Storage Accounts

Azure Storage Accounts provide scalable, durable cloud storage for blobs, queues, tables, and file shares. A single storage account can host multiple storage services and acts as the top-level namespace for data access, billing, and access control.

Account Types

• Standard general-purpose v2 (StorageV2) — The recommended default; supports all storage services and tiers
• Premium block blobs — Low-latency blob storage backed by SSDs; suited for high-transaction workloads
• Premium file shares — SSD-backed Azure Files; required for NFS shares and latency-sensitive SMB workloads
• Premium page blobs — SSD-backed page blob storage; used primarily for Azure VM unmanaged disks

For most workloads, use Standard general-purpose v2.

Storage Services

• Blob Storage — Object storage for unstructured data (documents, images, backups, logs). Supports block blobs, append blobs, and page blobs
• Azure Files — Fully managed SMB and NFS file shares mountable by Windows, Linux, and macOS
• Queue Storage — Simple message queuing for decoupling application components; messages up to 64 KB
• Table Storage — NoSQL key-attribute store for structured, schema-less data (consider Cosmos DB for new workloads)

Redundancy Options

• LRS (Locally Redundant Storage) — 3 synchronous copies within a single datacenter; lowest cost
• ZRS (Zone-Redundant Storage) — 3 synchronous copies across availability zones in one region
• GRS (Geo-Redundant Storage) — LRS in primary region plus async replication to a paired region
• GZRS (Geo-Zone-Redundant Storage) — ZRS in primary region plus async replication to a paired region; highest durability
• RA-GRS / RA-GZRS — GRS or GZRS with read access to the secondary region

For production workloads, prefer ZRS or GZRS. Use RA-GZRS where secondary read access is required for DR.

Common Built-in RBAC Roles

Blob Access Tiers

Access tiers apply to block blobs in general-purpose v2 and blob storage accounts:

• Hot — Frequently accessed data; higher storage cost, lower access cost
• Cool — Infrequently accessed data stored for at least 30 days; lower storage cost, higher access cost
• Cold — Rarely accessed data stored for at least 90 days; lower storage cost than Cool, higher access cost
• Archive — Offline tier for rarely accessed data stored for at least 180 days; lowest storage cost, highest retrieval cost and latency (rehydration required)

Usage

# Create a storage account
New-AzStorageAccount `
  -ResourceGroupName "rg-myapp-prod-uks-01" `
  -Name "stmyappprodukss01" `
  -Location "uksouth" `
  -SkuName "Standard_ZRS" `
  -Kind "StorageV2" `
  -EnableHttpsTrafficOnly $true `
  -MinimumTlsVersion "TLS1_2" `
  -AllowBlobPublicAccess $false
 
# Get storage account context
$ctx = (Get-AzStorageAccount -ResourceGroupName "rg-myapp-prod-uks-01" -Name "stmyappprodukss01").Context
 
# Create a blob container
New-AzStorageContainer -Name "mycontainer" -Context $ctx -Permission Off
 
# Upload a blob
Set-AzStorageBlobContent -Container "mycontainer" -File ".\data.json" -Blob "data.json" -Context $ctx
 
# Assign Blob Data Contributor to a managed identity
New-AzRoleAssignment `
  -ObjectId <identity-object-id> `
  -RoleDefinitionName "Storage Blob Data Contributor" `
  -Scope "/subscriptions/<sub-id>/resourceGroups/rg-myapp-prod-uks-01/providers/Microsoft.Storage/storageAccounts/stmyappprodukss01"

# Create a storage account
az storage account create \
  --resource-group "rg-myapp-prod-uks-01" \
  --name "stmyappprodukss01" \
  --location "uksouth" \
  --sku "Standard_ZRS" \
  --kind "StorageV2" \
  --https-only true \
  --min-tls-version "TLS1_2" \
  --allow-blob-public-access false
 
# Create a blob container
az storage container create \
  --account-name "stmyappprodukss01" \
  --name "mycontainer" \
  --auth-mode login
 
# Upload a blob
az storage blob upload \
  --account-name "stmyappprodukss01" \
  --container-name "mycontainer" \
  --name "data.json" \
  --file "./data.json" \
  --auth-mode login
 
# Assign Blob Data Contributor to a managed identity
az role assignment create \
  --assignee <identity-object-id> \
  --role "Storage Blob Data Contributor" \
  --scope "/subscriptions/<sub-id>/resourceGroups/rg-myapp-prod-uks-01/providers/Microsoft.Storage/storageAccounts/stmyappprodukss01"

Best Practices

• Disable public blob access on all storage accounts unless explicitly required; grant access via RBAC or SAS tokens instead
• Enforce HTTPS-only traffic and a minimum TLS version of TLS 1.2
• Use managed identities and RBAC for application access—avoid shared access keys where possible; consider disabling key access entirely
• Prefer ZRS or GZRS over LRS for production accounts to protect against zone failures
• Enable soft delete for blobs, containers, and file shares to protect against accidental deletion
• Enable versioning for blob containers that hold critical or frequently overwritten data
• Use lifecycle management policies to automatically transition blobs to cooler tiers or delete them after a defined retention period
• Restrict network access using firewall rules or private endpoints; avoid leaving storage accounts open to all public networks
• Enable diagnostic logging and route to a Log Analytics workspace for audit trails
• Follow the naming convention: st<app><environment><location><instance> (e.g. stmyappprodukss01); names must be 3–24 lowercase alphanumeric characters with no hyphens