Forem: Fredrick Chukwuma

Update and Maintain Resources in Azure - Manage tags and locks

Fredrick Chukwuma — Sat, 14 Mar 2026 09:15:08 +0000

If you’ve completed the previous exercises, you’ve managed to add a subnet to a virtual network, made changes to a virtual machine, and worked with an Azure storage account. The final set of tasks for this guided project focus around working with tags and resource locks to help manage and monitor your environment. During this exercise, you’ll go back into each of the areas you’ve already worked to add tags, locks, or a combination of both.

Scenario

The Azure admin hopes that you can wrap a few things up to help with monitoring and protecting resources. They want to know that someone can’t accidentally get rid of the virtual machine that’s running as an FTP server, and they want a quick way to see which department is using resources and the resource’s purpose.

Manage tags and locks on VMs

Adding tags to resources is a quick way to be able to group and organize resources. Tags can be added at different levels, giving you the ability to organize and group resources at a level that makes sense for you.

Add tags to a virtual machine
You’ll start by adding a pair of tags to the virtual machine. One tag will be to identify the purpose of the virtual machine and the other will be to indicate the department the machine supports.

from the Azure portal, search for and select virtual machines under services.
Select the guided-project-vm virtual machine.

From the menu pane, select Tags.
On one line for Name, enter Department, and for Value, enter Customer Service
On the next line, for Name, enter Purpose, and for Value, enter FTP Server.
Select Apply.

Add a resource lock to a VM

While on the Virtual Machine page, expand the Settings submenu and select Locks.

Select + Add.

For the name, enter VM-delete-lock.
For the Lock type, select Delete.
You may enter a note to help remind you why you created the lock.
Select OK.

That’s it. Now the VM is protected from deletion and has tags assigned to help track use. Time to move on to the network.

Add tags to network resources

From the Virtual Networks page, select the guided-project-vnet network.

From the menu pane, select Tags.

Note: Notice that now you can select an existing tag to apply or add a new tag. You can also select just the name or value and create something new in the other field.

For the Name, select Department.
For the Value, enter IT.
Select Apply.

Now both the VNet and VM are organized.

Conclusion
Managing metadata and protection mechanisms in the Microsoft Azure Portal is an important part of maintaining cloud resources efficiently. Tags are key-value pairs applied to resources such as virtual machines and network components to improve organization, cost tracking, automation, and governance. By tagging Virtual Machines (VMs) and network resources such as virtual networks, subnets, and network security groups, administrators can categorize resources by environment, department, owner, or project. This makes it easier to filter resources, generate cost reports, and enforce operational policies across the environment.
In addition to tagging, resource locks provide a protection layer for critical virtual machines. Locks can prevent accidental deletion or modification of important resources by applying either Delete or Read-only restrictions. When properly used together, tags improve visibility and management while locks enhance resource protection, helping administrators maintain a well-organized, secure, and controlled Azure environment.

Update and Maintain Resources in Azure - Control Storage Access

Fredrick Chukwuma — Fri, 13 Mar 2026 19:32:24 +0000

This part entails several tasks related to managing a storage account and components of the storage account.
Note: This is a continuation of the project in the previous article I published.

Scenario

The Azure admin wants you to get more familiar with storage accounts, containers, and file shares. They anticipate needing to share an increasing number of files and need someone who is skilled in using these services. They’ve given you a task of creating a storage container, a file share, and uploading files to both locations.

Create a storage container

From the Storage account page, select the storage account you created in the Prepare exercise

On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.

In the Name field, enter storage-container.
Select Create.

Upload a file to the storage container

Select the storage container you just created.

Select Upload and upload the file you prepared.

Once the file is ready for upload, select Upload.

With the file uploaded, notice that the Access tier is displayed. For something we uploaded just for testing, it doesn’t need to be assigned to the Hot access tier. In the next few steps, you’ll change the access tier for the file.

Change the Access Tier

Select the file you just uploaded (the file name is a hyperlink).

Select Change tier.

Select Cold.

Select Save.

Note: You just changed the access tier for an individual blob or file. To change the default access tier for all blobs within the storage account, you could change it at the storage account level.

Create a File Share

From the storage accounts page, select the storage account you created in the Prepare exercise. The storage account name is marchsa (Note: it should be associated with the resource group guided-project-rg.)
On the storage account blade, under the Data storage submenu, select File shares.

Select + File share.

On the Basics tab, in the name field, enter file-share.

On the Backup tab, uncheck Enable backup.

Select Review + create.
Select Create.

Once the file share is created, select Upload.

Upload the same file you uploaded to the blob storage or a different file, it’s up to you.

The next piece of the puzzle is figuring one way to control access to the files that have been uploaded. Azure has many ways to control files, including things like role-based access control. In this scenario, the Azure admin wants you to use shared access tokens or keys.

Create a Shared Access Signature Token

Select the storage account you created in the Prepare exercise.
On the storage account blade, select Storage browser. Expand Blob containers.

Select the storage container you created earlier, storage-container.

Select the ellipses (three dots) on the end of the line for the image you uploaded.
Select Generate SAS.

Note: When you generate a shared access signature, you set the duration. Once the duration is over, the link stops working. The **Start automatically populates with the current date and time.

