Forem: Faith Aneke Adaora

Part 6: Resource Cleanup & Cost Control -Decommissioning Azure Infrastructure

Faith Aneke Adaora — Fri, 10 Apr 2026 19:18:54 +0000

Overview: 🧹 Clean Up (Avoid Unexpected Azure Costs)

Every good cloud engineer knows this:
If you don’t clean up, you keep paying and Azure resources continue running and billing until they are deleted.
So the final step in this guided project was to properly remove everything i have created.

This ensures:
•No unexpected charges
•No orphaned resources
•A clean environment

Procedure

🔓 Step 1: Remove Delete Locks

Earlier in the project,i protected the VM with a Delete lock.
Hence, before deleting anything that lock must be removed.
Here’s what i did:

✔ Removing the VM Lock

1.Navigated to Virtual Machines
2.Selected guided-project-vm
3.Opened Settings → Locks
4.Deleted the VM-delete-lock
5.Confirmed removal

Once the lock was removed,the VM became eligible for deletion.

✔ Removing the Resource Group Lock (If Applied)

Since i also applied a lock at the Resource Group level, i :
1.Navigated to Resource Groups
2.Selected the project resource group

3.Opened Settings → Locks
4.Deleted the Resource Group delete lock

5.Confirmed removal.

💡 Reminder

Always remove locks before attempting to delete resources.

🗑️ Step 2: Delete the Resource Group

One of the biggest advantages of using resource groups is that you can delete everything at once.
Where instead of deleting:
•The VM
•The VNet
•The Storage account
•The NSG
•The Subnets individually…

I simply:
1.Navigated to Resource Groups
2.Selected guided-project-rg

3.Chose Delete resource group

4.Entered the resource group name to confirm.
5.Confirmed removal

Within a few minutes, Azure removed all associated resources.
Clean. Efficient. Complete.

⚠️ Important Note: The NetworkWatcherRG Check

🔗 Azure sometimes automatically creates a resource group called ¥NetworkWatcherRG,if it already existed before the project, do NOT delete it.
🔗 If it was created during this guided project, then it should also be removed using the same deletion process.
🔗 Always verify before deleting shared system resource groups.

✅ Final Outcome’

At this point:
☑️ •All locks removed
☑️ •All project resources deleted
☑️ •No active billable services remaining
☑️ •Environment fully cleaned

This concludes the Azure Management Tasks Guided Project.

From:

✔ Environment setup
✔ Networking updates
✔ VM management
✔ Storage configuration
✔ Tags & governance
✔ Cleanup & cost control

This is a full administrative lifecycle, end to end.

Part 5 : 🏷️ Managing Tags & Resource Locks in Azure

Faith Aneke Adaora — Thu, 09 Apr 2026 20:24:41 +0000

🏷️ Overview

After configuring networking, scaling the VM, and managing storage,the final responsibility was governance.
This is because in real-world environments, deploying resources isn’t enough,you must:
• Organize them
• Monitor ownership
• Prevent accidental deletion

Hence, this phase focused on tags and resource locks which are two simple but powerful Azure management tools.

🎯 The Scenario

The Azure admin had two concerns:
1.Prevent accidental deletion of the VM running as an FTP server.
2.Quickly identify which department owns which resource.
This is where governance best practices come in.

🖥️ Managing Tags and Locks on the Virtual Machine

Step 1: 🏷️ Adding Tags to the VM

Tags allow you to categorize and group resources using key-value pairs.
• Where inside the guided-project-vm

•I added two tags:
Name Value
Department Customer Service
Purpose FTP Server

This makes it easy to:
•Filter resources by department
•Track cost allocation
•Identify resource purpose instantly
Tags are small but powerful for reporting and organization.

Step 2: 🔒 Adding a Resource Lock to Prevent Deletion

Next, I secured the VM.
Where inside Settings → Locks, I:
•Selected + Add

•Named the lock VM-delete-lock
•Chose Lock type: Delete
•Added a note explaining the reason

What this means

The VM can still be modified but it cannot be deleted unless the lock is removed first.
This is critical for production workloads where one accidental click won’t take down the FTP server.

Step 3: 🌐 Adding Tags to Network Resources

Governance shouldn’t stop at compute.
Next, I moved to the virtual network (guided-project-vnet)

and added:
Name Value
Department IT

Key Note💡 1:

Now both
•The VM
•The Virtual Network are clearly categorized and traceable and this improves:
•Visibility
•Cost tracking
•Operational clarity

Key Note💡 2:

Tags and Locks Matter because:
In large environments with hundreds of resources,
•Tags help with cost management and reporting.
•Locks prevent critical service disruptions.
•Governance reduces operational risk.

✅ Conclusion

Cloud administration is not just about building infrastructure.
It’s about managing it responsibly.

Therefore at this stage of the guided project, i have:
•Organized resources using tags.
•Protected critical infrastructure with delete locks.
•Improved visibility across departments.
•Strengthened governance practices.

