Implement and manage storage
This domain covers storage account selection, replication, access control, and data movement. Questions often hinge on durability, tier cost, and whether a client can read the secondary endpoint.
Account and replication
Choose general-purpose v2 for blobs, files, queues, and tables; premium block blob, file, or page blob accounts serve performance-sensitive workloads. LRS keeps three copies in one datacenter; ZRS spreads three copies across availability zones; GRS adds asynchronous replication to a paired region; GZRS combines zones with a regional pair. Only RA-GRS and RA-GZRS expose a readable secondary endpoint. Hot, cool, cold, and archive tiers trade storage cost for access cost and latency. Archive requires rehydration, which can take hours, and early deletion before 180 days incurs charges. Lifecycle rules can tier or delete base blobs, snapshots, and versions using last-modified days and prefix filters.
Access
Account keys grant full access; prefer Entra ID with Storage Blob Data roles. A SAS can be account, service, or user-delegation based; user delegation SAS is secured by Entra credentials and is the safest for blobs. Stored access policies let you revoke a service SAS without rotating keys. Disable shared key access where possible, restrict public network access, and use private endpoints for private IP access. Azure Files supports SMB and NFS; identity-based SMB access uses AD DS or Entra Domain Services.
Worked example
A 5 TB archive must survive a regional outage and be read once a year. Create a GPv2 account with GRS, or GZRS if zone redundancy is required, upload to hot, and add a lifecycle rule moving blobs to archive after 30 days. Reasoning: GRS satisfies regional durability, archive minimizes storage cost, and the 30-day delay avoids early-deletion charges. Reading requires rehydration to cool or hot first.
Traps
The secondary endpoint is unreadable with plain GRS. Archive objects cannot be downloaded directly. Changing replication does not convert existing data instantly. Rotating keys invalidates SAS signed with the old key, but revoking a stored access policy is faster. AzCopy handles scripted transfers; Data Box suits hundreds of terabytes.