Set Signing method to Account key.
Set Signing key to Key 1.
Set Stored access policy to None.
Set Permissions to Read.
Enter a custom start and expiry time or leave the defaults.
Set Allowed protocols to HTTPS only.
Select Generate SAS token and URL.

Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.

With the SAS token created, anyone with that link can access the file for the duration that was set when you created the SAS token. However, controlling access to a resource or file is about more than just granting access. It’s also about being able to revoke access. To revoke access with a SAS token, you need to invalidate the token. You invalidate the token by rotating the key that was used.

Rotate Access Keys

From the Storage accounts page, select the storage account you created in the Prepare exercise.
Expand the Security + networking submenu.
Select Access keys.

For Key 1, select Rotate key.

Read and then acknowledge the warning about regenerating the access key by selecting Yes.

Once you see the success message for rotating the access key, go back to the window or tab you used to check the SAS token and refresh the page. You should receive an authentication failed error.

Conclusion
The Control Storage Access exercise demonstrated the essential administrative tasks required to manage and secure storage resources in Microsoft Azure. The project covered the creation of a storage container for organizing and managing blob data, as well as changing the access tier to optimize storage costs and performance based on data usage patterns.

It also involved creating a file share to enable structured file storage and collaboration across systems. To ensure controlled and temporary access to storage resources, a Shared Access Signature (SAS) token was generated, allowing secure delegated access without exposing the primary account keys. Finally, rotating the storage access keys reinforced security best practices by periodically renewing credentials to minimize the risk of unauthorized access.

Overall, these operations highlight the importance of efficient storage management, cost optimization, and strong security practices when maintaining cloud storage resources within the Azure environment.

Update and Maintain Resources in Azure - Manage Virtual Machines

Fredrick Chukwuma — Fri, 13 Mar 2026 19:30:52 +0000

Scenario

With the network settings updated to support segmenting the Linux virtual machine, you’re ready to manage the virtual machine itself. The first thing the Azure admin asks you to complete is moving the virtual machine to the new subnet you created in the previous exercise.
Note: This is a continuation of the project in the article I posted before this.

Move the virtual machine network to the new subnet

From the Virtual Machines page, select the guided-project-vm virtual machine.

If the virtual machine is running, select Stop. Note: To make some configuration changes, such as changing the subnet, the VM will need to be restarted. You can request the change without stopping the VM, but Azure will force a restart before completing the change.
Wait for the Status field to update and show Stopped (deallocated).

Within the Networking subsection of the menu, select Network settings.

Select the Network interface / IP configuration hyperlink for the VM.

On the IP Configurations page, update the Subnet to ftpSubnet.

Select Apply.

The VM has been migrated from one subnet to another. Remember, the new subnet had specific network security rules applied to help it function as an FTP server. The next task from the Azure admin relates to the computing power of the VM. The admin would like to vertically scale the machine to increase its computing power.

Vertically scale the virtual machine

From the Virtual Machine page, select the guided-project-vm virtual machine.

Locate the Availability + scale submenu and select Size.
Select a new VM size D2s_v5, for example. (Note: If you don’t see the same size as shown in this exercise, select something similar.)
Select Resize.

With the VM successfully scaled up to a more robust processor, it can handle the new role it’s being assigned.
However, now the Azure admin realizes that if the VM is going to serve as an FTP server, it needs more storage. The Azure admin needs to attach a new data disk to the VM.

Attach data disks to a virtual machine

From the Virtual Machine page, select the guided-project-vm virtual machine.

Locate the settings submenu and select Disks.

Select Create and attach a new disk.

Leave LUN as default.
Enter ftp-data-disk for the Disk name.
Leave the Storage type as default.
Enter 20 for the Size.
Select Apply to create the new storage disk and attach the disk to the machine.

Now the VM has enough storage to handle some uploads.
The final thing the Azure admin is concerned about is the cost of running the computer 24 hours a day. The first thing they’ll do every morning is start up the FTP server. However, they’d like to configure it to automatically shut down every day at 7 PM Coordinated Universal Time (UTC).

Configure automatic shutdown on a virtual machine

From the Virtual Machines page, select the guided-project-vm virtual machine.
Under the Operations submenu, select Auto-shutdown.

In order to let late uploads finish, set the scheduled shutdown to 7:15:00 PM.
Select Save.

The Azure admin has completed all of the management tasks needed for the virtual machine.

Summary
In this project, we successfully managed virtual machines (VMs) by covering essential operational tasks. We demonstrated how to move a VM to a specific subnet to optimize network segmentation and security. Vertical scaling was applied to adjust the VM’s resources according to workload demands, ensuring optimal performance. Additionally, we attached a data disk to expand storage capacity for applications and data. Finally, configuring auto-shutdown helped enforce cost efficiency by automatically stopping VMs during non-working hours. Collectively, these steps highlight best practices in VM lifecycle management, balancing performance, scalability, and cost control.

