{"id":1036,"date":"2026-07-19T05:17:10","date_gmt":"2026-07-19T05:17:10","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1036"},"modified":"2026-07-19T05:17:11","modified_gmt":"2026-07-19T05:17:11","slug":"azure-storage-services-lab-using-an-existing-ubuntu-24-04-vm","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/azure-storage-services-lab-using-an-existing-ubuntu-24-04-vm\/","title":{"rendered":"Azure Storage Services Lab Using an Existing Ubuntu 24.04 VM"},"content":{"rendered":"\n

Blob Storage, Azure Files and Managed Disks<\/h2>\n\n\n\n

Interface:<\/strong> Azure portal for resource creation and configuration
Client system:<\/strong> Existing Azure VM running Ubuntu Server 24.04 LTS
Validation date:<\/strong> July 19, 2026
Authentication model:<\/strong> Managed identity for Blob Storage; storage account key for the introductory Azure Files SMB exercise<\/p>\n\n\n\n

\n\n\n\n

1. Lab objectives<\/h2>\n\n\n\n

By completing this lab, the student will be able to:<\/p>\n\n\n\n

    \n
  1. Create a general-purpose v2 Azure storage account.<\/li>\n\n\n\n
  2. Create and use a private Blob Storage container.<\/li>\n\n\n\n
  3. Enable a system-assigned managed identity on an existing Ubuntu VM.<\/li>\n\n\n\n
  4. Grant the VM permission to access Blob Storage without storing credentials.<\/li>\n\n\n\n
  5. Upload, list and download blobs from Ubuntu.<\/li>\n\n\n\n
  6. Create an SMB Azure file share.<\/li>\n\n\n\n
  7. Mount the Azure file share on Ubuntu 24.04.<\/li>\n\n\n\n
  8. Configure the file share to mount after a reboot.<\/li>\n\n\n\n
  9. Create and attach an Azure managed data disk.<\/li>\n\n\n\n
  10. Partition, format and permanently mount the disk.<\/li>\n\n\n\n
  11. Transfer a file across the managed disk, Azure Files and Blob Storage.<\/li>\n\n\n\n
  12. Validate and safely clean up all lab resources.<\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n

    2. Lab architecture<\/h2>\n\n\n\n
    Azure Portal\n    |\n    +-- Existing Ubuntu 24.04 VM\n    |       |\n    |       +-- System-assigned managed identity\n    |       +-- \/datadrive          -> Azure Managed Disk\n    |       +-- \/mnt\/azurefiles     -> Azure Files SMB share\n    |       +-- Azure CLI           -> Azure Blob Storage\n    |\n    +-- Standard GPv2 Storage Account\n            |\n            +-- Private blob container: blob-lab\n            +-- SMB file share: files-lab\n<\/code><\/pre>\n\n\n\n
    The VM accesses Blob Storage by using Microsoft Entra ID and Azure RBAC. Microsoft recommends Microsoft Entra credentials for Blob Storage data operations, and Azure VMs can authenticate through a managed identity without storing passwords, keys or service-principal secrets.<\/p>\n\n\n\n
    \n\n\n\n
    3. Required permissions<\/h2>\n\n\n\n
    The student needs permission to:<\/p>\n\n\n\n
      \n
    • View and connect to the existing VM.<\/li>\n\n\n\n
    • Modify the VM to enable its managed identity.<\/li>\n\n\n\n
    • Create a storage account.<\/li>\n\n\n\n
    • Attach a data disk to the VM.<\/li>\n\n\n\n
    • Assign an Azure role to the VM’s managed identity.<\/li>\n<\/ul>\n\n\n\n
      A role such as Contributor<\/strong> can create and modify resources but does not necessarily allow role assignments. Assigning Azure roles requires Microsoft.Authorization\/roleAssignments\/write<\/code>, available through roles such as Role Based Access Control Administrator<\/strong> or User Access Administrator<\/strong>. An instructor can preconfigure the managed-identity role assignment when students do not have this permission.<\/p>\n\n\n\n
      The VM must also have:<\/p>\n\n\n\n
        \n
      • SSH connectivity.<\/li>\n\n\n\n
      • Outbound HTTPS access on TCP 443.<\/li>\n\n\n\n
      • Outbound SMB access on TCP 445 for Azure Files.<\/li>\n\n\n\n
      • sudo<\/code> access inside Ubuntu.<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n