This concludes the Azure Management Tasks guided project.
🔗 From networking…
🔗 To compute…
🔗 To storage…
🔗 To governance…
🔑 A full administrative lifecycle.

Part 4 : 📦 Managing Azure Storage - Containers, Access Tiers & Secure Access Control

Faith Aneke Adaora — Thu, 09 Apr 2026 19:34:33 +0000

Overview

With the virtual network and VM fully configured,the next responsibility shifted to storage management.

This part of the project focused on three critical things:

•Storing data efficiently

•Optimizing storage cost

•Controlling and revoking access securely

Here’s how I handled it 👇

Procedure 1: 📦 Creating a Storage Container & Uploading a Blob

Inside the existing storage account (guided-project-rg), I:
•Navigated to Data storage → Containers

•Created a new container called storage-container

•Uploaded a test image file

Once uploaded, Azure automatically assigned it the Hot access tier which is ideal for frequently accessed data.
But since this was just a test file, keeping it in Hot storage wasn’t cost-efficient.

Procedure 2:❄️ Changing the Access Tier (Cost Optimization)

To optimize cost:
•I selected the uploaded blob
•Clicked Change tier

•Switched it from Hot → Cold
•Saved the configuration

This reinforced an important cloud concept (storage tiers directly impacting cost),where not all data needs premium, high-frequency access.

Procedure 3: 📁 Creating a File Share

Beyond blob storage, I also needed to configure Azure Files for shared access scenarios.Inside the same storage account:
•I navigated to File shares

•Created a new share called file-share

•Enabled backup (for this lab)

•Uploaded a file into the share

Now the environment supported both:
•Blob storage (object-based)
•File shares (SMB-style shared storage)

Which are two different storage solutions and two different use cases.

Procedure 4: 🔐 Generating a Shared Access Signature (SAS Token)

Next came secure access control, where instead of giving full account access,i generated a Shared Access Signature (SAS) for the uploaded blob.

The Configuration included are :

•Signing method: Account key
•Signing key: Key 1
•Permissions: Read only
•Protocol: HTTPS only
•Custom expiration time

Once generated, i copied the Blob SAS URL into a new browser tab and it successfully displayed the image.

That link allowed temporary limited access.
This is powerful because:
•No need to share account keys
•Access is time-bound
•Permissions are granular

Procedure 5: 🔁 Rotating Access Keys (Revoking Access)

Granting access is only half the story,revoking access is just as important.Since the SAS token was signed using Key 1,i invalidated it by:
•Navigating to Security + networking → Access keys
•Selecting Rotate key for Key 1
•Confirming the regeneration

After the key rotation, I refreshed the SAS URL tab.

☑️ Result

Authentication failed,access successfully revoked and this demonstrated a critical Azure security concept.
Rotating storage account keys immediately invalidates all SAS tokens generated with that key.

📊 Final Outcome

By the end of this exercise, i had:
•Created and configured blob storage
•Optimized cost using access tiers
•Deployed Azure File Shares
•Generated secure, time-limited access
•Revoked access by rotating keys

🔑 Conclusion

This part of the guided project strengthened my understanding of:
•Storage architecture
•Access governance
•Cost management
•Real-world administrative control
Where cloud storage isn’t just about uploading files.It’s about managing lifecycle, security, and access responsibly.

🖥️ Part 3: Managing the Virtual Machine - Migration, Scaling & Cost Optimization

Faith Aneke Adaora — Thu, 09 Apr 2026 13:54:13 +0000

Overview

As the environment continued to evolve, networking was only one piece of the puzzle.

With the new ftpSubnet created and secured in Part 2, the next step was ensuring the virtual machine could properly support its workload.

This phase moved beyond networking and focused on VM management ,i.e aligning subnet placement, compute power,storage and cost optimization to ensure performance, security, and efficiency.

Here’s how I handled it 👇

🔄 Step 1: Migrating the VM to the New Subnet

Since the new subnet had stricter network rules (allowing only SSH – Port 22), the VM had to be placed inside it.

I navigated to:
•Virtual Machines
•Selected guided-project-vm

•Stopped the VM (Azure requires deallocation for subnet changes)

•Waited until it showed Stopped (deallocated)

Then:
•Opened Networking
•Selected the Network Interface / IP configuration

•Changed the subnet to ftpSubnet
•Clicked Apply

📝 Note

The VM was now operating inside the secured subnet environment
✅ Network segmentation
✅ Security alignment

📈 Step 2: Vertically Scaling the VM

With the VM transitioning into an FTP server role, it needed more processing power.

From the VM blade:
•I selected Size under Availability + Scale
•Chose a higher SKU (e.g., D2s_v5)
•Clicked Resize

📝 Note

✅ Vertical scaling allows us to increase CPU and memory without redeploying the VM.
✅ Now the machine could handle more concurrent connections and file transfers.
✅ Performance upgraded 🚀

💾 Step 3: Attaching a New Data Disk

An FTP server without sufficient storage is a problem waiting to happen.
So I attached a new managed disk:
•Opened Disks
•Selected Create and attach a new disk

•Named it ftp-data-disk
•Set size to 20 GB
•Applied changes

📝 Note

✅ The VM now had dedicated storage for uploads and file transfers.

