Storage Account Security: AZ-500 Exam Guide

Shared Access Signatures (SAS)

A SAS token grants time-limited, scoped access to storage resources without sharing the account key.

Exam tip: User Delegation SAS is signed with an Entra ID credential, not the storage account key. It is the most secure SAS type and can be revoked independently of the account key.

Storage Firewall

The storage firewall restricts access to specific VNets (via Service Endpoints) and IP ranges. Key behaviours:

• "Allow trusted Microsoft services" exception: Enables Azure services like Backup, Event Grid, and Azure Monitor to bypass the firewall even when all public access is restricted.
• Setting "Disable public network access" blocks everything including Service Endpoint traffic: only Private Endpoint traffic is allowed.

Encryption

All data in Azure Storage is encrypted at rest using AES-256 by default (Microsoft-managed keys). For regulatory requirements:

• Customer-Managed Keys (CMK): Your key in Key Vault encrypts the storage account's data encryption key. You control rotation and can revoke access.
• Customer-Provided Keys: You send an encryption key on each request: the key is not stored by Azure.

Exam tip: Revoking a CMK by deleting the Key Vault key renders the storage account inaccessible. This is intentional for data sovereignty scenarios.

Defender for Storage

Defender for Storage detects: unusual access patterns, anonymous access to containers, hash reputation analysis for uploaded files, malware scanning (preview). Enable per storage account or per subscription.