Update and Maintain Resources in Azure - Update the virtual network

Fredrick Chukwuma — Fri, 13 Mar 2026 19:28:51 +0000

You’re helping an Azure Admin maintain resources. While you won’t be responsible for maintaining the entire infrastructure, the Admin will ask you to help out by completing certain tasks. Currently, there’s a Linux virtual machine (VM) that’s underutilized, and a need for a new Linux machine to serve as an FTP server. However, the Azure admin wants to be able to track network flow and resource utilization for the needed FTP server, so has asked you to start out by provisioning a new subnet. The current subnet should be left alone, as there are future plans for using it for additional VMs.
This is a continuation of the previous article; the resources created in the previous article will be used for this project.

Create a new subnet on an existing virtual network (vNet)

From the Azure portal home page, search for and select virtual networks under services.

Select the guided-project-vnet virtual network.

From the guided-project-vnet blade, under settings, select Subnets.

To add a subnet, select + Subnet.

For Subnet purpose, leave it as Default.
For Name, enter: ftpSubnet.

Leave the rest of the settings alone and select Add.

Create a network security group

From the virtual network blade, select network security group

Select + Create.

Select the guided-project-rg resource group.

Enter ftpNSG for the network security group name.

Select Review + create.

Once the validation is complete, select Create.

Wait for the screen to refresh and display Your deployment is complete, then select Go to resource.

Create an inbound security rule

Under settings, select Inbound security rules.

Select + Add.

Change the Destination port range from 8080 to 22.

Select TCP for the protocol.

Set the name to ftpInbound.

Select Add.

Select Home to return to the Azure portal home page.

Associate a network security group to a subnet

From the Virtual network page, select the guided-project-vnet virtual network.

Under settings, select Subnets.

Select the ftpSubnet you created.

On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.
Select Save.

In summary, creating a subnet within an existing Azure Virtual Network (VNet) enables administrators to segment the network and organize resources logically. A subnet defines a specific IP address range within the VNet, enabling better control over traffic flow and resource placement. When a subnet is created, it becomes a dedicated network segment where Azure resources such as virtual machines can be deployed and communicate securely within the virtual network environment.

After creating the subnet, a Network Security Group (NSG) can be associated with it to enforce security policies. An NSG acts as a virtual firewall that controls inbound and outbound traffic using predefined security rules based on factors such as source and destination IP addresses, ports, and protocols. By associating the NSG with the subnet, the defined rules automatically apply to all resources deployed within that subnet, ensuring consistent network security and helping protect the environment from unauthorized access while maintaining controlled communication between resources.

Update and Maintain Resources in Azure - Prepare

Fredrick Chukwuma — Fri, 13 Mar 2026 19:25:58 +0000

Updating and maintaining resources in Microsoft Azure is a fundamental aspect of effective cloud infrastructure management. It ensures that deployed services remain secure, reliable, and optimized for performance. Azure provides a range of tools and management interfaces, such as the Azure Portal, Azure CLI, and automation services, to help administrators efficiently monitor, update, and manage cloud resources.

Regular updates and maintenance activities include applying security patches, updating virtual machines and operating systems, managing storage and networking configurations, and monitoring resource health and performance. These practices help prevent vulnerabilities, improve system stability, and ensure that cloud workloads continue to operate efficiently.

By consistently maintaining Azure resources, organizations can reduce operational risks, optimize costs, and ensure that their cloud environment aligns with best practices for security, scalability, and performance. This proactive approach is essential to maintaining a well-managed, resilient cloud infrastructure.

This project will be sectioned into parts. In this article, I will only prepare the resources needed for the project. And in the next articles, I will;

Update a virtual network and subnet.
Manage virtual machines.
Control storage access.
Manage resource tags and locks.

Create a resource group

From the Azure Portal, search for and select Resource groups under services

Select Create.

Enter guided-project-rg in the Resource group name field.

Select Review + create.

Create a virtual network with one subnet

Search for and select virtual networks under services.

Select Create.

Scroll down to the Instance details section and enter guided-project-vnet for the Virtual network name.

Select Review + create.

Wait for the screen to refresh and show Your deployment is complete.

Create a virtual machine

Search for and select virtual machines under services.

Select Create and then select Virtual machine

Select guided-project-rg for the Resource group.

Enter guided-project-vm for the Virtual machine name.

For the Image, select one of the Ubuntu Server options. (For example, Ubuntu Server 24.04 LTS - x64 Gen2)

Continue further on the Basics page to the Administrator account section.
Select Password for authentication type.

Enter guided-project-admin for the admin Username.

Enter a password for the admin account.
Confirm the password for the admin account.

Leave the rest of the settings as the default settings. You can review the settings if you like, but you shouldn’t change any.
Select Review + create.

Select Create to confirm the resource cost and create the virtual machine.

Select Home to return to the Azure portal home page.

Create a Storage account

Search for and select Storage accounts under services.

Select Create.

Scroll down to the Instance details section and enter a name for the storage account. Storage accounts must be globally unique, so you may have to try a few different times to get a storage account name.

Select Review + create.

Select Create.

Wait for the screen to refresh and show that your deployment is complete.

In conclusion, updating and maintaining resources through the Azure Portal is an important practice for ensuring the stability, security, and optimal performance of services hosted on Microsoft Azure. The portal provides a centralized graphical interface that allows administrators to easily monitor resource health, apply updates, modify configurations, and manage services in real time. By regularly maintaining resources through the Azure Portal, organizations can improve operational efficiency, reduce potential system issues, and ensure their cloud infrastructure remains reliable and aligned with best practices.
In the next article, I will show you how to update the virtual network.