⏱️ Step 4: Configuring Automatic Shutdown (Cost Control)

Running a VM 24/7 can quietly increase cloud costs.
Since the admin only needed the FTP server during working hours, I configured automatic shutdown:
•Navigated to Auto-shutdown
•Set scheduled shutdown to 7:15 PM (UTC)
•Saved configuration

📝 Note

✅ Now,the VM automatically powers down daily thereby reducing unnecessary compute charges.
✅ Cost optimization is also in action 💡

📊 Final Outcome

By the end of this task, I had:
✅•Migrated the VM to a secured subnet
✅•Increased its compute capacity
✅•Expanded its storage
✅•Implemented automated cost control

This exercise reinforced something important:
Azure management isn’t just about deploying resources,it’s about maintaining,optimizing, and securing them over time.

That’s what real cloud administration looks like.

🔧 Part 2: Azure Management Tasks - Hands-On Guided Project

Faith Aneke Adaora — Thu, 09 Apr 2026 12:35:07 +0000

📝 Overview

After deploying the environment in Part 1, the next phase focused on managing and governing Azure resources.

Cloud engineering doesn’t stop at deployment,proper administration ensures security, efficiency, and operational stability.

In this multi-part series (Part 2 – Part 6), I’ll be covering:

•Updating the Virtual Network

•Managing Virtual Machines

•Controlling Storage Access

•Managing Tags and Resource Locks

In this article (Part 2), I’ll focus specifically on Updating the Virtual Network, with an emphasis on improving network segmentation for tighter security control.

🌐 Updating the Virtual Network: Securing SFTP Traffic with a Dedicated Subnet

When managing cloud environments, security and structure go hand in hand.
As part of my Azure Management Tasks guided project, I needed to improve the network design by creating a dedicated subnet specifically for SFTP traffic.

Instead of allowing traffic to mix within the main subnet,I segmented the network and applied tighter security controls using a Network Security Group (NSG).

Here’s how I did it 👇

🎯 The Goal

•Create a new subnet inside an existing Virtual Network

•Restrict traffic using a Network Security Group

•Allow only secure SFTP (SSH – Port 22) traffic

•Associate the NSG with the subnet

This ensures better isolation, tighter access control, and improved security posture.

🛠️ Step 1: Creating a Dedicated Subnet

I logged into the Azure Portal and navigated to Virtual Networks.

Inside my existing VNet (guided-project-vnet), I:
•Opened Subnets
•Clicked + Subnet

•Named it ftpSubnet
•Left the remaining settings as default
•Selected Add

Just like that, the new subnet was created.
This subnet will only handle SFTP traffic, separating it from other workloads in the environment.

🔐 Step 2: Creating a Network Security Group

Next, I needed to control what traffic could reach this subnet.

From the Azure portal:
•I searched for Network Security Groups from the virtual network section
•Clicked + Create

•Selected my resource group (guided-project-rg)
•Named the NSG ftpNSG

•Reviewed and deployed it

Once deployment was complete, I opened the resource to configure inbound rules.

🚦 Step 3: Allowing Secure SFTP Traffic

Inside the NSG:
•I navigated to Inbound security rules
•Clicked + Add

•Changed the destination port from 8080 to 22
•Selected TCP
•Named the rule ftpInbound
•Clicked Add

Now, only SSH/SFTP traffic on Port 22 is allowed inbound.
No unnecessary open ports. No over-permissive rules.

🔗 Step 4: Associating the NSG with the Subnet

Finally, I needed to enforce the rule.
I went back to:
•Virtual Network

•Selected guided-project-vnet
•Opened Subnets
•Selected ftpSubnet

•Attached ftpNSG under the Security section
•Saved the configuration

Now the subnet is officially protected.

📊 The Outcome

By the end of this task:

•A new subnet was created for SFTP traffic

•A Network Security Group was deployed

•Port 22 was securely configured

•The NSG was successfully associated with the subnet

⚙️ Conclusion

The environment is now more segmented, controlled, and secure.
This is the kind of practical Azure management task that strengthens real-world cloud engineering skills not just theory, but actual infrastructure design decisions.

📌 Part 1: Azure Project Setup - Resource Group, VNet, VM & Storage

Faith Aneke Adaora — Thu, 09 Apr 2026 06:45:52 +0000

📝OVERVIEW

Before performing management tasks in Azure, it’s important to first build a structured cloud environment. In this part, I provisioned the foundational resources required for the project:
•Resource Group
•Virtual Network (VNet)
•Virtual Machine (VM)
•Storage Account

This setup ensures proper organization, secure networking, scalable compute, and reliable storage before moving into advanced management operations.

🔹 PROCEDURE

1️⃣ Create a Resource Group

Purpose:

This organize project resources for easy management and cleanup.

