L6. Securing Azure Storage Accounts: Firewalls, Access Policies & Defender for Storage

Baseline Storage Account Hardening

A handful of settings determine most of a storage account's exposure:

• Secure transfer required: forces all requests over HTTPS, rejecting plaintext HTTP
• Minimum TLS version: set to TLS 1.2 (or higher), rejecting older, weaker negotiated connections
• Disable shared key access: shared keys are long-lived, account-wide credentials; disabling them forces all data-plane access through Microsoft Entra ID authentication (Azure RBAC) instead, so access can be scoped per-identity and revoked individually
• Restrict SAS token generation: shared access signatures (SAS) should specify a short expiration, HTTPS-only, and the narrowest possible permission and resource scope; account-level SAS should be avoided in favor of user-delegation SAS (issued using Entra ID credentials, individually revocable) where possible

Configuring the Storage Firewall

Like Key Vault, a storage account's network rules default to accessible from any network unless explicitly restricted:

• Default action: set to Deny, allowing only explicitly listed exceptions
• IP network rules: allow specific public IP ranges
• Virtual network rules (service endpoints): allow traffic only from specified subnets
• Resource instance rules / trusted Microsoft services: allow specific first-party Azure services (e.g., Azure Monitor writing diagnostic logs) to bypass the firewall even when public access is otherwise denied
• Private endpoints: the strongest option, giving the storage account a private IP inside your VNet so traffic never traverses the public internet at all

Defender for Storage Threat Protection

Defender for Storage analyzes activity at the storage account level and flags:

• Malware scanning (near-real-time, using Microsoft Defender Antivirus signatures) on blobs as they're uploaded, useful for accounts accepting user-uploaded content
• Sensitive data threat detection, which uses sensitive data discovery to identify when suspicious operations (like unusual bulk downloads) are happening against blobs known to contain sensitive data, elevating the severity of the alert
• Anomalous access alerts: access from a Tor exit node, unusual application accessing the account for the first time, unexpected volume of delete or download operations consistent with data exfiltration or ransomware staging

Access Control Models Compared

A stored access policy matters specifically because it solves SAS's biggest weakness: without one, revoking a leaked SAS token before its natural expiration requires rotating the entire account key (breaking every other SAS issued from that key). With a stored access policy, you can revoke just that policy's grant. Exam tip: SC-500 favors questions where "disable shared key access and use Azure RBAC / Entra ID auth" is the correct answer over any SAS-based option, since it's both the current Microsoft recommendation and removes the long-lived account-wide credential entirely.