Nordlicht Reisen GmbH, a fictional travel agency, wants to store booking receipts, customer pictures and backup files in Azure. The first decision isn't about a file but about the storage account: It determines region, redundancy, encryption and network access for everything in it. This lesson shows what you decide when creating one and what can be changed later.

In the study guide, this lesson covers: create and configure storage accounts, configure Azure Storage redundancy, configure storage account encryption.

Prior knowledge. What the storage services are and how LRS, ZRS, GRS and GZRS differ in principle is explained in "AZ-900 compact", lesson 2.5. How developers use blobs from .NET is shown in K3, module 3.6. Here is the administrator's side: create, change, secure.

Creating the storage account

A storage account is a shared pool in which blob containers, file shares (Azure Files), tables and queues live. The redundancy setting applies to all services in the account. If two kinds of data have different redundancy requirements, they belong in separate accounts.

Account type, performance and redundancy

In commands and templates, you choose the type with kind, and performance and redundancy together with sku:

Type Redundancy kind sku
Standard general-purpose v2 LRS, GRS, RA-GRS, ZRS, GZRS, RA-GZRS StorageV2 Standard_LRS, Standard_GRS, Standard_RAGRS, Standard_ZRS, Standard_GZRS, Standard_RAGZRS
Premium block blobs LRS, ZRS BlockBlobStorage Premium_LRS, Premium_ZRS
Premium file shares LRS, ZRS FileStorage Premium_LRS, Premium_ZRS
Premium page blobs LRS StorageV2 Premium_LRS

The older types (general-purpose v1, legacy blob) now appear only in the exam as legacy. For almost everything, Microsoft recommends Standard general-purpose v2; you choose Premium when low latency matters.

Name and region

  • The name is 3 to 24 characters long and contains only digits and lowercase letters. It must be unique in Azure, because it is part of the address (<name>.blob.core.windows.net).
  • The region affects price and the availability of the type and of the redundancy. Not every region supports every redundancy. To check the region for your exercises, see lesson 0.1.

Portal way

  1. In the portal, search for Storage accounts (if your portal is set to another language, look for the same item under its translated name; the search box finds both), Create.
  2. Basics: subscription, resource group, account name, region, preferred storage type, Performance (Standard or Premium) and Redundancy. If you choose GRS or GZRS, the portal additionally offers "Make read access to data available in the event of regional unavailability" (that gives RA-GRS or RA-GZRS).
  3. Advanced: Enable hierarchical namespace (for Data Lake), SFTP, NFS v3, the default Access tier for blobs (Hot is the default).
  4. Networking: public network access and rules; lesson 2.2 goes deeper.
  5. Data protection, Security, Encryption, Tags, then Review + create.

On the Security tab, two settings are relevant for the exam: the minimum TLS version (default TLS 1.2; requests with TLS 1.0 and 1.1 are then rejected) and "Allow enabling anonymous access on individual containers". Microsoft recommends switching anonymous access off.

Command

PowerShell
az group create --name rg-az104-speicher --location germanywestcentral
az storage account create --name <eindeutiger-name> --resource-group rg-az104-speicher `
    --location germanywestcentral --sku Standard_LRS --kind StorageV2 `
    --min-tls-version TLS1_2 --allow-blob-public-access false

The same in Azure PowerShell:

PowerShell
New-AzStorageAccount -ResourceGroupName rg-az104-speicher -Name <eindeutiger-name> `
    -Location germanywestcentral -SkuName Standard_LRS -Kind StorageV2