Steps:

1.In the Azure portal search bar, type Resource groups.

2.Select Resource groups under Services.
3.Select Create.

4.Enter guided-project-rg as the Resource group name or any other unique name of your choice .
5.Leave the default Region.
6.Select Review + create → Create.

7.Return to the Home page.

2️⃣ Create a Virtual Network

Purpose:

This Provide network infrastructure for the virtual machine.

Steps:

1.Search for Virtual networks in the Azure portal.

2.Select Create.

3.Confirm Subscription and Resource group (guided-project-rg).
4.Enter guided-project-vnet as the Virtual network name.
5.Select Review + create → Create.

6.Wait for deployment to complete.

7.Return to Home.

3️⃣ Create a Virtual Machine

Purpose:

This Deploys a Linux-based virtual machine for compute resources.

Steps:

1.Search for Virtual machines.

2.Select Create → Virtual machine.

3.Select guided-project-rg as the Resource group or the new Resource group of your choice .

4.Enter guided-project-vm as the VM name or any unique name of your choice .
5.Choose an Ubuntu image (e.g., Ubuntu Server 24.04 LTS - x64 Gen2).

6.Under Administrator account:
•Authentication type: Password
•Username: guided-project-admin
•Set and confirm password

7.Leave other settings as default.
8.Select Review + create → Create.
9.After deployment, return to Home.

4️⃣ Create a Storage Account

Purpose:

This Provides cloud storage for project data.

Steps:

1.Search for Storage accounts.

2.Select + Create.

3.Confirm Subscription and Resource group (guided-project-rg).
4.Enter a globally unique storage account name.
5.Select Review + create → Create.

6.Wait for deployment to complete.

7.Return to Home.

🔹 RESULTS

✔ Resource group created for organized management.
✔ Virtual network deployed with default subnet.
✔ Ubuntu virtual machine successfully provisioned.
✔ Storage account created for data storage.
✔ Environment ready for the next phase of the guided project.

Creating an Amazon EC2 Instance

Faith Aneke Adaora — Sat, 04 Apr 2026 01:57:29 +0000

💻 INTRODUCTION

Amazon Elastic Compute Cloud (EC2) is a web service that provides resizable compute capacity in the cloud.It also lets you launch virtual servers in the cloud.It provides flexible computing resources to run applications, host websites, or perform tasks without physical hardware.
This procedure shows how to create and access an EC2 instance.

🔒 IMPLEMENTATION STEPS

How to Create an EC2 Instance

🔗 Objective

To launch and configure a virtual server using Amazon Elastic Compute Cloud (EC2) for running applications in the cloud.

⚙️ Materials/Requirements

•AWS account with appropriate permissions
•Internet access
•SSH client (for Linux) or RDP (for Windows)
•Key pair for secure login

🛠️ Procedure

1.Login to AWS
•Open the AWS Management Console.
•Navigate or search for EC2 under the “Compute” section and select.

2.Launch an Instance
•Click “Launch Instance”.

•Give your instance a name for easy identification.

•Select an Amazon Machine Image (AMI) (e.g., Amazon Linux 2, Ubuntu, Windows Server).

3.Select an existing key pair or create a new one.

•If you are creating a key-pair ,give it a name (e.g., Name: Adaorakey)and create key.

4.Click “Launch Instance” to start your EC2 instance.

5.Connect to Your Instance
i.By clicking “connect to instance”(Browser SSH):

ii.Then click “Connect”, (browser-based SSH).

iii.A black terminal window will appear in your browser.

iv.Once connected, type:
“sudo su”

•This switches you to the root user, giving full administrative privileges.

V.You can now run commands and configure your instance as needed.

📝 Note:

For Windows instances, you would still use RDP via the Connect button and your key pair.

👩‍💻 Results/Expected Outcome

•A running EC2 instance visible in the EC2 dashboard.
•Ability to securely connect to the instance via SSH or RDP.
•Instance can host applications, web servers, or databases as configured.
•Billing begins only while the instance is running (stop when not in use to save cost).

📝 Notes/Best Practices

•Always use a secure key pair; never share your private key.
•Tag instances for easy identification in large environments.
•Stop or terminate instances when not needed to avoid unnecessary charges.

🔹Azure Compute Fundamentals: Creating and Managing a Virtual Machine

Faith Aneke Adaora — Sat, 04 Apr 2026 00:16:11 +0000

🖥️ Introduction

Creating a Virtual Machine (VM) in Azure allows organizations to deploy scalable,on-demand computing resources in the cloud without investing in physical hardware. Virtual machines can host applications,run development and test environments,or support enterprise workloads securely and efficiently.
In this guide, we will walk you through how to provision and configure an Azure Virtual Machine step-by-step.

👩‍💻Implementation Steps

🖥️ Create a Virtual Machine in Azure

🎯 Objective

Provision and configure an Azure Virtual Machine (VM) to host applications or perform testing in a secure cloud environment.

