Secure Storage, Databases, and Networking · Topic 1 of 3
Storage Account Security
SC-500 storage security: authorization with Entra ID and SAS, disabling Shared Key, firewall rules and private endpoints, and Defender for Storage.
- 4 min
- Secure transfer, TLS 1.2, no anonymous access, Shared Key disabled where possible.
- Entra ID with data roles is the preferred authorization method.
- User delegation SAS is the most secure SAS; stored access policies allow revocation.
What it is
An Azure storage account holds blobs, files, queues and tables. Securing it means controlling who can access data and how (authorization), from where (network rules), protecting data in transit and at rest, and detecting threats with Microsoft Defender for Storage.
How it works
Account-level security settings
| Setting | Secure choice |
|---|---|
| Secure transfer required | On, so only HTTPS is accepted |
| Minimum TLS version | TLS 1.2 |
| Allow Blob anonymous access | Off, unless a container must be public |
| Allow storage account key access (Shared Key) | Off where possible, forcing Microsoft Entra ID authorization |
| Encryption | Always on at rest; use customer-managed keys in Key Vault if required; infrastructure encryption adds a second layer |
Authorizing access
| Method | Notes |
|---|---|
| Microsoft Entra ID with Azure RBAC | Recommended; data roles such as Storage Blob Data Reader and Storage Blob Data Contributor |
| Shared Key (account key) | Full access to the account; avoid and rotate keys if used |
| User delegation SAS | Signed with Entra ID credentials; the most secure type of SAS |
| Service or account SAS | Signed with the account key; limit permissions, IPs, protocol and lifetime |
| Stored access policy | Defines start time, expiry and permissions on a blob container, file share, queue or table (up to five per container) so you can change or revoke many service SAS tokens at once; it doesn't apply to user delegation or account SAS |
Management roles such as Contributor let you manage the account but, with Shared Key disabled, do not by themselves grant data access.
Firewall and network access
- Storage firewall rules allow selected virtual networks (service endpoints) and public IP ranges, with the default action set to deny.
- Private endpoints give the account a private IP address in your virtual network, one per storage service you need (blob, file and so on).
- Resource instance rules and the trusted Microsoft services exception let specific Azure services through the firewall.
- After adding private endpoints, disable public network access if nothing else needs it.
Microsoft Defender for Storage
Defender for Storage covers Blob Storage, Azure Files and Data Lake Storage. Activity monitoring detects threats such as access from suspicious IP addresses, unusual data extraction and access through overly permissive or leaked SAS tokens. Configurable features include malware scanning (on upload or on demand, billed per GB scanned with a monthly cap per account) and sensitive data threat detection, which raises the priority of alerts on data that contains sensitive information. Enable it at subscription level (recommended), with per-account overrides and exclusions.
A worked example: an app stores customer documents. The team disables anonymous blob access and Shared Key, gives the app's managed identity Storage Blob Data Contributor on one container, adds a private endpoint for blob storage, disables public network access and turns on Defender for Storage with malware scanning.
When a question needs short-term delegated access with the strongest security, choose a user delegation SAS. When it needs to revoke many existing SAS tokens at once, choose a stored access policy.
How the exam asks about this
- "Force all access to use Microsoft Entra ID." Disable Shared Key access.
- "Revoke all SAS tokens issued for a container." Change or delete the stored access policy they use.
- "Scan uploaded files for malware." Defender for Storage malware scanning.
What to remember for the exam
- Secure transfer, TLS 1.2, no anonymous access, Shared Key disabled where possible.
- Entra ID with data roles is the preferred authorization method.
- User delegation SAS is the most secure SAS; stored access policies allow revocation.
- Firewall default deny, private endpoints per service, then disable public access.
- Defender for Storage: threat detection, malware scanning, sensitive data threat detection.
An account SAS signed with the account key cannot be revoked individually. Rotating the key revokes every SAS signed with it.
Common mistakes
Giving Contributor to read blobs. Use a data role.
Leaving Shared Key enabled while relying on Entra ID. Keys still bypass RBAC.
Creating one private endpoint for all storage services. Each service needs its own.
Check yourself
Which SAS type is signed with Microsoft Entra ID credentials?
A user delegation SAS.
What does disabling Shared Key access achieve?
Requests must use Microsoft Entra ID authorization, so account keys and key-signed SAS tokens stop working.
What does Defender for Storage malware scanning do?
It scans uploaded blobs for malware and raises alerts when malicious content is found.
Topic 1 of 3 in Secure Storage, Databases, and Networking
Test yourself on Secure Storage, Databases, and Networking
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.