Build a Complete Azure Environment using only the Azure CLI — no Portal

Fredrick Chukwuma — Wed, 11 Mar 2026 09:51:12 +0000

Azure CLI

Azure CLI is a cross-platform command-line tool developed by Microsoft that allows users to create, manage, and automate cloud resources in Microsoft Azure directly from a terminal or command prompt.
It enables cloud engineers, developers, and administrators to interact with Azure services using structured commands (az) instead of the graphical web portal. Azure CLI supports automation, scripting, and infrastructure management across services such as virtual machines, storage, networking, and resource groups.

In this project, I will;

Create a Resource Group
Build a Virtual Network (VNet) & Subnet
Provision a Linux Virtual Machine
Create a Storage Account & Upload Files
Store Secrets in Azure Key Vault
Monitor Costs & Set a Budget Alert

Create a Resource Group

A Resource Group is a logical container used to hold and organize related cloud resources in Microsoft Azure.
Resources such as virtual machines, storage accounts, databases, and networks are placed inside a resource group so they can be managed, deployed, and deleted together as a single unit.

1. Set a variable for the resource group

A variable is a named placeholder that stores a value that commands or scripts can reuse during a session.
Instead of repeatedly typing the same value (such as a file path, resource name, or configuration), you assign it to a variable and reference the variable whenever needed.

2. Create the Resource Group
This creates the above-named resource group (mylab-rg) in the location (East US). All resources in this lab will be placed here for easy cleanup.

verify it was created in the Azure Portal

Build a Virtual Network (VNet) & Subnet

1. Create a VNet
A Virtual Network is a private network in the cloud that enables all cloud resources to communicate securely with one another.
It provides network isolation, IP address management, and secure connectivity for resources such as virtual machines and databases within Azure.

Create a Virtual Network with a broad 10.0.0.0/16 IP address space.

2. Create a Subnet
A Subnet is a smaller, segmented range of IP addresses within a virtual network.
It is used to organize, secure, and control network traffic between resources, allowing better management and isolation within the larger virtual network.

Create a Subnet that carves out a smaller 10.0.1.0/24 piece (subnet) of the VNet specifically for your VMs.

3. Create a Network Security Group (NSG)
A Network Security Group (NSG) is a set of security rules in Microsoft Azure that controls inbound and outbound traffic to resources in a virtual network.
It allows you to permit or deny traffic based on source/destination IP, port, and protocol, providing network-level security and isolation.

Create a Network Security Group, which acts as a virtual firewall.

4. Open port 22 (SSH) & 80 (HTTP)
Port 22 (SSH) is the default port for Secure Shell (SSH) connections, which allows secure, encrypted remote access to a server or virtual machine. Opening this port lets administrators log in and manage resources remotely.
Port 80 (HTTP) is the default port for web traffic using the Hypertext Transfer Protocol (HTTP). Opening this port allows a server to serve web pages and respond to standard, unencrypted web requests from clients or browsers.

Add inbound rules prioritizing SSH (port 22) and HTTP (port 80) access from the internet.

Allow SSH

Allow HTTP

5. Attach NSG to Subnet
Applying the NSG to the subnet ensures that any VM created in that subnet automatically inherits those exact firewall rules, protecting the entire subnet.

Confirm resources are created from Azure Portal

Provision a Linux Virtual Machine

A Virtual Machine is a software based computer that runs an operating system and applications just like a physical computer, but operates on virtualized hardware within a host system or cloud platform.
In cloud environments such as Microsoft Azure, virtual machines provide on-demand computing resources including CPU, memory, storage, and networking, allowing users to deploy and manage servers without owning physical hardware.

Create an Ubuntu VM with a public IP inside your VNet

1. Allocate a Public IP
Without a public IP, the VM can only be accessed internally through the VNet or a VPN. You need this to reach your web server from your browser.

2. Create the VM
Create a B1s Ubuntu VM with auto-generated SSH keys and connect it to the existing subnet and firewall.
This is the actual cloud compute instance that will run your web application code.

3. Retrieve the public IP
This filters the Azure API response to return just the IP address string because we need this IP to SSH into the machine and to test the web application.

4. Verify the VM is running
This queries the VM status and displays it in a clean table format. Always verify provisioning success before attempting connections.

5. SSH into your VM & install Nginx
This will log into the VM over the internet via SSH, install the Nginx package using APT, and start the service. Usually A fresh VM is blank. Nginx serves as the web server to test our HTTP port 80 firewall rule.

Conclusion

Building a complete Azure environment using only the Azure CLI demonstrates how core Azure infrastructure components work together to create a secure, scalable, and manageable cloud environment. The Resource Group serves as the logical container that organizes and manages all related resources within a single lifecycle boundary. Inside this container, the Virtual Network (VNet) provides an isolated network environment in Azure where resources can communicate securely.

Within the VNet, Subnets segment the network into smaller logical sections, allowing better traffic control, organization, and security management. To further enforce security, Network Security Groups (NSGs) are applied to subnets or network interfaces to define inbound and outbound traffic rules, ensuring that only authorized network communication is permitted.