        4. Naming worksheet<\/h2>\n\n\n\n
        Replace these sample values with values assigned by the instructor.<\/p>\n\n\n\n
        Resource<\/th>Lab value<\/th><\/tr><\/thead>
        Existing VM<\/td><vm-name><\/code><\/td><\/tr>
        Resource group<\/td><vm-resource-group><\/code><\/td><\/tr>
        Azure region<\/td>Same region as the VM<\/td><\/tr>
        Storage account<\/td>stlab<initials><digits><\/code><\/td><\/tr>
        Blob container<\/td>blob-lab<\/code><\/td><\/tr>
        Azure file share<\/td>files-lab<\/code><\/td><\/tr>
        Managed disk<\/td>disk-lab-data-01<\/code><\/td><\/tr>
        File share mount point<\/td>\/mnt\/azurefiles<\/code><\/td><\/tr>
        Managed disk mount point<\/td>\/datadrive<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        Storage account names must be globally unique, contain only lowercase letters and numbers, and be between 3 and 24 characters long.<\/p>\n\n\n\n
        \n\n\n\n
        Exercise 1: Inspect the existing Ubuntu VM<\/h1>\n\n\n\n
        Step 1.1: Open the VM<\/h2>\n\n\n\n
          \n
        1. Sign in to the Azure portal.<\/li>\n\n\n\n
        2. In the portal search bar, enter Virtual machines<\/strong>.<\/li>\n\n\n\n
        3. Select Virtual machines<\/strong>.<\/li>\n\n\n\n
        4. Select the existing Ubuntu 24.04 VM.<\/li>\n\n\n\n
        5. On the Overview<\/strong> page, record:\n
            \n
          • VM name<\/li>\n\n\n\n
          • Resource group<\/li>\n\n\n\n
          • Subscription<\/li>\n\n\n\n
          • Location<\/li>\n\n\n\n
          • Public IP address, when present<\/li>\n\n\n\n
          • Virtual network and subnet<\/li>\n<\/ul>\n<\/li>\n\n\n\n
          • Confirm that the VM status is Running<\/strong>.<\/li>\n<\/ol>\n\n\n\n
            Step 1.2: Connect to Ubuntu<\/h2>\n\n\n\n
            From the VM page:<\/p>\n\n\n\n
              \n
            1. Select Connect<\/strong>.<\/li>\n\n\n\n
            2. Select Connect via SSH<\/strong> or the SSH option available in the portal.<\/li>\n\n\n\n
            3. Copy the displayed SSH command.<\/li>\n\n\n\n
            4. Run it from a terminal that has access to the VM.<\/li>\n<\/ol>\n\n\n\n
              Example:<\/p>\n\n\n\n
              ssh <admin-username>@<vm-public-ip>\n<\/code><\/pre>\n\n\n\n
              Validate the operating system:<\/p>\n\n\n\n
              cat \/etc\/os-release\nuname -r\n<\/code><\/pre>\n\n\n\n
              Expected result:<\/p>\n\n\n\n
              NAME=\"Ubuntu\"\nVERSION=\"24.04...\"\n<\/code><\/pre>\n\n\n\n
              \n\n\n\n
              Exercise 2: Create the storage account<\/h1>\n\n\n\n
              This lab uses a Standard general-purpose v2 account. The Preferred storage type<\/strong> selection only customizes the portal guidance; it does not prevent the account from using other supported storage services. Therefore, selecting Azure Files still allows Blob Storage containers to be created in the same GPv2 account.<\/p>\n\n\n\n
              Step 2.1: Start storage account creation<\/h2>\n\n\n\n
                \n
              1. In the Azure portal search bar, enter Storage accounts<\/strong>.<\/li>\n\n\n\n
              2. Select Storage accounts<\/strong>.<\/li>\n\n\n\n
              3. Select Create<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                Step 2.2: Configure the Basics tab<\/h2>\n\n\n\n
                Enter the following values:<\/p>\n\n\n\n
                Setting<\/th>Value<\/th><\/tr><\/thead>
                Subscription<\/td>The subscription containing the VM<\/td><\/tr>
                Resource group<\/td>The VM resource group or an instructor-provided lab resource group<\/td><\/tr>
                Storage account name<\/td>Your globally unique name<\/td><\/tr>
                Region<\/td>Same region as the VM<\/td><\/tr>
                Preferred storage type<\/td>Azure Files<\/td><\/tr>
