Security for Storage

Security measures are required for every request against a resource in the Blob, File, Queue, or Table storage. Secure storage resources guarantee that they are only accessible when we want them and only to the users or applications to which we choose to grant access. They also ensure that only specific users or programs may access the resources. Let’s discuss the measures we can take to secure the storage resources in Azure.

Access control for storage accounts

Storage account provides the following options for implementing access control:

• Integration with Microsoft Entra ID: Azure Storage integrates with Microsoft Entra ID to enable identity-based authorization resources of requests made to the Queue and Blob services. We might provide users, groups, or applications permission to access blob and queue resources utilizing the role-based access control (RBAC) feature of Microsoft Entra ID. We can grant permissions to an individual container or queue at any chosen level. We won’t have to worry about storing our account access key with our code when we use authorization requests from our applications. Authorization can still be used with our blob and queue applications; however, Microsoft advises switching to Microsoft Entra Domain Services for Azure Files. Microsoft Entra Domain Services enables Azure Files to use identity-based permission for Server Message Block (SMB). Using RBAC, we can exercise granular control over a client’s access to the Azure Files resources within a storage account.