Finally, the Virtual Machine (VM) represents the compute resource running within the virtual network subnet, leveraging the network infrastructure and security policies defined by the NSG.

Overall, using the Azure CLI to deploy and manage these components provides a powerful, automated, and reproducible approach to infrastructure provisioning. It enables DevOps and cloud engineers to efficiently build, configure, and control Azure environments through scripting and command-line operations, reinforcing the principles of Infrastructure as Code (IaC), automation, and scalable cloud architecture.

Create a Resource Group in Azure using Azure CLI

Fredrick Chukwuma — Wed, 04 Mar 2026 14:43:16 +0000

In this project, I will walk through the steps below to be able to create a resource group in Microsoft Azure using the Visual Studio Code.

Install Azure CLI
Login to Azure portal
Create a Resource Group in Azure Portal

What is Azure CLI

Azure CLI is Microsoft’s cross-platform command-line interface for provisioning, configuring, and managing resources in Microsoft Azure. It provides a declarative and scriptable way to interact with Azure services using concise commands (az ), making it suitable for automation, DevOps workflows, CI/CD pipelines, and infrastructure management.

Azure CLI supports Windows, macOS, and Linux, integrates with authentication methods like Azure AD, and outputs results in formats such as JSON for easy scripting and programmatic processing.

1. Install Azure CLI on macOS using Visual Studio Code

In the VS Code, open the terminal.

In the terminal, paste this command (brew update && brew install azure-cli) to instal Azure Cli on macOS.

verify that Azure CLI has been successfully installed.

2. Login to Azure Portal

In the terminal, type this command (az login) to login to Azure Portal

What is an Azure Resource Group

An Azure Resource Group is a logical container in Microsoft Azure used to organize and manage related resources such as virtual machines, storage accounts, networking components, and databases as a single unit.
It provides a scope for lifecycle management, access control (RBAC), policy enforcement, and deployment boundaries.
Resources within a resource group can be deployed, updated, or deleted collectively, enabling structured governance, cost tracking, and environment segmentation (e.g., dev, test, production).

3. Create a Resource Group in Azure Portal

In the terminal, type this command (az group create --name --location) to create a resource group in Azure Portal.

Confirm that you have created a Resource Group in Azure Portal

In summary, the Azure CLI provides a streamlined, scriptable interface for managing Azure resources with precision and automation. An Azure Resource Group serves as the logical boundary for organizing, securing, and governing related resources within an Azure environment.

Creating a resource group through Visual Studio Code using the Azure CLI combines infrastructure management with a modern development workflow. It enables repeatable deployments, version-controlled infrastructure commands, and seamless integration into DevOps pipelines ensuring consistency, scalability, and operational efficiency in cloud environments.

Provide Storage for a New Company App

Fredrick Chukwuma — Thu, 26 Feb 2026 19:24:46 +0000

The company is designing and developing a new app. Developers need to ensure the storage is only accessed using keys and managed identities. The developers would like to use role-based access control. To help with testing, protected immutable storage is needed.
In this project, we will be doing these tasks as follows using Microsoft Azure:

Create the storage account and managed identity.
Secure access to the storage account with a key vault and key.
Configure the storage account to use the customer managed key in the key vault
Configure a time-based retention policy and an encryption scope.

Storage Account in Microsoft Azure

A Storage Account in Microsoft Azure is a secure, scalable, and highly available cloud storage container that provides access to Azure Storage services such as Blob Storage (object storage), File Shares, Queues, and Tables. It serves as the foundational resource that defines how data is stored, replicated (LRS, ZRS, GRS), encrypted, and accessed over HTTPS endpoints. For applications, a storage account enables durable data persistence, backup, logging, content hosting, and data exchange with controlled access via role-based access control (RBAC) and shared access signatures (SAS).
In essence, a Storage Account stores and protects your application’s data.

Managed Identity for an Application in Microsoft Azure

A Managed Identity in Azure is an automatically managed identity in Microsoft Entra ID that allows an application (e.g., Azure VM, App Service, Function App) to authenticate securely to Azure services without storing credentials in code or configuration. Azure handles credential rotation and lifecycle management. When assigned appropriate role-based access control (RBAC) roles (e.g., Storage Blob Data Contributor), the application can securely access resources like a Storage Account using Azure AD-based authentication, eliminating the need for connection strings or secrets.
In essence, a Managed Identity secures how your application authenticates to access that data.

Create the storage account and managed identity

1. Provide a storage account for the web app.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name is unique and meets the naming requirements.

Move to the Encryption tab.

Check the box for Enable infrastructure encryption.

Notice the warning, This option cannot be changed after this storage account is created.

Select Review + Create.

Wait for the resource to deploy.

2. Provide a managed identity for the web app to use.

Search for and select Managed identities.

Select Create.

Select your resource group.

Give your managed identity a name.

Select Review and create, and then Create.

3. Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs.

Search for and select your storage account.

Select the Access Control (IAM) blade.

Select Add role assignment.

On the Job functions roles page, search for and select the Storage Blob Data Reader role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.
Select the managed identity you created in the previous step.
Click Select and then Review + assign the role.