⚙️ Procedure

1️⃣ Create the Virtual Machine

1.Sign in to the Azure portal.
2i.Search for Virtual machines.

2ii.Select + Create.

2iii.Select Azure virtual machine.

3.Select or create a new Resource Group.

4.Provide a Virtual machine name.

5i.Choose a Region.
5ii.Select Availability.

5iii.Select Zone options

6i.Select Security type (Standard)

6ii.Select an Image (e.g., Windows Server 2022 or Ubuntu Server).

7.Choose a Size (e.g., B1s for testing).

8.Configure Administrator account (username & password or SSH key).

9.Under Inbound port rules, allow:
•RDP (3389) which enables secure remote desktop access for administrators.
•HTTP (80) which allows public web traffic to access the hosted application.

10.Enable licensing

11.Navigate to the Management tab:
•Disable Boot diagnostics (if not required).

11.Navigate to the Tags tab.
Add relevant tags such as:
•Department = Security
•Staff= Kelvin
•Purpose = Staff Records

📝 Note:

Tags help with organization, cost tracking, and resource management.

12i.Select Review + Create → Create.

12ii.Wait for deployment to complete, then select Go to resource.

2️⃣ Configure Public IP Timeout Settings

1.On the VM Overview page, select the Primary NIC.
2.Click on the associated Public IP address.

3.In the Settings section, select Configuration.
4.Increase the Idle timeout (minutes) value to your desired duration.
5.Select Save to apply the changes.

📝 Note:

This ensures longer remote sessions are not disconnected due to inactivity.

3️⃣ Connect to the Virtual Machine

For Windows VM (RDP):

1.Select Connect from the virtual machine overview page → RDP.

2.Download the RDP file, (on this page you can also reset password and check VM access).

3.Open it and enter your admin credentials.

For Linux VM (SSH):

1.Select Connect → SSH.
2.Use the provided SSH command in your terminal.

4️⃣ Verify the VM is Running

1.Check the VM Status — it should show Running.
2.Confirm you can log in successfully.
3.Optionally install a web server or test application.

🧪 Testing

•Confirm remote access works (RDP or SSH).
•Install a simple application (e.g., IIS or Nginx).
•Access the public IP in a browser (if HTTP port 80 is enabled).

✅ Results

•A successfully deployed Azure Virtual Machine
•Remote access configured
•Network connectivity verified
•VM ready for application deployment

💡 Key Takeaways

•Azure VMs provide scalable, on-demand compute resources.
•Choose the right OS, size, and storage for your workload.
•SSH keys or strong passwords improve authentication security.
•Costs accrue only while the VM is running—stop or deallocate when idle.

PROVIDE STORAGE FOR A NEW COMPANY APP

Faith Aneke Adaora — Fri, 03 Apr 2026 22:16:22 +0000

INTRODUCTION

Providing secure and scalable storage for a new company application is a foundational step in cloud architecture. A properly configured Azure Storage account ensures high availability, data protection, controlled access, and compliance with security best practices. In this exercise, we deploy and configure storage resources that support the application while maintaining strong security and governance standards.

IMPLEMENTATION STEPS

1.Create the Storage Account with Infrastructure Encryption

🎯 Objective:

Provision a secure storage account for a web application with infrastructure-level encryption enabled.

🛠️ Steps:

1i.Go to Storage accounts

1ii.→click on + Create.

2.Create a new Resource group.

3.Provide a globally unique Storage account name.

4.Navigate to the Encryption
5.Enable Infrastructure encryption (note: this cannot be changed after creation).
6.Select Review + Create → Create.

7.After deployment, select Go to resource.

2.Create and Configure a Managed Identity

2a.Create a User-Assigned Managed Identity

🎯 Objective:

Provide secure, passwordless authentication for the web app.

🛠️ Steps:

1i.Search for Managed identities

1ii. → Click +Create.

2.Select your resource group.

3.Provide a name for the manage identity.

4.Select Review + Create → Create.

2b.Assign Storage Permissions to the Managed Identity

🎯 Objective:

Grant the identity read-only access to blobs and containers.

🛠️ Steps:

1.Open the Storage account.

2.Go to Access Control (IAM).
3.Select Add role assignment.

4.Choose the role Storage Blob Data Reader.

5.Under Members, select Managed identity.

6.Choose User-assigned managed identity.
7.Select your managed identity.

8.Click Review + assign.

✅ Result:

The managed identity can securely read and list blobs without using storage keys.

3.Secure Access with Key Vault and Customer-Managed Key

3a.Assign Key Vault Administrator Role

🎯 Objective:

Grant your user account permissions to manage keys.

🛠️ Steps:

1i.Go to Resource group

1ii. Navigate to → Access Control (IAM).
2.Select Add role assignment.

3.Assign the Key Vault Administrator role to your user account.

4.Select Review + assign.

3b.Create a Key Vault

🎯 Objective:

Store encryption keys securely.

🛠️ Steps:

1i.Search for Key vaults.

1ii. Select → + Create.

