AZ-104: Implement and Manage Storage – The Ultimate 2026 Deep Dive

Welcome to the definitive guide for mastering the “Implement and manage storage” domain of the AZ-104 Azure Administrator certification exam. As an experienced Azure instructor, I’ve seen countless students struggle with the sheer breadth of Azure’s storage offerings. It’s not just about knowing what a Blob is; it’s about understanding the architectural decisions, security implications, and cost trade-offs that separate a certified professional from an amateur.

This deep dive is designed to be your single source of truth. We will move beyond simple definitions and into the realm of real-world application, architecture-level analysis, and the critical nuances that frequently appear as exam questions. By the end of this guide, you will not only understand what the services are but why and when to use them, ensuring you are fully prepared for both the certification exam and real-world Azure administration tasks in 2026. If you’re just starting your journey, check out our AZ-104 Study Plan and detailed guide on Azure Certification Path.

The Foundation: Azure Storage Accounts

Everything in Azure Storage begins with the Azure Storage Account. Think of it not just as a container, but as a unique namespace in Azure with its own security boundary, performance settings, and redundancy configuration. Getting this foundational element right is critical to building a scalable and cost-effective solution.

Understanding the Storage Account Model

A Storage Account is a top-level Azure Resource Manager (ARM) resource that provides a unique namespace for your data, accessible via HTTP or HTTPS. It’s the management container for the core storage services: Blobs, Files, Queues, and Tables. For the AZ-104 exam, your primary focus will be on Blobs, Files, and the underlying account configuration.

Storage Account Types: Choosing Your Base

Azure offers several types of storage accounts, but for the AZ-104, your focus should be on the modern options. The recommended best practice is to always use General-purpose v2 (GPv2) unless you have a highly specific workload.

Exam Tip: For any exam question that doesn’t specify a high-performance or low-latency requirement, General-purpose v2 is almost always the correct answer. It is the most versatile and current standard. Not sure how AZ-104 compares with other Microsoft exams? See our breakdown of AZ-104 vs. AZ-204 and AZ-104 vs. AZ-305.

Redundancy Options: Architecting for Resilience

How Azure replicates your data is one of the most tested concepts. Choosing the right redundancy strategy is a balance between availability, durability, and cost.

Memory Technique (Mnemonic): Think of the letters. Local < Zone < Geo.

• L = Least resilient (single data center)
• Z = More resilient (spans multiple data centers/zones in a region)
• G = Most resilient (spans multiple regions)

Real-world Scenario: A financial services company hosts its primary transaction database application in the “East US 2” region. To comply with regulations, they need a disaster recovery site hundreds of miles away. They also need to run analytics queries on the data without impacting the primary application’s performance. The ideal solution is RA-GRS (or RA-GZRS for maximum resilience). This provides a failover copy in a paired region (e.g., Central US) and allows their analytics platform to read from the secondary endpoint, isolating the read workload. For more exam context, check out AZ-104 Certification Worth It? and the latest AZ-104 Salary & Job Opportunities.

Mastering Azure Blob Storage

Azure Blob Storage is Microsoft’s object storage solution, optimized for storing massive amounts of unstructured data, such as text, images, videos, and application binaries.

Core Concepts: Containers and Blobs

• Container: A container organizes a set of blobs, similar to a directory in a file system. All blobs must reside in a container.
• Blob Types:
  • Block Blobs: Composed of blocks of data. Ideal for streaming and storing large files like videos or backups. This is the most common type.
  • Append Blobs: Similar to block blobs but optimized for append operations. Perfect for logging scenarios where new data is continuously added to the end of a file.
  • Page Blobs: Used to store random-access files up to 8 TB in size, primarily the VHD files for Azure VMs. You will interact with these more through Managed Disks than directly.

Access Tiers: Optimizing for Cost and Performance

One of the most powerful features of Blob storage is the ability to manage costs by placing data in different access tiers.

• Hot Tier: Optimized for storing data that is accessed frequently. Highest storage cost, lowest access cost.
• Cool Tier: Optimized for storing data that is infrequently accessed and stored for at least 30 days. Lower storage cost, higher access cost than Hot.
• Cold Tier: Optimized for data accessed maybe once or twice a year, stored for at least 90 days. Very low storage costs, higher access costs than Cool.
• Archive Tier: For long-term archival of data that is rarely accessed, stored for at least 180 days. Lowest storage cost, but highest retrieval cost and latency (can take hours to “rehydrate” data back to Hot or Cool). If you’re preparing for multiple certifications, don’t miss our comparison of AZ-900 vs. AZ-104 and AZ-900 vs. MS-900.