Select Review + assign a second time to add the role assignment.

Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.

Secure access to the storage account with a key vault and key

1. To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions.

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Administrator role.

On the Members page, select User, group, or service principal.

Select Select members.

Search for and select your user account. Your user account is shown in the top right of the portal.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

You are now ready to continue with the lab.

2. Create a key vault to store the access keys.
A Key Vault in Microsoft Azure is a secure, cloud-based service used to store and manage sensitive information such as: Secrets (passwords, connection strings, API keys), Cryptographic keys (RSA, ECC keys used for encryption/signing), Certificates (SSL/TLS certificates).
Azure Key Vault protects your application's secrets and cryptographic materials while controlling exactly who or what can access them.

In the portal, search for and select Key vaults.

Select Create.

Select your resource group.

Provide the name for the key vault. The name must be unique.

Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.

Select Review + create.

Wait for the validation checks to complete and then select Create.

After the deployment, select Go to resource.

On the Overview blade ensure both Soft-delete and Purge protection are enabled.

3. Create a customer-managed key in the key vault.

In your key vault, in the Objects section, select the Keys blade.

Select Generate/Import and Name the key.

Take the defaults for the rest of the parameters, and Create the key.

Configure the storage account to use the customer managed key in the key vault

1. Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.

In the portal, search for and select Resource groups.

Select your resource group, and then the Access Control (IAM) blade.

Select Add role assignment (center of the page).

On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.

On the Members page, select Managed identity.

Select Select members, in the Managed identity drop-down select User-assigned managed identity.

Select your managed identity.

Click Select and then Review + assign.

Select Review + assign a second time to add the role assignment.

2. Configure the storage account to use the customer managed key in your key vault.

Return to your storage account.

In the Security + networking section, select the Encryption blade.

Select Customer-managed keys.

Select a key vault and key. Select your key vault and key.

Select to confirm your choices.
Ensure the Identity type is User-assigned.

Select an identity.
Select your managed identity, then select Add.

Save your changes.

If you receive an error that your identity does not have the correct permissions, wait a minute and try again.

Configure a time-based retention policy and an encryption scope.

1. The developers require a storage container where files can’t be modified, even by the administrator.

Navigate to your storage account.

In the Data storage section, select the Containers blade.

Create a container called hold. Take the defaults. Be sure to Create the container.

Upload a file to the container.

In the Settings section, select the Access policy blade.

In the Immutable blob storage section, select + Add policy.

For the Policy type, select time-based retention.

Set the Retention period to 5 days.

Be sure to Save your changes.

Try to delete the file in the container.

Verify you are notified failed to delete blobs due to policy.

2. The developers require an encryption scope that enables infrastructure encryption.

Navigate back to your storage account.

In the Security + networking blade, select Encryption.

In the Encryption scopes tab, select Add.

Give your encryption scope a name.

The Encryption type is Microsoft-managed key.

Set Infrastructure encryption to Enable.

Create the encryption scope.

Return to your storage account and create a new container.

Notice on the New container page, there is the Name and Public access level.

Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.

Conclusion

In Microsoft Azure, a secure storage architecture for an application is achieved by combining Storage Account, Managed Identity, Key Vault, and Encryption Scope into a cohesive security model.

The Storage Account delivers scalable and durable data persistence. Managed Identity provides passwordless, Azure AD–based authentication, eliminating hardcoded credentials. Key Vault centrally protects and manages cryptographic keys and secrets with strict access control and auditing. Encryption Scope enables granular control of data-at-rest encryption, allowing specific containers or blobs to be encrypted with designated customer-managed keys (CMKs).

Together, these components enforce least-privilege access, strong cryptographic governance, and compartmentalized encryption boundaries, resulting in a compliant, enterprise-grade storage solution.

Provide Shared File Storage for a Company's Offices

Fredrick Chukwuma — Tue, 24 Feb 2026 19:51:55 +0000

Azure Shared File Storage is a managed cloud-based file system that allows multiple users, virtual machines, or applications to access the same files concurrently over a network. A shared file storage is hosted inside an Azure storage account. It behaves like a traditional network file server but without managing physical hardware.
In this project, I will show you how to;

Create a storage account.
Configure a file share and directory.
Configure snapshots and practice restoring files.
Restrict access to a specific virtual network and subnet.

Create and configure a storage account for Azure Files.

1. Create a storage account for the finance department’s shared files.

In the portal, search for and select Storage accounts.

Select + Create.

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a Storage account name. Ensure the name meets the naming requirements.

Set the Performance to Premium.

Set the Premium account type to File shares.

Set the Redundancy to Zone-redundant storage.

Select Review and then Create the storage account.

Wait for the resource to deploy.

Select Go to resource.

Create and configure a file share with directory.

1. Create a file share for the corporate office.

In the storage account, in the Data storage section, select the File shares blade.

Select + File share and provide a Name.

Review the other options, but take the defaults.

Select Create

2. Add a directory to the file share for the finance department. For future testing, upload a file.

Select your file share and select + Add directory.

Name the new directory finance.

Select Browse and then select the finance directory.

Notice you can Add directory to further organize your file share.
Upload a file of your choosing.

Configure and Test Snapshots.