                Performance<\/td>Standard<\/td><\/tr>
                File share billing<\/td>Pay-as-you-go<\/td><\/tr>
                Redundancy<\/td>Locally-redundant storage, or LRS<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                Using pay-as-you-go allows the same StorageV2 account to host both blobs and an HDD-backed SMB file share. Microsoft currently recommends provisioned v2 for new production Azure Files workloads, but pay-as-you-go remains fully supported and is suitable for a small multipurpose training account.<\/p>\n\n\n\n
                Step 2.3: Configure the Advanced tab<\/h2>\n\n\n\n
                Use these settings:<\/p>\n\n\n\n
                Setting<\/th>Lab selection<\/th><\/tr><\/thead>
                Require secure transfer for REST API operations<\/td>Enabled<\/td><\/tr>
                Allow storage account key access<\/td>Enabled<\/td><\/tr>
                Enable hierarchical namespace<\/td>Disabled<\/td><\/tr>
                Enable SFTP<\/td>Disabled<\/td><\/tr>
                Enable NFS v3<\/td>Disabled<\/td><\/tr>
                Blob access tier<\/td>Hot<\/td><\/tr>
                Enable Managed Identity for SMB<\/td>Disabled for the core lab<\/td><\/tr>
                Require Encryption in Transit for SMB<\/td>Enabled<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                Storage account key access remains enabled because the core Azure Files exercise uses the broadly supported SMB account-key mounting method. Blob Storage will still use managed identity rather than the account key.<\/p>\n\n\n\n
                Step 2.4: Configure the Networking tab<\/h2>\n\n\n\n
                For a classroom lab, configure:<\/p>\n\n\n\n
                Setting<\/th>Lab selection<\/th><\/tr><\/thead>
                Public network access<\/td>Enabled<\/td><\/tr>
                Public network access scope<\/td>Enable from all networks<\/td><\/tr>
                Routing preference<\/td>Microsoft network routing<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                This selection reduces lab failures caused by missing network rules. For production, restrict the storage account through selected virtual networks, private endpoints or another approved network-security model. Azure Storage firewall rules can restrict access by subnet, IP address, resource instance or trusted-service exception.<\/p>\n\n\n\n
                Step 2.5: Create the account<\/h2>\n\n\n\n
                  \n
                1. Select Review + create<\/strong>.<\/li>\n\n\n\n
                2. Wait for validation to succeed.<\/li>\n\n\n\n
                3. Select Create<\/strong>.<\/li>\n\n\n\n
                4. After deployment succeeds, select Go to resource<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                  Validation checkpoint<\/h2>\n\n\n\n
                  On the storage account Overview<\/strong> page, confirm:<\/p>\n\n\n\n
                    \n
                  • Status is available.<\/li>\n\n\n\n
                  • Performance is Standard.<\/li>\n\n\n\n
                  • Redundancy is LRS.<\/li>\n\n\n\n
                  • Account kind is StorageV2.<\/li>\n\n\n\n
                  • Primary location matches the VM region.<\/li>\n<\/ul>\n\n\n\n
                    \n\n\n\n
                    Exercise 3: Create the Blob Storage container<\/h1>\n\n\n\n
                    Step 3.1: Create a private container<\/h2>\n\n\n\n
                      \n
                    1. Open the storage account.<\/li>\n\n\n\n
                    2. Under Data storage<\/strong>, select Containers<\/strong>.<\/li>\n\n\n\n
                    3. Select + Container<\/strong>.<\/li>\n\n\n\n
                    4. Enter:<\/li>\n<\/ol>\n\n\n\n
                      Setting<\/th>Value<\/th><\/tr><\/thead>
                      Name<\/td>blob-lab<\/code><\/td><\/tr>