Azure Blob access tiers (Hot, Cool, Cold, Archive) allow you to balance storage costs against data retrieval time. Hot is for frequently accessed data with instant access, while Archive is for long-term storage with the lowest cost but retrieval times of several hours.

Lifecycle Management Policies

Manually moving blobs between tiers is inefficient. This is where lifecycle management comes in. You can create rule-based policies to automate this process.

Common Use Case: Automatically move log files from the Hot tier to the Cool tier after 30 days, then to the Archive tier after 90 days, and finally delete them after 7 years to comply with retention policies.

Step-by-Step: Creating a Lifecycle Policy

1. Navigate to your Storage Account in the Azure portal.
2. Under “Data management,” select “Lifecycle management.”
3. Click “Add a rule.”
4. Define the rule scope (e.g., apply to all blobs or filter by prefix).
5. Set the conditions. For example:
   • IF Base blob was last modified more than 30 days ago
   • THEN Move to Cool storage
6. Add another condition:
   • IF Base blob was last modified more than 90 days ago
   • THEN Move to Archive storage
7. Save the rule. Azure will now handle this automatically.

Implementing Azure Files and File Sync

Azure Files offers fully managed cloud file shares that you can access via the industry-standard Server Message Block (SMB) and Network File System (NFS) protocols. It’s the go-to solution for “lift-and-shift” applications that rely on traditional file shares.

Azure Files: Cloud-Native SMB & NFS Shares

Unlike Blob storage, which requires API calls, Azure Files allows you to mount a share just like a network drive on Windows, Linux, or macOS.

Performance Tiers:

• Standard (HDD-based): Good for general-purpose file shares, dev/test, and applications that are not I/O sensitive. Billed on a pay-as-you-go model.
• Premium (SSD-based): For I/O-intensive workloads like databases, high-performance computing (HPC), and enterprise applications. Billed on a provisioned model (you pay for the size of the share, not just what you use).
• Transaction Optimized: A tier within Standard storage optimized for transaction-heavy workloads that don’t need Premium performance.

Securing Azure Files: AD Integration

A common challenge with cloud file shares is replicating on-premises permissions. Azure Files solves this by enabling identity-based authentication over SMB through Azure Active Directory Domain Services (Azure AD DS) or on-premises Active Directory Domain Services (AD DS).

Common Pitfall: Many administrators set up an Azure File share and only use the storage account key for access. This grants full admin rights to anyone with the key. For production environments, the best practice is to join the storage account to a domain and use standard NTFS-style permissions for granular user and group access control.

Azure File Sync: The Hybrid Cloud Bridge

What if you have an on-premises file server that you want to extend to the cloud? Azure File Sync is the answer. It synchronizes files from your on-premises Windows Server to an Azure File share, providing a centralized file service while maintaining the performance of a local server. Want to learn how storage fits into other domains? Read our guide on AZ-104 Azure Virtual Networking and Monitoring & Maintaining Azure Resources.

Key Components:

• Storage Sync Service: The top-level resource in Azure for File Sync.
• Sync Group: Defines the sync topology for a set of files. It contains one cloud endpoint and one or more server endpoints.
• Cloud Endpoint: An Azure File share that is part of a sync group.
• Server Endpoint: A path on a registered Windows Server that is being synced.

Cloud Tiering Explained: This is the killer feature of Azure File Sync. It allows you to set policies that automatically tier your least-accessed files to the Azure cloud, leaving only a pointer (a reparse point) on the local server. The file still appears to be local, but when a user accesses it, it’s seamlessly recalled from the Azure File share.

Analogy: Think of Cloud Tiering like a smart, infinitely large cache for your on-premises file server. It keeps the “hot” data local for fast access and moves the “cold” data to the cloud, freeing up local disk space.

Managing Azure Disks for Virtual Machines

While Azure Files and Blobs are for unstructured data, Azure Disks are block-level storage volumes for your Azure Virtual Machines. They function like physical disks in a server, but with the benefits of cloud management and scale.

