https://<account>.blob.core.windows.net/demo-container/sample.txt?<sas-token>
``

Open in browser—you should download sample.txt

After 1 hour, this URL will expire and access will fail


> Tip: SAS tokens are great for temporary sharing. Generate new ones for each user/device to minimize blast radius if leaked.

<h3 id="step-4-test-entra-id-access">Step 4: Test Entra ID access</h3>

Go to the storage account > <strong>Access control (IAM)</strong> > <strong>Add role assignment</strong>
<strong>Role</strong>: <strong>Storage Blob Data Reader</strong>
<strong>Assign to</strong>: your user account
Open <strong>Containers</strong> > demo-container

In the top toolbar, switch <strong>Authentication method</strong> from <strong>Access key</strong> to <strong>Microsoft Entra user account</strong>
Confirm you can still view sample.txt


> Important: This uses your Entra identity + RBAC instead of account keys. This is the most secure approach for production.



<h2 id="part-5-network-rules">Part 5 – Network rules</h2>

<h3 id="restricting-access">Restricting Access</h3>

> Warning: Network rules can lock you out if misconfigured. Always test before deploying to production.

<h3 id="step-1-enable-network-rules">Step 1: Enable network rules</h3>

<strong>Networking</strong> (under <strong>Security + networking</strong>)
<strong>Public network access</strong>: select <strong>Enabled from selected virtual networks and IP addresses</strong>
Under <strong>Firewall</strong>, select <strong>Add your client IP address</strong> to allow-list your current IP
<strong>Save</strong>

<h3 id="step-2-test-the-restriction">Step 2: Test the restriction</h3>

Confirm you can still access the storage account (you're on the allow-list)
Try accessing from a different network/VPN (should fail with 403 Forbidden)
Observe that having the access key alone is NOT enough—network rules now take precedence

> Tip: In production, use Service Endpoints or Private Endpoints instead of IP ranges for more security.

<h3 id="step-3-revert-for-simplicity">Step 3: Revert for simplicity</h3>

Go back to <strong>Networking</strong> > <strong>Public network access</strong>: <strong>Enable from all networks</strong>
<strong>Save</strong> (to not interfere with other labs)



<h2 id="part-6-copy-data-with-storage-browser">Part 6 – Copy data with Storage browser</h2>

<h3 id="step-1-copy-blob-between-containers">Step 1: Copy blob between containers</h3>

<strong>Storage browser</strong> > <strong>Blob containers</strong> > demo-container > select sample.txt

<strong>Copy</strong>
Create a new container demo-container-2 (or navigate to an existing empty one)

<strong>Paste</strong>—the blob is now copied


> Tip: This is the Portal equivalent of azcopy. For large data migrations, use AzCopy CLI for speed.


<h3 id="step-2-download-and-upload">Step 2: Download and upload</h3>

Select sample.txt > <strong>Download</strong> (pulls to your local machine)

Modify the file locally
Go back to <strong>Upload</strong> > upload the modified file
Confirm the updated file is in the container




<h2 id="success-criteria">Success Criteria</h2>

✓ Storage account created with StorageV2, LRS, Hot tier
✓ Container, queue, table, and file share all exist
✓ SAS URL grants time-limited read access to blob
✓ Entra ID authentication works (view blob with your user account)
✓ Network rule restricts access to allow-listed IPs
✓ Blob successfully copied between containers



<h2 id="cleanup-if-needed">Cleanup (If Needed)</h2>