managed identity and granular data-plane roles avoid distributing powerful long-lived secrets. In this case, an organization wants to prevent apps from using storage shared-key authorization. “Use supported identity-based authorization instead of storing shared account keys” would not satisfy that requirement; the supported action is “Disable shared-key authorization where supported and migrate to Entra-based access”. Disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed.

key rotation invalidates compromised shared-key credentials after dependent applications are migrated safely. In this case, an organization wants to prevent apps from using storage shared-key authorization. “Rotate the affected storage account key and update legitimate clients” would not satisfy that requirement; the supported action is “Disable shared-key authorization where supported and migrate to Entra-based access”. Disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed.

dual account keys can support continuity during shared-key credential rotation. In this case, an organization wants to prevent apps from using storage shared-key authorization. “They enable staggered key rotation while clients move between credentials” would not satisfy that requirement; the supported action is “Disable shared-key authorization where supported and migrate to Entra-based access”. Disallowing shared keys reduces risk from broad, long-lived credentials, after compatibility is assessed.

a container organizes blob objects while the storage account supplies service endpoints and configuration. In this case, an application needs general-purpose blobs, files, queues and tables in one new account. “A storage account and a blob container within it” would not satisfy that requirement; the supported action is “A general-purpose v2 StorageV2 account”. StorageV2 supports common Azure Storage services and modern redundancy and data protection features.

account-level anonymous access restrictions prevent public container/blob anonymous reads. In this case, an application needs general-purpose blobs, files, queues and tables in one new account. “Disallow anonymous blob access at the storage-account level” would not satisfy that requirement; the supported action is “A general-purpose v2 StorageV2 account”. StorageV2 supports common Azure Storage services and modern redundancy and data protection features.

secure transfer required enforces encrypted transport to supported storage endpoints. In this case, an application needs general-purpose blobs, files, queues and tables in one new account. “Require secure transfer for the storage account” would not satisfy that requirement; the supported action is “A general-purpose v2 StorageV2 account”. StorageV2 supports common Azure Storage services and modern redundancy and data protection features.

account-level anonymous access restrictions prevent public container/blob anonymous reads. In this case, an account should store application objects and provide access through the Blob endpoint. “Disallow anonymous blob access at the storage-account level” would not satisfy that requirement; the supported action is “A storage account and a blob container within it”. A container organizes blob objects while the storage account supplies service endpoints and configuration.

secure transfer required enforces encrypted transport to supported storage endpoints. In this case, an account should store application objects and provide access through the Blob endpoint. “Require secure transfer for the storage account” would not satisfy that requirement; the supported action is “A storage account and a blob container within it”. A container organizes blob objects while the storage account supplies service endpoints and configuration.

storage service URLs and network configuration differ by service and account settings. In this case, an account should store application objects and provide access through the Blob endpoint. “The account's specific blob or file service endpoint and network policy” would not satisfy that requirement; the supported action is “A storage account and a blob container within it”. A container organizes blob objects while the storage account supplies service endpoints and configuration.

a container organizes blob objects while the storage account supplies service endpoints and configuration. In this case, a newly created account must block public anonymous access to all blobs. “A storage account and a blob container within it” would not satisfy that requirement; the supported action is “Disallow anonymous blob access at the storage-account level”. Account-level anonymous access restrictions prevent public container/blob anonymous reads.

secure transfer required enforces encrypted transport to supported storage endpoints. In this case, a newly created account must block public anonymous access to all blobs. “Require secure transfer for the storage account” would not satisfy that requirement; the supported action is “Disallow anonymous blob access at the storage-account level”. Account-level anonymous access restrictions prevent public container/blob anonymous reads.

storage account names participate in service DNS addresses and cannot conflict within Azure's naming scope. In this case, a newly created account must block public anonymous access to all blobs. “Choose an available globally unique storage-account name” would not satisfy that requirement; the supported action is “Disallow anonymous blob access at the storage-account level”. Account-level anonymous access restrictions prevent public container/blob anonymous reads.

a container organizes blob objects while the storage account supplies service endpoints and configuration. In this case, a storage account needs to use HTTPS rather than plain HTTP for client operations. “A storage account and a blob container within it” would not satisfy that requirement; the supported action is “Require secure transfer for the storage account”. Secure transfer required enforces encrypted transport to supported storage endpoints.

storage account names participate in service DNS addresses and cannot conflict within Azure's naming scope. In this case, a storage account needs to use HTTPS rather than plain HTTP for client operations. “Choose an available globally unique storage-account name” would not satisfy that requirement; the supported action is “Require secure transfer for the storage account”. Secure transfer required enforces encrypted transport to supported storage endpoints.

storageV2 supports common Azure Storage services and modern redundancy and data protection features. In this case, a storage account needs to use HTTPS rather than plain HTTP for client operations. “A general-purpose v2 StorageV2 account” would not satisfy that requirement; the supported action is “Require secure transfer for the storage account”. Secure transfer required enforces encrypted transport to supported storage endpoints.

secure transfer required enforces encrypted transport to supported storage endpoints. In this case, an organization sets a minimum TLS policy for a storage account. “Require secure transfer for the storage account” would not satisfy that requirement; the supported action is “Reject client TLS connections below the supported minimum version”. Minimum TLS version settings constrain transport protocol negotiation for storage service access.

storage account names participate in service DNS addresses and cannot conflict within Azure's naming scope. In this case, an organization sets a minimum TLS policy for a storage account. “Choose an available globally unique storage-account name” would not satisfy that requirement; the supported action is “Reject client TLS connections below the supported minimum version”. Minimum TLS version settings constrain transport protocol negotiation for storage service access.