Managed vs. Unmanaged Disks

• Unmanaged Disks: The legacy method where you had to create and manage the underlying storage accounts for your VHD files. You were responsible for scalability and performance limits. Avoid using these.
• Managed Disks: The modern standard. Azure manages the storage accounts for you, abstracting away the complexity and providing better reliability, scalability, and security.

Exam Tip: If you see “Unmanaged Disks” on the exam, it’s likely a distractor or part of a question about migrating to the modern standard, which is Managed Disks.

Disk Types Deep Dive

Choosing the right disk type is a critical decision that impacts both the performance and cost of your VMs.

Disk Encryption

Security is paramount. Azure offers multiple ways to encrypt your VM disks.

• Server-Side Encryption (SSE): This is encryption-at-rest and is enabled by default on all Managed Disks. The data is encrypted before being written to the storage cluster.
  • Platform-Managed Key (PMK): Microsoft manages the encryption keys. This is the default.
  • Customer-Managed Key (CMK): You provide and manage your own encryption keys using Azure Key Vault. This gives you full control and is often required for compliance.
• Azure Disk Encryption (ADE): This encrypts both the OS and data disks of a VM within the guest OS using BitLocker for Windows and DM-Crypt for Linux. ADE is useful for protecting the VHDs from being accessed if they were somehow downloaded from the storage account. We’ve also covered the cost factor in detail: Microsoft Azure Certification Cost and Highest Paying Microsoft Azure Certifications.

Securing Azure Storage: A Multi-Layered Approach

A storage account without proper security is a significant risk. Azure provides a robust, layered security model.

Authentication vs. Authorization

• Authentication: Proving you are who you say you are. In Azure Storage, this is typically done with a Storage Account Access Key or an Azure AD identity.
• Authorization: Determining what an authenticated identity is allowed to do. This is handled by RBAC, SAS tokens, or Access Policies.

Authorization Methods

Network Security: Service Endpoints vs. Private Endpoints

Securing access to your storage account from a network perspective is a critical exam topic.

• Firewalls and Virtual Networks: The simplest form of network security. You can configure the storage account to only accept traffic from specific public IP addresses or from subnets within a Virtual Network (VNet).
• Service Endpoints:
  • How it works: Extends your VNet’s private address space to the storage service over the Azure backbone network. The traffic from your VNet to the storage account is optimized, but the endpoint on the storage account is still a public IP.
  • Analogy: It’s like a dedicated, high-speed lane on a public highway. You are still on the highway, but in a secure, direct lane.
• Private Endpoints:
  • How it works: Creates a network interface (NIC) with a private IP address from your VNet’s address space. This NIC maps directly to your storage account. All traffic to the storage account stays entirely on the Microsoft private network.
  • Analogy: It’s like building a private driveway directly from your house (VNet) to the store (storage account), completely avoiding the public highway.
  • Architecture-level analysis: Private Endpoints are the superior solution for maximum security as they eliminate any public internet exposure for your storage account. They are the standard for highly secure enterprise environments.

Frequently Asked Questions (FAQ)

I’m preparing for the AZ-104. Can you explain the difference between LRS, ZRS, GRS, and GZRS in simple terms?

The key difference is the scope of data replication for protection against failures. LRS protects against a disk or server rack failure within one data center. ZRS protects against an entire data center failure within a region. GRS and GZRS protect against a total regional failure by replicating your data to another region hundreds of miles away.

Think of it like backing up your photos. LRS is like having a copy on another hard drive in the same room. ZRS is like having a copy in a safe at your neighbor’s house. GRS/GZRS is like having a copy in a bank vault in another city. For the AZ-104 exam, know that ZRS provides high availability within a region, while GRS/GZRS provides disaster recovery across regions.

When should I use Azure Files instead of Azure Blob Storage?

Use Azure Files when you need a traditional file share that can be mounted as a network drive using SMB or NFS protocols. Use Azure Blob Storage for storing large amounts of unstructured object data that will be accessed via HTTP/HTTPS APIs.

Essentially, if your application is designed to read/write to a C:\ or /mnt/ path, Azure Files is the perfect fit. It’s ideal for lifting and shifting legacy applications. If your application is a modern cloud-native app designed to work with object storage (like storing user-uploaded images for a website), Blob storage is the more scalable and cost-effective choice.