2.Select your resource group.

3.Provide a globally unique name.
4.Ensure Azure role-based access control is selected.
5.Select Review + Create → Create.

6.After deployment, verify Soft-delete and Purge protection are enabled.

3c.Create a Customer-Managed Key

🎯 Objective:

Generate a key to control storage encryption.

🛠️ Steps:

1.In the key vault, select Keys → Generate/Import.

2.Provide a name.
3.Accept defaults.
4.Select Create.

4.Configure Storage Account to Use Customer-Managed Key

4a.Assign Crypto Role to Managed Identity

🎯 Objective:

Allow the managed identity to access the encryption key.

🛠️ Steps:

1i.Go to Resource group.

1ii. Select → Access Control (IAM).
2.Select Add role assignment.

3.Choose Key Vault Crypto Service Encryption User.

4.Select Managed identity → User-assigned.
5.Choose your managed identity.

6.Select Review + assign.

4b. Enable Customer-Managed Keys on Storage Account

🎯 Objective:

Configure storage to use the Key Vault key for encryption.

🛠️ Steps:

1.Open the Storage account.

2.Navigate to Security + networking → Encryption.

3.Select Customer-managed keys.

4.Choose your Key vault and key.

5.Set Identity type to User-assigned.
6.Select your managed identity.
7.Click Save.

✅ Result:

The storage account now uses a customer-managed key stored in Azure Key Vault.

5.Configure Time-Based Retention Policy (Immutable Storage)

🎯 Objective:

Prevent modification or deletion of files for a fixed retention period.

🛠️ Steps:

1.Go to Storage account → Containers.

2.Create a container named hold.

3.Upload a file.

4.Go to Settings → Access policy
5.Under Immutable blob storage, select + Add policy.
6.Select Time-based retention
7.Set retention period to 5 days.
8.Save changes.

9.Attempt to delete the file.
10.Confirm deletion fails due to policy.

✅ Result:

Files cannot be modified or deleted until the retention period expires.

6. Configure an Encryption Scope

🎯 Objective:

Create an encryption scope with infrastructure encryption enabled.

🛠️ Steps:

1.Go to Storage account → Security + networking → Encryption.
2.Select the Encryption scopes tab.
3.Click Add.

4.Provide a name.
5.Set:
•Encryption type: Microsoft-managed key
•Infrastructure encryption: Enable
6.Create the encryption scope.

7.Create a new container.

8.Under Advanced, select the encryption scope.

9.Apply it to all blobs in the container.

✅ Result:

Blobs within the container are encrypted using the defined encryption scope with infrastructure encryption enabled.

💡 Key Outcomes

✅ Storage account secured with infrastructure encryption.
✅ Managed identity configured for secure authentication.
✅ Customer-managed encryption key stored in Azure Key Vault.
✅ Immutable storage enforced with time-based retention.
✅ Encryption scope created for granular encryption control.

PROVIDE SHARED FILE STORAGE FOR COMPANY OFFICES

Faith Aneke Adaora — Wed, 01 Apr 2026 11:14:07 +0000

INTRODUCTION

Providing shared file storage for company offices is essential for collaboration, security, and operational efficiency. A centralized file storage solution ensures teams can securely access, manage, and share documents across departments while maintaining data protection standards. By implementing high availability, snapshots for recovery, and network access restrictions, organizations can protect critical business files, prevent accidental data loss, and control who can access sensitive information.

IMPLEMENTATION STEPS

1.Create a Storage Account for Azure Files

Objective:

Provision a premium storage account optimized for Azure File Shares with high availability.

Steps:

1.In the Azure portal, go to Storage accounts →

Click + Create.

2.Select Create new Resource group, provide a name, and click OK.

3.Provide a globally unique Storage account name.

4.Set:
•Performance: Premium

•Premium account type: File shares

•Redundancy: Zone-redundant storage (ZRS)

5.Select Review + Create, then Create.

6.After deployment, select Go to resource.

2.Create and Configure a File Share with Directory

2a.Create a File Share

Objective:

Create a shared file location for corporate office use.

Steps:

1.In the storage account, go to Data storage → File shares.

2.Select + File share.

3.Provide a Name.

4.Leave other settings as default.
5.Select Create.

2b.Create a Directory and Upload a File

Objective:

Organize files within the share and prepare for snapshot testing.

Steps:

1.Open the created file share.
2.Select + Add directory.

3.Name the directory finance.

4.Select Browse, then open the finance directory.

5.Upload a test file.

Result:

•The finance directory contains the uploaded file.

•File structure is ready for snapshot protection.

3.Configure and Test Snapshots

3a.Create a Snapshot

Objective:

Protect files from accidental deletion using file share snapshots.

Steps:

1.Open the file share.
2.Go to Operations → Snapshots.
3.Select + Add snapshot.

4.Optionally add a comment.
5.Select OK.

6ii.Open the snapshot and verify the finance directory.

6i.Confirm if file exist.

