Disk Storage and Storage Security

Azure Managed Disks are block-level storage volumes attached to Azure VMs — the cloud equivalent of a physical hard drive or SSD in a server. Azure manages the disk: it handles storage account placement, redundancy, and lifecycle automatically. Before Managed Disks, customers had to manage storage accounts and VHD files themselves, which was error-prone. Today, Managed Disks are the standard way to provide persistent OS and data storage for VMs, simplifying management and supporting availability set and zone deployments natively.

Azure offers four managed disk types: Standard HDD — lowest cost, up to 500 IOPS/disk; for dev/test VMs and non-critical workloads. Standard SSD — more consistent performance than HDD, up to 6,000 IOPS; for lightly used web servers and CI/CD build agents. Premium SSD — high performance, up to 20,000 IOPS; for production databases, enterprise applications, and any I/O-sensitive workload. Ultra Disk — highest performance, up to 160,000 IOPS with sub-millisecond latency; for the most demanding workloads like SAP HANA and top-tier SQL Server. Ultra Disks require VMs with specific families and configurations.

An Azure VM has up to three disk roles: OS disk — contains the operating system (Windows or Linux), maximum size 4 TB, must be Premium or Standard SSD for reliable performance. Data disks — additional managed disks for application data, databases, or log files; you can attach multiple data disks (up to 32 for larger VM sizes). Temporary disk — local SSD on the host server, very fast (hundreds of thousands of IOPS) but not persistent; data is lost on VM deallocation or redeployment. Never store important data on the temporary disk.

Azure Managed Disks support disk snapshots — point-in-time read-only copies of a disk at a specific moment. Snapshots are stored in Azure Storage and billed per GB of used data (not the full allocated disk size). You can create a new disk from a snapshot to restore a VM to a previous state or to clone a disk for testing. For production backup, Azure Backup automates snapshot scheduling, retention, and cross-region backup with a consistent application-aware backup rather than a raw disk snapshot.

Azure Shared Disks allow a single managed disk to be attached to multiple VMs simultaneously — enabling clustered application scenarios such as SQL Server Failover Cluster Instances or SAP ASCS clusters. Shared disks are available on Premium SSD and Ultra Disk tiers with a specific maxShares setting that limits how many VMs can mount the disk concurrently. The application is responsible for coordinating access using clustering software (Windows Server Failover Clustering or a Linux equivalent) to prevent data corruption from simultaneous writes.

Azure Managed Disks encrypt all data at rest by default using Server-Side Encryption (SSE) with AES-256-bit keys. By default, Microsoft manages the encryption keys (Platform-Managed Keys). For organisations that require control over encryption keys, Customer-Managed Keys (CMK) stored in Azure Key Vault can be used instead. A third option — Azure Disk Encryption (ADE) — encrypts the OS and data disks using BitLocker (Windows) or DM-Crypt (Linux), so the disk is encrypted at the OS level in addition to the platform level, providing defence in depth.

A Shared Access Signature (SAS) is a URI that grants restricted, time-limited access to Azure Storage resources (blobs, files, queues, tables) without sharing the account's master access keys. A SAS token specifies: Resource (which blob or container), Permissions (read, write, delete, list), Start and expiry time, and optionally IP restrictions. There are three SAS types: Account SAS (multiple services), Service SAS (single service), and User delegation SAS (backed by Entra ID credentials, most secure).

A Private Endpoint assigns a private IP address from your VNet to an Azure Storage account, making it accessible within your virtual network over the Azure private backbone — with no traffic flowing over the public internet. After creating a private endpoint for a storage account, you can disable the account's public endpoint entirely, ensuring it is only reachable from within the connected VNet (and via VPN/ExpressRoute from on-premises). Private endpoints are the most secure way to access storage accounts from VMs, Kubernetes clusters, or on-premises systems.

Before implementing Private Endpoints, many organisations use the Storage Account Firewall to restrict access to specific IP ranges or virtual network subnets. The firewall is configured in the 'Networking' blade of the storage account in the Azure portal. You can allow access from: Specific public IP ranges (e.g., your office's NAT IP), specific VNet subnets (using service endpoints), or Azure services (trusted Microsoft services like Azure Backup and Azure Monitor). Firewall rules are an important layer of defence even when using RBAC for data-plane access control.

Microsoft Defender for Storage (part of Defender for Cloud) monitors your storage accounts for anomalous access patterns that may indicate a security threat — such as access from unusual locations, access of many files in a short period (ransomware exfiltration), or the upload of known malware files. Defender for Storage alerts are sent to your security team and can trigger automated responses via Logic Apps or Function Apps. Enabling Defender for Storage is a best practice for production storage accounts holding sensitive or business-critical data.

Applying the following storage security best practices gives you a strong security posture: Never share account keys in code — use managed identities or SAS tokens. Enable RBAC for data-plane access instead of key-based auth where possible. Use Private Endpoints to eliminate public internet exposure for sensitive data. Enable Storage Firewall to restrict access to known networks. Turn on soft delete and versioning to recover from accidental deletion. Enable Defender for Storage for anomaly detection. Enforce HTTPS only to prevent unencrypted access. Together, these controls address the most common storage security risks.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: managed disks come in four types — Standard HDD, Standard SSD, Premium SSD, and Ultra Disk — each suited for different performance and cost requirements, Shared Access Signatures provide time-limited, permission-scoped access to storage resources without sharing master keys, and private endpoints and storage firewalls restrict access to trusted networks, eliminating public internet exposure. Next up we begin Azure Networking — starting with Virtual Networks and subnets.