                      Anonymous access level<\/td>Private \u2014 no anonymous access<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                        \n
                      1. Select Create<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                        Containers hold blobs, and the default private access level prevents anonymous public access.<\/p>\n\n\n\n
                        Validation checkpoint<\/h2>\n\n\n\n
                        The Containers<\/strong> page should now list:<\/p>\n\n\n\n
                        blob-lab\n<\/code><\/pre>\n\n\n\n
                        \n\n\n\n
                        Exercise 4: Enable the VM managed identity<\/h1>\n\n\n\n
                        Step 4.1: Enable the system-assigned identity<\/h2>\n\n\n\n
                          \n
                        1. Open Virtual machines<\/strong>.<\/li>\n\n\n\n
                        2. Select the Ubuntu VM.<\/li>\n\n\n\n
                        3. Under Security<\/strong>, select Identity<\/strong>.<\/li>\n\n\n\n
                        4. Select the System assigned<\/strong> tab.<\/li>\n\n\n\n
                        5. Change Status<\/strong> to On<\/strong>.<\/li>\n\n\n\n
                        6. Select Save<\/strong>.<\/li>\n\n\n\n
                        7. Confirm the operation when prompted.<\/li>\n<\/ol>\n\n\n\n
                          Azure creates a Microsoft Entra service principal tied to the VM’s lifecycle. The credentials are managed by Azure and are not exposed to the student.<\/p>\n\n\n\n
                          Step 4.2: Grant Blob Storage access<\/h2>\n\n\n\n
                            \n
                          1. Return to the storage account.<\/li>\n\n\n\n
                          2. Select Access control (IAM)<\/strong>.<\/li>\n\n\n\n
                          3. Select Add<\/strong>.<\/li>\n\n\n\n
                          4. Select Add role assignment<\/strong>.<\/li>\n\n\n\n
                          5. Search for and select:<\/li>\n<\/ol>\n\n\n\n
                            Storage Blob Data Contributor\n<\/code><\/pre>\n\n\n\n
                              \n
                            1. Select Next<\/strong>.<\/li>\n\n\n\n
                            2. For Assign access to<\/strong>, select Managed identity<\/strong>.<\/li>\n\n\n\n
                            3. Select + Select members<\/strong>.<\/li>\n\n\n\n
                            4. For Managed identity<\/strong>, select Virtual machine<\/strong>.<\/li>\n\n\n\n
                            5. Select the subscription.<\/li>\n\n\n\n
                            6. Select the existing Ubuntu VM.<\/li>\n\n\n\n
                            7. Select Select<\/strong>.<\/li>\n\n\n\n
                            8. Select Review + assign<\/strong>.<\/li>\n\n\n\n
                            9. Select Review + assign<\/strong> again.<\/li>\n<\/ol>\n\n\n\n
                              The Storage Blob Data Contributor role permits the VM identity to read, write and delete blob data. Role assignments can take several minutes, and Microsoft notes that propagation can take up to approximately 10 minutes.<\/p>\n\n\n\n
                              \n\n\n\n
                              Exercise 5: Install Azure CLI on Ubuntu 24.04<\/h1>\n\n\n\n
                              Microsoft’s current Azure CLI installation documentation lists Ubuntu 24.04 as a tested apt-based distribution.<\/p>\n\n\n\n
                              Step 5.1: Check whether Azure CLI is already installed<\/h2>\n\n\n\n
                              az version\n<\/code><\/pre>\n\n\n\n
                              If the command succeeds, continue to Exercise 6.<\/p>\n\n\n\n
                              Step 5.2: Install prerequisites<\/h2>\n\n\n\n
                              sudo apt-get update\nsudo apt-get install -y \\\n  apt-transport-https \\\n  ca-certificates \\\n  curl \\\n  gnupg \\\n  lsb-release\n<\/code><\/pre>\n\n\n\n