3b.Restore a File from Snapshot

Objective: Practice restoring deleted files using snapshots.

Steps:

1.Return to the live file share.
2.Navigate to the finance directory.
3.Select the uploaded file → Delete → Confirm.

4.Go to Snapshots.
5.Select the snapshot.

6.Locate the deleted file.
7.Select Restore.

8.Provide a new file name.
9.Confirm the restored file appears in the directory.

Result:

•File successfully restored from snapshot.
•This demonstrates recovery capability.

4.Restrict Storage Access to a Virtual Network

4a.Create a Virtual Network and Configure Service Endpoint

Objective:

Prepare a virtual network to restrict storage access.

Steps:

1.Search for and select Virtual networks

→ click + Create.

2.Select your resource group and provide a Virtual network name.
3.Accept defaults → Review + Create

→ Create.

4.After deployment, select Go to resource.

5.Go to Settings → Subnets.

6.Select the default subnet.

7.Under Service endpoints, select Microsoft.Storage.

8.Click Save.

4b.Restrict Storage Account to Selected Virtual Network

Objective:

Ensure the storage account is only accessible from the configured virtual network.

Steps:

1.Return to the storage account.
2.Go to Security + networking → Networking.

3.Change Public network access to:
•Enabled from selected virtual networks and IP addresses

4.Under Virtual networks, select Add existing virtual network.

5.Choose your virtual network and subnet.

6.Click Add, then Save.

Testing Network Restriction:

1.Open Storage browser.
2.Attempt to access the file share.
3.Confirm you receive the message:
•Not authorized to perform this operation

Result:

•Storage account is now restricted to the specified virtual network.
•Access from outside the VNet is blocked.

Key Outcomes

•Premium Azure File storage account deployed with Zone redundancy.
•File share and directory created for structured storage.
•Snapshots configured to protect against accidental deletion.
•Files successfully restored from snapshot.
•Storage account access restricted to a specific virtual network.

Provide private storage for internal company documents

Faith Aneke Adaora — Sun, 29 Mar 2026 13:21:47 +0000

The Importance of Private Storage in Organizations

Providing private storage for internal company documents in an organization is critical for security, compliance, and business continuity. Here’s why it matters:
1️⃣ Protection of Sensitive Information
2️⃣ Data Security
3️⃣ Access Control
4️⃣ Regulatory Compliance
5️⃣ Data Integrity
6️⃣ Business Continuity
7️⃣ Protecting Company Reputation

PROCEDURE

Create a Storage Account with High Availability

Objective:

Provision secure storage for internal company documents with geo-redundant replication to protect against regional outages.

Steps:

1.In the Azure portal, go to Storage accounts

2.select + Create.

3.Select an existing Resource group.

4.Set the storage account name to private (must be globally unique).

5.Select Review + Create, then Create.

6.After deployment, select Go to resource.

Configure Redundancy:

1.In the storage account, go to Data management → Redundancy.

2.Select Geo-redundant storage (GRS).

3.Review the primary and secondary region information.
4.Click Save.

2.Create a Private Container and Restrict Access

Objective:

Ensure corporate files are not publicly accessible.

Steps:

1.Go to Data storage → Containers.

2.Select + Container.

3.Name the container private and click create.

4.Set Public access level to Private (no anonymous access).

5.Select OK

Testing Access Restriction:

1.Select container created.

Click upload to upload a test file to the container.
Select browse for file to select which file to upload and click upload

4.Select the file and copy the URL from the Overview tab.

5.Paste the URL into a browser.
6.Confirm access is denied (authentication required).

3.Configure a Shared Access Signature (SAS)

Objective:

Provide temporary, restricted access to an external partner for 24 hours.

Steps:

1.Select the uploaded blob.
2.Navigate to the Generate SAS tab.

3.Under Permissions, select Read only.
4.Set the Start time to now and Expiry time to 24 hours.
5.Select Generate SAS token and URL.
6.Copy the Blob SAS URL.

Testing SAS Access:

1.Paste the SAS URL into a browser.
2.Confirm the file opens successfully.
3.Verify that access will expire after the specified time.

4.Implement Lifecycle Management (Move to Cool Tier)

Objective:

Reduce storage costs by automatically moving older blobs from the Hot tier to the Cool tier after 30 days.

Steps:

1.Return to the storage account.
2.Go to Data management → Lifecycle management.

3.Select Add rule.

4.Name the rule movetocool.
5.Apply the rule to All blobs in the storage account.

Under conditions:

•Select Last modified
•Set to More than 30 days ago

Under actions:

•Select Move to cool storage

6.Click Add to save the rule.

5.Configure Object Replication (Backup Public Website)

Objective:

Back up public website content to the private storage account for redundancy and protection.

Steps:

1a.In the private storage account, create a new container by clicking Add container

1b.Give it a name,example “backup” and select create.

2.Navigate to the publicwebsite storage account earlier or any other storage account already created that requires backup .

3.Go to Data management → Object replication.