What is a Snapshot in Azure File Share

A snapshot in Azure File Share is a read-only, point-in-time copy of an entire file share within an Azure Storage Account.
It captures the state of all files and directories at the moment the snapshot is created without interrupting active workloads.
These are the key characteristics of a snapshot; cannot be modified, it's stored within the same storage account, used to restore individual files or entire shared files.

1. Similar to blob storage, you need to protect against accidental deletion of files. You decide to use snapshots

Select your file share.

In the Operations section, select the Snapshots blade.

Select + Add snapshot. The comment is optional. Select OK.

Select your snapshot and verify your file directory and uploaded file are included.

2. Practice using snapshots to restore a file.

Return to your file share.

Browse to your file directory.

Locate your uploaded file and in the Properties pane select Delete. Select Yes to confirm the deletion.

Select the Snapshots blade and then select your snapshot.

Navigate to the file you want to restore,

Select the file and the select Restore.

Provide a Restored file name.

Verify your file directory has the restored file.

Configure restricting storage access to selected virtual networks.

1. This tasks in this section require a virtual network with subnet. In a production environment these resources would already be created.

Search for and select Virtual networks.

Select Create. Select your resource group. and give the virtual network a name.

Take the defaults for other parameters, select Review + create, and then Create.

Wait for the resource to deploy.

Select Go to resource.

In the Settings section, select the Subnets blade.

Select the default subnet.

In the Service endpoints section, choose Microsoft.Storage in the Services drop-down.

Do not make any other changes.
Be sure to Save your changes.

2. The storage account should only be accessed from the virtual network you just created.

Return to your files storage account.

In the Security + networking section, select the Networking blade.

Change the Public network access to Enabled from selected virtual networks and IP addresses.

In the Virtual networks section, select Add existing virtual network.

Select your virtual network and subnet, select Add.

Be sure to Save your changes.

Select the Storage browser and navigate to your file share.

Verify the message not authorized to perform this operation. You are not connecting from the virtual network.

Conclusion

Shared file storage in Microsoft Azure, delivered through Azure File Shares within Azure Storage Accounts, provides a fully managed, scalable, and highly available SMB/NFS-based file system accessible from multiple servers and locations. It enables centralized data access for distributed teams, hybrid environments, and cloud-native workloads without the overhead of managing physical file servers.

Snapshots in Azure File Shares enhance this capability by providing point-in-time, read-only copies of data. They support data protection, operational recovery, and compliance by enabling fast restoration of files or entire shares in the event of accidental deletion, corruption, or ransomware incidents. Together, shared file storage and snapshots form a resilient, enterprise-grade file management solution in the Azure ecosystem.

Creating and Connecting to an Amazon EC2 Instance

Fredrick Chukwuma — Sat, 21 Feb 2026 10:54:15 +0000

AWS Elastic Compute Cloud (EC2)

Amazon EC2 is a core Infrastructure-as-a-Service (IaaS) offered by Amazon Web Services that provides resizable, on-demand virtual servers in the cloud. It lets users rent virtual machines, called instances, to run applications without purchasing or maintaining physical hardware. EC2 instances can be launched, scaled, and terminated in seconds, making them ideal for workloads that vary in size or demand.
EC2 supports multiple operating systems like Linux and Windows, integrates natively with AWS networking (VPC), storage (EBS, S3), security (IAM, Security Groups), and automation services, and operates on a pay-as-you-go pricing model.

In this project, I will show you how to create and connect to an Amazon Web Services EC2 instance.

Create and deploy an EC2 instance

In the AWS portal, search for and select EC2

On the EC2 dashboard, select launch instance

Give your EC2 instance a name

Select an operating system or image name (I will select the Ubuntu OS in this project)

Create a key pair

Leave other settings at default, then select launch

Connect to the EC2 instance

Make sure your instance has successfully launched, and select Connect to instance

On the connect to instance page, leave the connection type to default and select connect

Now I am connected to the server

first I type in the "sudo su" command. The sudo su typically defaults to switching to the root user, granting full administrative access to the instance

Notice the Ubuntu@ip changed to root@ip after the sudo su command

Now you type in the "apt update" command. The apt update command is a core operation in Ubuntu‑based EC2 instances that refreshes the local package index. It contacts the repositories listed in /etc/apt/sources.list (and any files under /etc/apt/sources.list.d/) and downloads the latest metadata about available packages, versions, and dependencies. This metadata update ensures that subsequent package‑management actions (apt upgrade, apt install, etc.) can resolve the newest software versions correctly.

Conclusion
Launching an Ubuntu EC2 instance on AWS provides a robust and flexible cloud computing solution, allowing users to run applications without managing physical hardware. The process is straightforward, from selecting an Ubuntu AMI to configuring security groups and launching the instance. This setup enables scalable, pay‑as‑you‑go compute resources that can be tailored to specific workloads, making it ideal for both development and production environments. By following the step‑by‑step guide, you can quickly deploy a secure, Linux‑based server that leverages AWS’s extensive ecosystem. With proper security hardening, your Ubuntu EC2 instance can become a resilient foundation for a wide range of cloud‑native applications.