                              Step 5.3: Add the Microsoft signing key<\/h2>\n\n\n\n
                              sudo mkdir -p \/etc\/apt\/keyrings\n\ncurl -sLS https:\/\/packages.microsoft.com\/keys\/microsoft.asc \\\n  | gpg --dearmor \\\n  | sudo tee \/etc\/apt\/keyrings\/microsoft.gpg > \/dev\/null\n\nsudo chmod go+r \/etc\/apt\/keyrings\/microsoft.gpg\n<\/code><\/pre>\n\n\n\n
                              Step 5.4: Add the Azure CLI repository<\/h2>\n\n\n\n
                              AZ_DIST=$(lsb_release -cs)\n\necho \"Types: deb\nURIs: https:\/\/packages.microsoft.com\/repos\/azure-cli\/\nSuites: ${AZ_DIST}\nComponents: main\nArchitectures: $(dpkg --print-architecture)\nSigned-by: \/etc\/apt\/keyrings\/microsoft.gpg\" \\\n| sudo tee \/etc\/apt\/sources.list.d\/azure-cli.sources\n<\/code><\/pre>\n\n\n\n
                              Step 5.5: Install Azure CLI<\/h2>\n\n\n\n
                              sudo apt-get update\nsudo apt-get install -y azure-cli\n<\/code><\/pre>\n\n\n\n
                              Validate:<\/p>\n\n\n\n
                              az version\n<\/code><\/pre>\n\n\n\n
                              \n\n\n\n
                              Exercise 6: Use Blob Storage from the VM<\/h1>\n\n\n\n
                              Step 6.1: Sign in with the VM identity<\/h2>\n\n\n\n
                              az login --identity\n<\/code><\/pre>\n\n\n\n
                              The --identity<\/code> option signs Azure CLI in by using the VM’s system-assigned managed identity rather than student credentials or a stored secret.<\/p>\n\n\n\n
                              Step 6.2: Set lab variables<\/h2>\n\n\n\n
                              Replace the storage account value:<\/p>\n\n\n\n
                              STORAGE_ACCOUNT=\"<your-storage-account-name>\"\nBLOB_CONTAINER=\"blob-lab\"\n<\/code><\/pre>\n\n\n\n
                              Check the variables:<\/p>\n\n\n\n
                              echo \"$STORAGE_ACCOUNT\"\necho \"$BLOB_CONTAINER\"\n<\/code><\/pre>\n\n\n\n
                              Step 6.3: Create a sample file<\/h2>\n\n\n\n
                              cat > \"$HOME\/blob-demo.txt\" <<EOF\nAzure Blob Storage lab\nSource VM: $(hostname)\nCreated: $(date --iso-8601=seconds)\nAuthentication: System-assigned managed identity\nEOF\n<\/code><\/pre>\n\n\n\n
                              Display it:<\/p>\n\n\n\n
                              cat \"$HOME\/blob-demo.txt\"\n<\/code><\/pre>\n\n\n\n
                              Step 6.4: Upload the blob<\/h2>\n\n\n\n
                              az storage blob upload \\\n  --account-name \"$STORAGE_ACCOUNT\" \\\n  --container-name \"$BLOB_CONTAINER\" \\\n  --name \"blob-demo.txt\" \\\n  --file \"$HOME\/blob-demo.txt\" \\\n  --auth-mode login\n<\/code><\/pre>\n\n\n\n
                              The --auth-mode login<\/code> option tells Azure CLI to authorize the data operation with the signed-in Microsoft Entra identity.<\/p>\n\n\n\n
                              Step 6.5: List the blobs<\/h2>\n\n\n\n
                              az storage blob list \\\n  --account-name \"$STORAGE_ACCOUNT\" \\\n  --container-name \"$BLOB_CONTAINER\" \\\n  --auth-mode login \\\n  --output table\n<\/code><\/pre>\n\n\n\n
                              Expected result includes:<\/p>\n\n\n\n
                              blob-demo.txt\n<\/code><\/pre>\n\n\n\n
                              Step 6.6: Download the blob<\/h2>\n\n\n\n
                              rm -f \"$HOME\/blob-demo-downloaded.txt\"\n\naz storage blob download \\\n  --account-name \"$STORAGE_ACCOUNT\" \\\n  --container-name \"$BLOB_CONTAINER\" \\\n  --name \"blob-demo.txt\" \\\n  --file \"$HOME\/blob-demo-downloaded.txt\" \\\n  --auth-mode login\n<\/code><\/pre>\n\n\n\n
                              Compare the original and downloaded files:<\/p>\n\n\n\n