4.Select Create replication rule and Configure:
•Source container: public
•Destination storage account: private
•Destination container: backup
5.Select Create to create the replication rule.

Testing Replication:

1.Upload a file to the public container.
2.Wait a few minutes.
3.Refresh the backup container in the private storage account.
4.Confirm the file appears automatically.

Key Outcomes

• ✅ Geo-redundant storage ensures high availability during regional outages.
• ✅ Private containers prevent anonymous access to sensitive documents.
• ✅ SAS provides secure, time-bound delegated access.
• ✅ Lifecycle management optimizes storage costs automatically.
• ✅ Object replication provides asynchronous backup between storage accounts.

Provide storage for the public website

Faith Aneke Adaora — Sun, 29 Mar 2026 06:24:16 +0000

CONFIGURATION STEPS :

Create a storage account with high availability:

Creating a storage account with high availability ensures that data is replicated across multiple locations or zones, providing resilience against hardware failures or outages and guaranteeing reliable access for applications and users.
Ensure the storage account has anonymous public access:

Enabling anonymous public access allows the storage account or container to serve files over the internet without authentication. This is essential for hosting publicly accessible content, such as website documents, while ensuring ease of access for all users.
Create a blob storage container for the website documents:

Creating a blob storage container organizes and stores the website’s documents and assets within the storage account, providing a dedicated space for files such as HTML, CSS, JavaScript, and media content.
Enable soft delete so files can be easily restored:

Enabling soft delete ensures that deleted files are retained for a configurable period, allowing accidental deletions to be recovered easily and enhancing data protection.
Enable blob versioning:

Enabling blob versioning automatically maintains previous versions of files, allowing changes to be tracked and older versions to be restored if needed, thereby improving data management and recovery.

EXERCISE INSTRUCTIONS

1.Provisioning the Storage Account

Objective:

Create a storage account that supports high availability and public website hosting.

Steps:

In the portal, search for and select Storage accounts.

2. Select + Create.

3. For Resource group, select New, provide a name, and select OK.

4. Set the Storage account name to publicwebsite (ensure uniqueness by adding an identifier).

5. Accept default settings for all other options.
6. Select Review + Create, then Create.

7. Wait for the deployment to complete, then select Go to resource.

2.Enable High Availability

Objective:

Ensure the storage account remains accessible during regional outages.

Steps:

In the storage account, navigate to the Data management → Redundancy blade.

2. Select Read-access Geo-redundant storage (RA-GRS).

3. Review the primary and secondary location information.

Note: RA-GRS replicates data to a secondary region, providing read access if the primary region becomes unavailable.

3.Enable Anonymous Public Access

Objective:

Allow website content to be accessed by users without authentication.

Steps:

1.In the storage account, go to Settings → Configuration.

2.Enable the Allow blob anonymous access setting.

3.Save your changes.

Use case: This setting is essential for serving website files such as HTML, CSS, images, and documents to all users.

4.Create a Blob Storage Container with Anonymous Read Access

Objective:

Organize website assets (images, documents) in a dedicated container and allow public access without requiring authentication.

Steps:

1.In your storage account, go to Data storage → Containers.

2.Select + Container.

3.Set the container name to public and select Create.

4.Configure anonymous read access:

Open the newly created container.

On the Overview blade, select Change access level.

Set Public access level to Blob (anonymous read access for blobs only).
Select OK.

5.Testing Uploads and Access:

Upload a test file to the public container by selecting the public container created

Select Upload, browse to a file (image or text), and select Upload.

Refresh the container and confirm the file is uploaded.

6.Test public access:

Select the uploaded file, copy the URL from the Overview tab, and open it in a browser.

Images should display directly; other file types may be downloaded.

5.Configure Soft Delete

Objective:

Protect against accidental deletions by retaining deleted files for a specified period.

Steps:

1.In the storage account, go to Overview → Properties → Blob service → Blob soft delete.

2.Enable Soft delete for blobs and set Keep deleted blobs for 21 days.

3.Save your changes.

4.Testing Soft Delete:

Navigate to your container and delete a file. Confirm deletion.

Toggle Show deleted blobs on the container Overview page.
Select the deleted file, click the ellipsis, and choose Undelete.

Refresh the container to confirm the file has been restored.

6.Configure Blob Versioning

Objective:

Maintain historical versions of files to track changes and allow recovery.

Steps:

1.In the storage account, navigate to Overview → Properties → Blob service → Versioning.

2.Enable Versioning for blobs and configure options to keep or delete previous versions as needed.
3.Save your changes.

4.Testing Versioning:

Upload a new version of an existing file in the container (overwrite the previous file).
Previous versions are available under the Show deleted blobs page.
Experiment with restoring older versions to verify versioning functionality.

✅ Key Benefits of These Configurations
• Anonymous Public Access: Serves website files without authentication.
• Soft Delete: Protects against accidental file deletions.
• Blob Versioning: Tracks changes and enables recovery of previous file versions.
• High Availability: Ensures data remains accessible even during outages or hardware failures.