Creating and Connecting to an Azure Virtual Machine

Fredrick Chukwuma — Thu, 19 Feb 2026 12:44:08 +0000

An Azure Virtual Machine is an Infrastructure-as-a-Service (IaaS) compute resource provided by Microsoft Azure that enables users to deploy and manage virtualized servers in the cloud. It delivers on-demand, scalable computing capacity without the need to purchase or maintain physical hardware. Azure VMs run on top of a hypervisor-based virtualization layer within Microsoft’s global data centers, allowing multiple isolated virtual machines to share the same physical host securely and efficiently.

That sounds too vague, right? Let me break it down a little bit more: An Azure Virtual Machine is like having a powerful server on standby without ever hearing the hum of hardware or worrying about rack space. Powered by Microsoft Azure, it lets you run up a fully functional Windows or Linux machine in minutes, scale it when traffic spikes, and then shut it down when the job’s done.
Whether you're deploying a production workload, testing a bold new idea, or lifting an app into the cloud, Azure VMs give you full control of the operating system and environment just like a traditional server, but smarter, faster, and globally available. In short, it is your data center… minus the data center 😉.

In this article, I will show you how to:

Create a virtual machine
Configure the virtual machine
Deploy the virtual machine
and then connect to the virtual machine

Create a Virtual Machine in Azure Portal

In the portal, search for and select virtual machines

Select + Create.

Choose "Virtual Machine hosted by Azure".

Configure Virtual Machine Details

For Resource group select Create new. Give your resource group a name and select OK to save your changes.

Provide a virtual machine name

In the availability options, select availability zone.

For operating system (image), I will be using Windows Server 2025 Datacenter - x64 Gen2

Set VM size to the default option

Set Up Administrator Account

Set up username

Set up password and then confirm password

Configure inbound ports to RDP for windows operating system. HTTP (80) is the port that helps you communicate with the internet.

Click the checkbox to accept the license agreement.

Navigate to monitoring lab

In the monitoring lab, disable boot diagnostics

Deploy the Virtual Machine

select review + create

Ensure validation passes.

Click "Create" to deploy.

After deployment is complete, select go to resource

Connect to the Virtual Machine

Go to the public Ip address and maximize idle timeout

Click "Connect" in the Azure VM blade.

Select download RDP file

Open RDP file and then enter your credentials to login

Now we are connected to the virtual machine

Notice the virtual machine name
Notice the windows edition

Provide Private Storage for Internal Company Documents

Fredrick Chukwuma — Wed, 18 Feb 2026 18:51:49 +0000

The company needs storage for its offices and departments. This content is private to the company and shouldn't be shared without consent. This storage requires high availability in the event of a regional outage. The company wants to use this storage to back up the public website storage.

This article is about storage accounts in Cloud Storage; a service model that stores data on remote servers accessible via the internet rather than on a local device.
I will show you how to;

Create a storage account for the company's private documents.
Configure redundancy for the storage account.
Configure a shared access signature so partners have restricted access to a file.
Back up the public website storage.
Implement lifecycle management to move content to the cool tier.

Create a storage account and configure high availability.

1. Create a storage account for the internal private company documents.

In the portal, search for and select Storage accounts.

Select + Create.

Select the Resource group created in the previous lab.

Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.
Select Review, and then Create the storage account.

Wait for the storage account to deploy, and then select Go to resource.

2. This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.

Ensure Geo-redundant storage (GRS) is selected.

Refresh the page.

Review the primary and secondary location information.

Save your changes.

Create a storage container, upload a file, and restrict access to the file.

1. Create a private storage container for the corporate data.

In the storage account, in the Data storage section, select the Containers blade.

Select + Container.

Ensure the Name of the container is private.

Ensure the Public access level is Private (no anonymous access).

As you have time, review the Advanced settings, but take the defaults.
Select Create.

2. For testing, upload a file to the private container. he type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.

Select the container.

Select Upload.

Browse to files and select a file.

Upload the file.

Select the uploaded file.

On the Overview tab, copy the URL.

Paste the URL into a new browser tab.

Verify the file doesn’t display and you receive an error.

3. An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS).

Select your uploaded blob file and move to the Generate SAS tab.

In the Permissions drop-down, ensure the partner has only Read permissions.

Verify the Start and expiry date/time is for the next 24 hours.

Select Generate SAS token and URL.

Copy the Blob SAS URL to a new browser tab.

Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.

1. To save on costs, after 30 days, move blobs from the hot tier to the cool tier.

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.

In the Data management section, select the Lifecycle management blade.

Select Add rule.

Set the Rule name to movetocool.

Set the Rule scope to Apply rule to all blobs in the storage account.

Select Next.

Ensure Last modified is selected.

Set More than (days ago) to 30.

In the Then drop-down select Move to cool storage.

As you have time, review other lifecycle options in the drop-down.

Add the rule.

2. The public website files need to be backed up to another storage account.

In your storage account, create a new container called backup. Use the default values.

Navigate to your publicwebsite storage account. This storage account was created in the previous exercise.

In the Data management section, select the Object replication blade.

Select Create replication rules.

Set the Destination storage account to the private storage account.

Set the Source container to public and the Destination container to backup.

Create the replication rule.

Optionally, as you have time, upload a file to the public container. Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.