Implement and manage storage
Storage Account Configuration, Encryption, and Data Movement
ImportantConfigure account properties and encryption, then choose Storage Explorer or AzCopy for the administrative task.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Account choices establish the storage namespace, supported services, performance, resilience, and security boundary, while the transfer tool determines how operators move and inspect data.
Must Know
- Select a storage account kind, region, performance option, and redundancy setting that support the required data service and workload.
- Storage service encryption protects data at rest by default; customer-managed keys add control but introduce key-vault access and availability dependencies.
- Storage Explorer is an interactive graphical tool for inspecting and managing storage data across accounts.
- AzCopy is a command-line tool suited to scripted, repeatable, and high-volume copy or synchronization operations.
Compare and Distinguish
- Microsoft-managed key vs customer-managed key: provider-managed encryption lifecycle vs customer-controlled key lifecycle and permissions.
- Storage Explorer vs AzCopy: interactive browsing and one-off administration vs command-line bulk transfer and automation.
- Account configuration vs data object configuration: namespace and service-wide capabilities vs settings on a container, share, or blob.
Scenario examples
- Scenario: An administrator must inspect several containers and upload a few files manually. Think: Use Storage Explorer for interactive data administration.
- Scenario: Terabytes of blobs must be copied nightly by automation. Think: Use AzCopy with suitable authentication and repeatable logging.
- Scenario: A customer-managed key was disabled and storage operations began failing. Think: Restore key availability and verify the storage identity’s key permissions.
Exam traps
- Encryption at rest does not by itself restrict network access or authorize data operations.
- Choosing AzCopy does not remove the need for valid credentials and an allowed network path.
- Changing an account-wide setting can affect several storage services, not just the container currently being viewed.
Key takeaways
- Choose account properties from service compatibility, performance, region, resilience, and security requirements.
- Use Storage Explorer for hands-on inspection and AzCopy for repeatable bulk movement.
How it works
- The storage resource applies account-level configuration, while each data service exposes its own containers or shares.
- Customer-managed encryption uses an authorized storage identity to access a key whose lifecycle is managed separately.
Objects and administrative surfaces
- Storage account — kind, region, performance, redundancy, networking, encryption, and service configuration.
- Container, share, queue, or table — data objects managed through the portal, Storage Explorer, service APIs, or supported commands.
- Client workstation or automation host — Storage Explorer sessions and AzCopy jobs with their chosen authentication.
When to use it
- Use customer-managed keys when the organization requires control over key rotation and revocation.
- Use AzCopy for scripted transfer and Storage Explorer for exploratory or occasional operator tasks.
Security and governance implications
- Protect key-management permissions and avoid embedding account keys in scripts.
- Log transfer activity and scope credentials only to the data and duration required.
How to reason about this
- For account deployment failure, verify provider registration, naming, region, account-kind, policy, and feature compatibility.
- For transfer failure, separate name resolution and firewall admission from authentication, authorization, source path, and destination capacity.
More detail
- Creation choices can constrain later features, so confirm account kind and supported combinations before deployment.
- Both graphical and command-line tools can use Entra or delegated access; the decisive distinction is interaction pattern and scale.
Ready for the quiz?
- What extra dependency appears when customer-managed keys replace Microsoft-managed keys?
- Which tool better fits a scheduled bulk-copy job?
- Which settings belong to the account rather than a blob container?
Related objectives
- D2.2.S1 — Create and configure storage accounts
- D2.2.S4 — Configure storage account encryption
- D2.2.S5 — Manage data by using Azure Storage Explorer and AzCopy