I’m confused about Shared Access Signatures (SAS). Why not just use the account access key?

You should almost never use the account access key in an application because it grants full, permanent administrative control over your entire storage account. A Shared Access Signature (SAS) is a much more secure method for delegating limited, temporary access.

Think of the access key as the master key to an entire hotel. A SAS token is like a temporary keycard for a single room that only works for one night and can only open the door (read), not redecorate (write/delete). You can create a SAS token that allows a user to only upload a file (write permission) to a specific container, for a duration of only 15 minutes. This massively reduces your security risk.

What’s the real-world difference between a Service Endpoint and a Private Endpoint for a storage account?

A Service Endpoint secures the connection from your virtual network to the storage account over the Azure backbone, but the storage account still has a public IP address. A Private Endpoint gives the storage account a private IP address directly within your virtual network, completely removing it from the public internet.

Pro Tip: For maximum security, always choose a Private Endpoint. It ensures that traffic to your storage account never traverses the public internet. This is the recommended approach for any production workload handling sensitive data. On the exam, if a question asks for the most secure way to connect a VNet to a storage account, the answer is Private Endpoint.

How do I decide which VM disk type to use? It seems complicated.

The choice boils down to a balance of performance versus cost. Start with this simple decision tree:

• Is this for Dev/Test or a non-critical, low-I/O app? Use Standard HDD.
• Is this a light-use production server like a small web server? Start with Standard SSD.
• Is this a production database or a performance-sensitive application? Use Premium SSD.
• Do I need to independently control IOPS and throughput for a very high-performance database? Use Premium SSD v2 or Ultra Disk.

Always start with the most cost-effective option that meets your minimum performance requirements and monitor the disk performance metrics (IOPS, latency). You can always resize or change the disk type later if needed.

Will I be tested on older concepts like Unmanaged Disks or Classic Storage Accounts?

It’s unlikely you’ll see deep questions on them, but you should know what they are and why they are considered legacy. The exam focuses on modern best practices. A question might be framed around migrating from an Unmanaged Disk to a Managed Disk, so understanding the benefits of the modern approach (better scalability, reliability, security) is important.

What’s the main purpose of Azure File Sync in a production environment?

The primary purpose of Azure File Sync is to centralize your organization’s file shares in Azure Files while keeping the performance benefits of having a local file server on-premises. Its “cloud tiering” feature is the main draw, as it allows you to have a small, fast local server that acts as a cache for a massive file share stored in Azure, saving significant local storage costs.

Can you explain immutability for Blob storage? How is it used?

Immutability (Write-Once, Read-Many or WORM) policies make your data non-erasable and non-modifiable for a user-defined interval. It’s a critical feature for meeting regulatory compliance and data retention requirements, such as SEC 17a-4 for financial records or HIPAA for healthcare data. There are two modes: Time-based retention (e.g., “lock this data for 7 years”) and Legal hold (locks the data indefinitely until the hold is removed).

Why am I getting an authorization error when trying to access a file share, even with the right key?

This is a common troubleshooting scenario. If you’re using the storage account key, the most likely issue is a network firewall rule on the storage account blocking your client’s IP address. If you’re using Azure AD authentication, the problem could be that your user identity doesn’t have the correct RBAC role (like “Storage File Data SMB Share Contributor”) assigned, or that the share-level NTFS permissions haven’t been configured correctly.

How important is PowerShell and Azure CLI for managing storage on the AZ-104 exam?

Very important. While the portal is great for learning, the exam will absolutely test your knowledge of CLI and PowerShell commands for performing administrative tasks. You should be comfortable with commands like az storage account create, az storage blob upload, New-AzStorageContainer, and Set-AzStorageFileContent. You won’t need to write complex scripts, but you must be able to recognize and understand what a given command does.

Can I use Azure AD to secure blob containers like I can with file shares?

Yes, absolutely. Azure RBAC roles can be used to grant permissions to Azure AD identities (users, groups, service principals) at the storage account or individual container level. This is the recommended modern approach for controlling access to blob data, as it avoids the need for SAS tokens or account keys. For example, you can assign the “Storage Blob Data Reader” role to a user group to give them read-only access to a container.

What is the difference between SSE with PMK and SSE with CMK?

