Overview
With the virtual network and VM fully configured,the next responsibility shifted to storage management.
This part of the project focused on three critical things:
•Storing data efficiently
•Optimizing storage cost
•Controlling and revoking access securely
Here’s how I handled it 👇
Procedure 1: 📦 Creating a Storage Container & Uploading a Blob
Inside the existing storage account (guided-project-rg), I:
•Navigated to Data storage → Containers
•Created a new container called storage-container
•Uploaded a test image file
Once uploaded, Azure automatically assigned it the Hot access tier which is ideal for frequently accessed data.
But since this was just a test file, keeping it in Hot storage wasn’t cost-efficient.
Procedure 2:❄️ Changing the Access Tier (Cost Optimization)
To optimize cost:
•I selected the uploaded blob
•Clicked Change tier
•Switched it from Hot → Cold
•Saved the configuration
This reinforced an important cloud concept (storage tiers directly impacting cost),where not all data needs premium, high-frequency access.
Procedure 3: 📁 Creating a File Share
Beyond blob storage, I also needed to configure Azure Files for shared access scenarios.Inside the same storage account:
•I navigated to File shares
•Created a new share called file-share
•Enabled backup (for this lab)
•Uploaded a file into the share
Now the environment supported both:
•Blob storage (object-based)
•File shares (SMB-style shared storage)
Which are two different storage solutions and two different use cases.
Procedure 4: 🔐 Generating a Shared Access Signature (SAS Token)
Next came secure access control, where instead of giving full account access,i generated a Shared Access Signature (SAS) for the uploaded blob.
The Configuration included are :
•Signing method: Account key
•Signing key: Key 1
•Permissions: Read only
•Protocol: HTTPS only
•Custom expiration time
Once generated, i copied the Blob SAS URL into a new browser tab and it successfully displayed the image.
That link allowed temporary limited access.
This is powerful because:
•No need to share account keys
•Access is time-bound
•Permissions are granular
Procedure 5: 🔁 Rotating Access Keys (Revoking Access)
Granting access is only half the story,revoking access is just as important.Since the SAS token was signed using Key 1,i invalidated it by:
•Navigating to Security + networking → Access keys
•Selecting Rotate key for Key 1
•Confirming the regeneration
After the key rotation, I refreshed the SAS URL tab.
☑️ Result
- Authentication failed,access successfully revoked and this demonstrated a critical Azure security concept.
- Rotating storage account keys immediately invalidates all SAS tokens generated with that key.
📊 Final Outcome
By the end of this exercise, i had:
•Created and configured blob storage
•Optimized cost using access tiers
•Deployed Azure File Shares
•Generated secure, time-limited access
•Revoked access by rotating keys
🔑 Conclusion
This part of the guided project strengthened my understanding of:
•Storage architecture
•Access governance
•Cost management
•Real-world administrative control
Where cloud storage isn’t just about uploading files.It’s about managing lifecycle, security, and access responsibly.