← Back to catalog
📚 Series

Azure - Implement and Manage Storage

The AZ-104 storage objectives, covered end to end: how Azure keeps data durable, who is allowed to reach it, and what it costs. Work through the series to gain the judgement to pick the right redundancy, the right authorization model and the right cost tier for a real workload.

Episodes (8)

  1. 1 Sequence 1 — Foundations & Architecture of Azure Storage The entry point to the whole AZ-104 storage module — it builds the mental map every later lesson assumes. You leave able to name the four core data services (Blob, Files, Queue, Table), explain the account → service → container → object hierarchy, construct any storage endpoint URL from memory, and reason about per-account scale limits. Packed with exam-ready mnemonics (D-S-S-M-A, B-F-Q-T, B-A-P), a worked endpoint drill, and exercises with answer keys, it turns vague familiarity with Azure Storage into a precise vocabulary you can build on.
  2. 2 Sequence 2 — Create & Configure Storage Accounts Turns the architecture from Sequence 1 into a real, working storage account. You learn to create accounts in the portal, Azure CLI and PowerShell, and — crucially — to nail the three choices that are permanent forever: Name, Kind, Performance (the N-K-P rule). Covers Standard vs Premium tiers, the four account kinds, how a single SKU token encodes both performance and redundancy, the hierarchical-namespace / ADLS Gen2 toggle, and post-creation management (upgrade, move, delete). High-yield material for the 'Create and configure storage accounts' exam objective.
  3. 3 Sequence 3 — Storage Redundancy & Disaster Recovery Azure Storage always keeps multiple copies of your data — this lesson teaches you to choose how far apart they live. You decode all six redundancy options (LRS, ZRS, GRS, RA-GRS, GZRS, RA-GZRS) from just two axes, map each to a durability figure and the outage it survives, and master the high-value disaster-recovery details: the sharp difference between planned and unplanned failover, what each does to your account, and how RPO/RTO and Last Sync Time quantify possible data loss. Directly targets the 'Configure Azure Storage redundancy' exam objective, with classic traps (Azure Files has no RA-) called out.
  4. 4 Sequence 4 — Encryption at Rest & Object Replication Two features the exam loves to test together — kept clearly apart here. The first half nails encryption at rest: the always-on AES-256 SSE baseline and the three key-management models (Microsoft-managed, customer-managed in Key Vault, customer-provided), with the exam-heavy CMK details — soft-delete + purge protection, managed-identity permissions, automatic vs manual rotation, the disable-key kill switch, infrastructure (double) encryption, and encryption scopes. The second half builds object replication step by step, with its make-or-break prerequisites ('change feed on the source, versioning on both'). Covers the 'Configure storage account encryption' and 'Configure object replication' objectives.
  5. 5 Sequence 5 — Managing Data: Storage Explorer & AzCopy The hands-on toolbox episode: which client to grab for each data-movement job, and how to drive the two that matter most. You learn to attach Azure Storage Explorer to a resource four different ways (and why owning an account isn't data access), then run AzCopy v10 reliably — authorizing with Entra ID or SAS, uploading with include/exclude patterns, and choosing sync (a one-way mirror that moves only the delta) over copy at exactly the right moment. Practical, command-by-command coverage of the 'Manage data with Storage Explorer and AzCopy' exam objective.
  6. 6 Sequence 6 — Authorization Foundations: Access Keys & SAS The authorization foundations the next three sequences build on. You learn the four ways to authorize data access (Entra, Shared Key, SAS, anonymous — 'ESSA'), how to rotate and protect the two account keys with zero downtime, and the three SAS types ('USA': user-delegation, service, account) — when to use each, how to read a token's anatomy field by field, and why user-delegation SAS is preferred. Crucially, it shows how to revoke access: stored access policies for instant server-side revocation, and an account-level SAS expiration policy to cap lifetime. Covers the 'Manage access keys', 'Create and use SAS tokens', and 'Configure stored access policies' objectives in one pass.
  7. 7 Sequence 7 — Microsoft Entra ID, RBAC & Anonymous Access The recommended, secret-free way to authorize storage data — and the single most-tested distinction in the module: management plane vs data plane. You learn how Entra ID + OAuth 2.0 + Azure RBAC authorize requests, why 'Owner ≠ data owner', the built-in blob data roles (Reader / Contributor / Owner), how to scope assignments for least privilege, and the propagation delays behind AuthorizationPermissionMismatch. It then closes the Shared Key back door (disable it to force Entra) and shows the two-gate model for locking down anonymous public read. Covers the identity-based-access and anonymous-access objectives.
  8. 8 Sequence 8 — Network Security: Firewalls, VNets & Private Endpoints The network-perimeter complement to identity: deciding which networks may even reach a storage account. You learn the public-access master switch and why firewall rules do nothing until the default action is Deny (and how to avoid locking yourself out), the four rule types (IP ranges, VNet service endpoints, resource instances, trusted-service bypass), and how to deploy a private endpoint — including the exam-favorite privatelink DNS flow and the 'both dfs + blob for Data Lake' trap. Closes with a clear service-endpoint-vs-private-endpoint decision. Directly targets 'Configure Azure Storage firewalls and virtual networks'.