Implement and Manage Storage
This domain focuses on Azure Storage accounts and the services they host, including blobs and file shares. You will choose redundancy and access tiers, secure access with SAS and firewalls, and move data efficiently. Understanding the trade-offs between durability, cost, and access is essential.
Storage Accounts and Redundancy
A storage account is the container for blobs, files, queues, and tables. Redundancy options determine how many copies exist and where: LRS keeps three copies in one datacenter, ZRS spreads copies across availability zones in a region, GRS replicates to a paired secondary region, and GZRS combines zone and geo redundancy. Read-access variants (RA-GRS, RA-GZRS) additionally allow reads from the secondary. Choose based on how much regional or zonal failure protection the workload requires.
Blob Tiers and Lifecycle Management
Blob storage offers Hot, Cool, Cold, and Archive access tiers that trade lower storage cost for higher access cost and latency as data cools. Lifecycle management policies automatically transition blobs between tiers or delete them based on rules like days since last modification. This reduces cost for data whose access pattern changes over time, such as logs that are rarely read after a month. Archive is offline and requires a rehydration step before access.
Azure Files and Shared Access Signatures
Azure Files provides fully managed SMB and NFS file shares that can be mounted by cloud or on-premises machines. To grant limited, delegated access to storage without sharing account keys, you create a shared access signature (SAS) that specifies permissions, scope, and an expiry time. SAS tokens can be scoped to an account, a service, or a single container or object. Using SAS instead of account keys follows least-privilege principles.
Storage Security and Firewalls
The storage account firewall restricts access to selected virtual networks and IP address ranges while denying other public traffic. You grant a subnet access via a service endpoint, or use a private endpoint to bring the storage account into your VNet with a private IP. Combined with Entra ID authorization and encryption at rest, these controls harden storage against unauthorized access. Network restrictions complement, rather than replace, key and SAS controls.
Moving Data with AzCopy
AzCopy is a command-line tool built for high-throughput, resumable transfer of data to and from Blob and File storage. It is well suited to bulk migrations from on-premises servers and to copying between storage accounts. Authentication can use Entra ID or a SAS token. For graphical management, Azure Storage Explorer offers similar operations with a UI.