storageV2 supports common Azure Storage services and modern redundancy and data protection features. In this case, an organization sets a minimum TLS policy for a storage account. “A general-purpose v2 StorageV2 account” would not satisfy that requirement; the supported action is “Reject client TLS connections below the supported minimum version”. Minimum TLS version settings constrain transport protocol negotiation for storage service access.

account-level anonymous access restrictions prevent public container/blob anonymous reads. In this case, a team wants public network traffic disabled entirely and connectivity only via Private Link. “Disallow anonymous blob access at the storage-account level” would not satisfy that requirement; the supported action is “Disable public network access and deploy appropriate private endpoints”. Private endpoints supply the private path when the public service endpoint is disallowed.

storage service URLs and network configuration differ by service and account settings. In this case, a team wants public network traffic disabled entirely and connectivity only via Private Link. “The account's specific blob or file service endpoint and network policy” would not satisfy that requirement; the supported action is “Disable public network access and deploy appropriate private endpoints”. Private endpoints supply the private path when the public service endpoint is disallowed.

a container organizes blob objects while the storage account supplies service endpoints and configuration. In this case, a team wants public network traffic disabled entirely and connectivity only via Private Link. “A storage account and a blob container within it” would not satisfy that requirement; the supported action is “Disable public network access and deploy appropriate private endpoints”. Private endpoints supply the private path when the public service endpoint is disallowed.

secure transfer required enforces encrypted transport to supported storage endpoints. In this case, an account must expose a unique global DNS name for its Azure Storage endpoints. “Require secure transfer for the storage account” would not satisfy that requirement; the supported action is “Choose an available globally unique storage-account name”. Storage account names participate in service DNS addresses and cannot conflict within Azure's naming scope.

a container organizes blob objects while the storage account supplies service endpoints and configuration. In this case, an account must expose a unique global DNS name for its Azure Storage endpoints. “A storage account and a blob container within it” would not satisfy that requirement; the supported action is “Choose an available globally unique storage-account name”. Storage account names participate in service DNS addresses and cannot conflict within Azure's naming scope.

storage service URLs and network configuration differ by service and account settings. In this case, an account must expose a unique global DNS name for its Azure Storage endpoints. “The account's specific blob or file service endpoint and network policy” would not satisfy that requirement; the supported action is “Choose an available globally unique storage-account name”. Storage account names participate in service DNS addresses and cannot conflict within Azure's naming scope.

a container organizes blob objects while the storage account supplies service endpoints and configuration. In this case, an administrator must determine whether a storage service endpoint is reachable. “A storage account and a blob container within it” would not satisfy that requirement; the supported action is “The account's specific blob or file service endpoint and network policy”. Storage service URLs and network configuration differ by service and account settings.

storage account names participate in service DNS addresses and cannot conflict within Azure's naming scope. In this case, an administrator must determine whether a storage service endpoint is reachable. “Choose an available globally unique storage-account name” would not satisfy that requirement; the supported action is “The account's specific blob or file service endpoint and network policy”. Storage service URLs and network configuration differ by service and account settings.

account-level anonymous access restrictions prevent public container/blob anonymous reads. In this case, an administrator must determine whether a storage service endpoint is reachable. “Disallow anonymous blob access at the storage-account level” would not satisfy that requirement; the supported action is “The account's specific blob or file service endpoint and network policy”. Storage service URLs and network configuration differ by service and account settings.

LRS does not distribute copies across separate availability zones. In this case, a business needs synchronous replication across availability zones inside one region, but has no requirement for secondary-region replication. “Locally redundant storage (LRS)” would not satisfy that requirement; the supported action is “Zone-redundant storage (ZRS) in a supported region”. ZRS synchronously copies data across availability zones in one region.

Standard GRS does not inherently distribute primary copies across availability zones. In this case, a business needs synchronous replication across availability zones inside one region, but has no requirement for secondary-region replication. “Geo-redundant storage (GRS) with primary LRS” would not satisfy that requirement; the supported action is “Zone-redundant storage (ZRS) in a supported region”. ZRS synchronously copies data across availability zones in one region.

Object access tier is unrelated to synchronous zone-level replication. In this case, a business needs synchronous replication across availability zones inside one region, but has no requirement for secondary-region replication. “Archive blob access tier” would not satisfy that requirement; the supported action is “Zone-redundant storage (ZRS) in a supported region”. ZRS synchronously copies data across availability zones in one region.

zRS synchronously copies data across availability zones in one region. In this case, a low-cost test workload only needs copies within one datacenter. “Zone-redundant storage (ZRS) in a supported region” would not satisfy that requirement; the supported action is “Locally redundant storage (LRS)”. LRS maintains replicas within one physical location and does not protect against an entire datacenter loss.

gRS asynchronously replicates regional data to a secondary geography in addition to primary local replicas. In this case, a low-cost test workload only needs copies within one datacenter. “Geo-redundant storage (GRS)” would not satisfy that requirement; the supported action is “Locally redundant storage (LRS)”. LRS maintains replicas within one physical location and does not protect against an entire datacenter loss.

read-access geo redundancy exposes the secondary endpoint for read scenarios while replication remains asynchronous. In this case, a low-cost test workload only needs copies within one datacenter. “Read-access geo-redundant storage such as RA-GRS” would not satisfy that requirement; the supported action is “Locally redundant storage (LRS)”. LRS maintains replicas within one physical location and does not protect against an entire datacenter loss.