                              cmp \"$HOME\/blob-demo.txt\" \"$HOME\/blob-demo-downloaded.txt\" \\\n  && echo \"Blob upload and download validation passed.\"\n<\/code><\/pre>\n\n\n\n
                              Step 6.7: Verify through the portal<\/h2>\n\n\n\n
                                \n
                              1. Open the storage account.<\/li>\n\n\n\n
                              2. Select Containers<\/strong>.<\/li>\n\n\n\n
                              3. Select blob-lab<\/strong>.<\/li>\n\n\n\n
                              4. Confirm that blob-demo.txt<\/code> is present.<\/li>\n\n\n\n
                              5. Select the blob and inspect its properties.<\/li>\n\n\n\n
                              6. Optionally download it through the portal.<\/li>\n<\/ol>\n\n\n\n
                                \n\n\n\n
                                Exercise 7: Create an Azure file share<\/h1>\n\n\n\n
                                Step 7.1: Create the SMB share<\/h2>\n\n\n\n
                                  \n
                                1. Open the storage account.<\/li>\n\n\n\n
                                2. Under Data storage<\/strong>, select Classic file shares<\/strong>.<\/li>\n\n\n\n
                                3. Select + File share<\/strong>.<\/li>\n\n\n\n
                                4. On the Basics<\/strong> tab, configure:<\/li>\n<\/ol>\n\n\n\n
                                  Setting<\/th>Value<\/th><\/tr><\/thead>
                                  Name<\/td>files-lab<\/code><\/td><\/tr>
                                  Access tier<\/td>Transaction optimized<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                    \n
                                  1. Open the Backup<\/strong> tab.<\/li>\n\n\n\n
                                  2. Clear Enable backup<\/strong> for this temporary lab.<\/li>\n\n\n\n
                                  3. Select Review + create<\/strong>.<\/li>\n\n\n\n
                                  4. Select Create<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                                    The Azure portal enables backup by default when creating a classic file share. Disabling it avoids creating extra backup resources for this disposable exercise.<\/p>\n\n\n\n
                                    \n\n\n\n
                                    Exercise 8: Mount Azure Files on Ubuntu<\/h1>\n\n\n\n
                                    This exercise uses SMB with a storage account key because it is simple and broadly reproducible for an introductory lab. Microsoft recommends identity-based access for production implementations. SMB 3.1.1 is the recommended protocol, and Ubuntu versions newer than 18.04 support the required encrypted SMB capabilities.<\/p>\n\n\n\n
                                    Step 8.1: Obtain the portal-generated connection script<\/h2>\n\n\n\n
                                      \n
                                    1. Open the files-lab<\/code> file share.<\/li>\n\n\n\n
                                    2. Select Connect<\/strong>.<\/li>\n\n\n\n
                                    3. Select Linux<\/strong>.<\/li>\n\n\n\n
                                    4. Select the storage-account-key authentication option.<\/li>\n\n\n\n
                                    5. Use \/mnt\/azurefiles<\/code> as the mount location when the portal displays a mount-path field.<\/li>\n\n\n\n
                                    6. Select Show script<\/strong> or the equivalent option.<\/li>\n\n\n\n
                                    7. Copy the generated Linux script.<\/li>\n<\/ol>\n\n\n\n
                                      The generated script is preferable because it contains the exact storage-account endpoint and current account key for the lab.<\/p>\n\n\n\n
                                      Do not include the generated script or storage key in screenshots, reports, source control or chat messages.<\/p>\n\n\n\n