Both are methods of Server-Side Encryption (SSE) for data at rest. With Platform-Managed Keys (PMK), Microsoft handles the entire lifecycle of the encryption keys automatically. With Customer-Managed Keys (CMK), you control the encryption keys using Azure Key Vault. You are responsible for creating, rotating, and revoking the keys. CMK is used when you have strict compliance requirements that mandate control over the encryption keys.

How does the Cold access tier for blobs fit in with Hot, Cool, and Archive?

The Cold tier is a relatively new online tier that fits between Cool and Archive. It’s for data that is stored for at least 90 days and accessed infrequently (maybe once or twice a year). It offers lower storage costs than the Cool tier but with similar instant-access retrieval latency. Archive is still the cheapest for long-term storage, but data takes hours to retrieve (“rehydrate”). Cold provides a good middle ground.

What do I need to know before I can start setting up Azure File Sync?

Before you set up Azure File Sync, you need an Azure File share (to act as the cloud endpoint) and an on-premises (or Azure VM) Windows Server (2012 R2 or newer) to install the File Sync agent on. You’ll also need to create a Storage Sync Service in Azure. Critically, ensure your server has internet connectivity to communicate with Azure.

How is Azure storage priced? What are the main components I’ll be billed for?

Azure storage billing primarily has three components:

1. Data at Rest: You pay per GB per month for the amount of data you store. This rate varies significantly based on the service (Blob, Files), performance tier (Standard, Premium), and redundancy option (LRS, GRS, etc.).
2. Operations: You are charged for transactions (read/write operations). This is usually a small charge per 10,000 operations. Hot tiers have cheaper operations, while Cool/Cold/Archive tiers have more expensive ones.
3. Data Egress: You are charged for data transferred out of an Azure region. Data ingress (transferring in) is free. This is a crucial cost to consider for applications that involve frequent data downloads. You can find detailed pricing information on the official Azure Storage Pricing page.

Key Takeaways

• Foundation First: Always start with the correct Storage Account configuration (GPv2, appropriate redundancy). This choice has long-term cost and resilience implications.
• Right Tool for the Job: Use Blobs for object storage (APIs), Files for shared drives (SMB/NFS), and Disks for VMs.
• Tier for Cost: Aggressively use Blob access tiers (Hot, Cool, Cold, Archive) and Lifecycle Management to automate cost savings.
• Security is Layered: Never rely on just one security mechanism. Combine identity (Azure AD RBAC), network controls (Private Endpoints), and data encryption (SSE/ADE) for a robust defense-in-depth strategy.
• Modern is Better: Always choose Managed Disks over Unmanaged, and GPv2 accounts over older types. The exam will test modern best practices.
• Hybrid is Reality: Understand Azure File Sync as a critical tool for bridging on-premises infrastructure with the Azure cloud.

Study Tips for Azure Administrator

1. Hands-On Labs: Theory is not enough. Create a free Azure account and practice every concept. Create storage accounts with different redundancy options. Set up a lifecycle policy. Mount an Azure File share. Deploy a VM with a Premium SSD.
2. Command Line Practice: Spend time in both Azure CLI and PowerShell. Don’t just copy-paste commands; understand the parameters (–sku, –kind, –access-tier). The exam expects this proficiency.
3. Draw the Architectures: Whiteboard the difference between a Service Endpoint and a Private Endpoint. Draw the components of an Azure File Sync deployment. Visualizing these concepts will solidify your understanding.
4. Focus on “Why”: For every feature, ask yourself, “What business problem does this solve?” Why would I choose ZRS over LRS? Why use a SAS token instead of an access key? The exam tests your decision-making ability, not just your memory.

Conclusion

Mastering Azure Storage is non-negotiable for passing the AZ-104 exam and becoming a competent Azure Administrator. It is a foundational pillar upon which nearly all other Azure services are built. By understanding the architectural decisions behind each storage type, the critical importance of layered security, and the nuances of cost optimization, you are positioning yourself for success. Use this guide as your roadmap, dive into the Azure portal to get hands-on experience, and you will be well-equipped to conquer any storage-related challenge that comes your way. Looking for trusted study resources? Download our AZ-104 Exam Dumps or explore all Microsoft Exam Dumps. For complete certification coverage, visit our Microsoft Certifications Guide.

Still confused between cloud providers? Compare AWS vs. Azure Salary to make the right career move. And don’t forget to check our latest articles on Pass IT Exams.