Create an Azure Storage Account

Lab overview

In this lab, you'll learn how to create and configure an Azure Storage Account using the Azure portal.

The lab provides step-by-step instructions, walking you through the process of setting up a storage account, selecting key configuration options, and enabling advanced features like geographic redundancy, network access controls, and blob versioning. By the end of the lab, you'll have hands-on experience with setting up a storage account, configuring its security settings, and deploying it within a specific Azure environment.

Why you'd do this

A storage account is the container behind almost everything that holds data in Azure that isn't a database: blob storage for files and backups, file shares that VMs mount, queues, tables, and the disks and diagnostics logs that VMs write to. You'll create dozens of them over a career, and most of the choices on the wizard can't be changed afterward, which is why this lab walks the tabs deliberately rather than clicking through with defaults. The globally unique name is the first example: it becomes part of a public DNS name, so lowercase letters and numbers only, and once it's taken it's taken.

Redundancy is the choice that decides what happens when a datacenter goes down. Locally redundant storage keeps three copies in one building, which is cheap and fine for scratch data; geo-redundant storage, which this lab selects, also copies everything to a paired region hundreds of miles away, so a regional outage doesn't take your data with it. It costs roughly twice as much, and that trade-off between price and durability is the kind of question AZ-104 and AZ-305 both ask directly.

The Networking tab is where most real-world storage accounts are misconfigured. The default allows access from any network; restricting it to selected networks and binding it to vNet-Prod means only resources inside that network can reach the account, which is the posture you want for anything holding backups, logs, or customer data. Watch the private endpoint section as you scroll past, because that's the next step up for production.

Blob versioning keeps every previous version of a file when it's overwritten or deleted, so a bad script or a ransomware event becomes a restore instead of a loss; it's cheap insurance and should be on by default for anything important. Infrastructure encryption adds a second encryption layer at the hardware level underneath the standard service-level encryption, which matters when a compliance framework requires double encryption and costs nothing to enable at creation. For certification prep, creating and configuring storage accounts, redundancy, and storage networking are core AZ-104 objectives, and storage design and data protection appear throughout AZ-305.

Lab details

• Resource Group: ProdRG
• Redundancy: Geo-redundant storage (GRS)
• Network access: Selected networks and IP addresses
• Virtual Network: vNet-Prod
• Blob versioning: Enabled
• Infrastructure encryption: Enabled

Learning objectives

1. Understand how to create a storage account in Azure.
2. Learn to configure key settings like redundancy and network access.
3. Get hands-on experience setting up access control using virtual networks and IP address restrictions.
4. Enable and understand blob versioning for data recovery.
5. Implement infrastructure encryption to add an extra layer of security to your storage account.
6. Review and manage the deployed storage account and its settings in the Azure portal.

Exam relevance

• AZ-104 — Azure Administrator — Create and configure storage accounts, Manage data redundancy, Configure storage security and networking.
• AZ-305 — Azure Solutions Architect — Design storage solutions, Plan data protection and redundancy, Implement secure storage architectures.

Step-by-step instructions

1. From the Azure Home screen, click Create a resource.
   • Type storage account in the search bar and press Enter.
   • Click Storage account from the results.
   • Click Create to begin configuration.
2. Configure the basics:
   • Select resource group ProdRG.
   • Enter a globally unique name using only lowercase letters and numbers.
   • Review the Primary service setting — do not select a primary service for this lab.
3. Configure Redundancy:
   • Click the Redundancy dropdown.
   • Select Geo-redundant storage (GRS) for high availability across regions.
4. Click Next to proceed to the Advanced tab and review available options.
5. Click Next to move to the Networking tab.
6. Configure network access:
   • Select Enable public access from selected networks and IP addresses.
   • Click the Virtual network dropdown and select vNet-Prod.
   • Scroll down to review IP address filtering and private endpoint settings.
7. Click Next to move to the Data protection tab.
8. Enable Blob versioning:
   • Check the Enable blob versioning checkbox.
   • Scroll down to review additional data protection options.
9. Click Next to move to the Encryption tab.
10. Enable Infrastructure encryption for an additional layer of protection.
11. Click Next through the Tags tab without changes.
12. Review the configuration summary, then click Create to deploy the storage account.
13. Wait for deployment to complete, then click Go to resource to view the storage account overview.