System-Assigned Managed Identity**, you must grant that identity the correct permissions so it can access your Blob Storage.

Azure uses **Role-Based Access Control (RBAC)** for this.  
You will assign the VM’s identity the **Storage Blob Data Reader** role.

### **5.1 — Open Your Storage Account**

* In the Azure Portal search bar, type **Storage accounts**
    
* Select your storage account: **storweek4mcnair**
    
* In the left-hand menu, click **Access control (IAM)**
    

### **5.2 — Add a Role Assignment**

* Click **\+ Add → Add role assignment**
    
* Under **Role**, search for:
    
    * **Storage Blob Data Reader**
        
* Select the role and click **Next**
    

*This role allows the VM to read blobs but not upload or delete.*

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762711650881/a743de17-6013-4282-87d4-217d44fc5f03.png align="center")

### **5.3 — Assign Role to the VM’s Managed Identity**

Under **Assign access to**, choose **Managed identity**

* Click **\+ Select members**
    
* In the identity browser:
    
    * Select **Virtual machine**
        
    * Choose **vm-week4-client**
        
* Click **Select**
    
* Click **Review + assign**
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762711757996/429943cf-78de-44f4-9f21-a36ba82d830d.png align="center")
    
    ### **5.4 — Confirm Role Assignment**
    
    After the assignment completes:
    
    * You should now see **Storage Blob Data Reader**
        
    * Assigned to: **vm-week4-client (Managed Identity)**
        
    * Scope: **This storage account**
        
    
    This means the VM can now authenticate to Blob Storage using its Azure AD identity.
    
    If you want your VM to also **upload files**, you can assign **Storage Blob Data Contributor**
    
    But for this lab, **Reader** is enough.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762712009816/8c0b05d1-2993-4e8e-9ae2-fbb112101caa.png align="center")

## **Step 6 — Connect to the VM and Access Blob Storage Using PowerShell (Data-Plane, Managed Identity)**

In this step, you’ll RDP into the VM, sign in with its **Managed Identity**, create a **data-plane storage context**, list containers, and download a blob — all **without keys or SAS**.

### **6.1 — Connect to the Virtual Machine (RDP)**

* In the Azure Portal, go to **Virtual machines**
    
* Click **vm-week4-client**
    
* Click **Connect → RDP**
    
* Click **Download RDP file**
    
* Open the RDP file
    
* Log in using:
    
    * Username: `azureuser`
        
    * Password: the one you created
        

Once logged in, wait a moment for Windows Server to load.

### **6.2 — Open PowerShell on the VM**

* Click **Start**
    
* Search for **PowerShell**
    
* Right-click → **Run as administrator**
    

This ensures all commands run properly.

### **6.3 — Install the Az PowerShell Module (if needed)**

If `Connect-AzAccount` is not recognized, install the module:

`Install-Module -Name Az -Repository PSGallery -Force`

`Import-Module Az`

### 6.4 — Authenticate Using the VM’s Managed Identity

Run this inside PowerShell: `Connect-AzAccount -Identity`

You should see output similar to:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762713869033/51ec01e4-eaa9-4f0a-b1c1-a2b9b27eed3f.png align="center")

This means the VM is now authenticated to Azure using its Managed Identity.

No passwords.  
No keys.  
No SAS tokens.  
Modern Azure Admin technique.

### **6.5 — Build a *data-plane* Storage Context (no management rights needed)**

```powershell
# Replace with your storage account name
$accountName = "storweek4mcnair"

# Create a context that uses the current connected identity
$ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount
```

This avoids management-plane APIs (like `Get-AzStorageAccount`) and uses only the **blob data plane**, which your **Storage Blob Data Reader** role allows.

### **6.6 — List containers (data plane)**

`Get-AzStorageContainer -Context $ctx`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762714890813/516571ea-ccc1-4a30-8c64-9b1d14ccdbf0.png align="center")

---

### **6.7 — Download a blob (data plane)**

**Replace the blob name with the file you uploaded earlier** (e.g., `test.txt`, `photo.jpg`)

`$container = "lab4-files"`

`$blobName = "<yourfilename>"`

`$destPath = "C:\Users\azuser\Desktop\$blobName"`

`Get-AzStorageBlobContent -Container $container -Blob $blobName -Destination $destPath -Context $ctx`

### **6.8 — Verify the Downloaded File on the VM**

Now that you downloaded the blob onto your VM, let’s confirm it’s there and readable.

`Get-Item "C:\Users\azuser\Desktop$blobName"`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762716468336/1820d055-5550-47b4-99bb-5b2ac3e98397.png align="center")

At this point, you have fully validated that:

* The VM authenticated using **Managed Identity**
    
* RBAC allowed access
    
* Your **Storage Blob Data Reader** assignment is working
    
* The VM downloaded the file through Azure AD (not keys or SAS)
    

## **Week 4 Summary — Azure VM to Blob Storage Access with Managed Identity**

In this lab, you built a complete, real-world Azure scenario: a Virtual Machine securely accessing a Blob Storage container using a **System-Assigned Managed Identity**.

This is the modern, recommended way to authenticate Azure workloads — without keys, without SAS tokens, and without storing any secrets inside scripts.

By the end of the lab, you successfully:

* created a new Storage Account using the updated 2025 Azure Portal
    
* created a private Blob container and uploaded a test file
    
* deployed a Windows Server VM with a System-Assigned Managed Identity
    
* connected to the VM via RDP and installed the Az PowerShell modules
    
* authenticated the VM using `Connect-AzAccount -Identity`
    
* built a data-plane storage context using the VM’s identity
    
* listed containers and downloaded a blob directly to the VM desktop
    
* accessed everything through Azure AD and RBAC only
    

**This lab mirrors exactly how Azure administrators secure compute-to-storage communication in real enterprise environments. Please stay tuned for more labs if you’re interested in Azure or currently studying for the AZ-104 certification from Microsoft.**