                                      Step 8.2: Install the SMB client<\/h2>\n\n\n\n
                                      On the Ubuntu VM, run:<\/p>\n\n\n\n
                                      sudo apt-get update\nsudo apt-get install -y cifs-utils netcat-openbsd\n<\/code><\/pre>\n\n\n\n
                                      Microsoft’s Linux Azure Files guidance requires cifs-utils<\/code> for SMB mounting.<\/p>\n\n\n\n
                                      Step 8.3: Test TCP 445 connectivity<\/h2>\n\n\n\n
                                      STORAGE_ACCOUNT=\"<your-storage-account-name>\"\nFILE_HOST=\"${STORAGE_ACCOUNT}.file.core.windows.net\"\n\nnc -zvw3 \"$FILE_HOST\" 445\n<\/code><\/pre>\n\n\n\n
                                      Expected result:<\/p>\n\n\n\n
                                      Connection to <storage-account>.file.core.windows.net 445 port succeeded\n<\/code><\/pre>\n\n\n\n
                                      Azure Files SMB uses TCP port 445. A failed test normally indicates an outbound NSG, firewall, routing or DNS restriction.<\/p>\n\n\n\n
                                      Step 8.4: Run the portal-generated script<\/h2>\n\n\n\n
                                      Paste and run the script copied from the Azure portal.<\/p>\n\n\n\n
                                      The script should:<\/p>\n\n\n\n
                                        \n
                                      • Create the local mount directory.<\/li>\n\n\n\n
                                      • Create a protected credentials file.<\/li>\n\n\n\n
                                      • Mount the SMB share.<\/li>\n\n\n\n
                                      • Use the storage account as the SMB username.<\/li>\n\n\n\n
                                      • Use the storage account key as the SMB password.<\/li>\n<\/ul>\n\n\n\n
                                        Step 8.5: Identify the actual mount point<\/h2>\n\n\n\n
                                        findmnt -t cifs\n<\/code><\/pre>\n\n\n\n
                                        If the portal script used the requested location, the output should include:<\/p>\n\n\n\n
                                        \/mnt\/azurefiles\n<\/code><\/pre>\n\n\n\n
                                        Set a variable for later exercises:<\/p>\n\n\n\n
                                        AZURE_FILES_MOUNT=\"\/mnt\/azurefiles\"\n<\/code><\/pre>\n\n\n\n
                                        If the portal script used a different location, replace the value above with the displayed mount point.<\/p>\n\n\n\n
                                        Step 8.6: Write data to the share<\/h2>\n\n\n\n
                                        echo \"Written from Ubuntu VM $(hostname) at $(date --iso-8601=seconds)\" \\\n  | sudo tee \"$AZURE_FILES_MOUNT\/from-ubuntu-vm.txt\"\n<\/code><\/pre>\n\n\n\n
                                        List the share:<\/p>\n\n\n\n
                                        ls -la \"$AZURE_FILES_MOUNT\"\n<\/code><\/pre>\n\n\n\n
                                        Read the file:<\/p>\n\n\n\n
                                        cat \"$AZURE_FILES_MOUNT\/from-ubuntu-vm.txt\"\n<\/code><\/pre>\n\n\n\n
                                        Step 8.7: Verify through the portal<\/h2>\n\n\n\n
                                          \n
                                        1. Return to the files-lab<\/code> share.<\/li>\n\n\n\n
                                        2. Select Browse<\/strong>.<\/li>\n\n\n\n
                                        3. Confirm that from-ubuntu-vm.txt<\/code> appears.<\/li>\n\n\n\n
                                        4. Select or download the file.<\/li>\n\n\n\n
                                        5. Confirm that its content matches the VM output.<\/li>\n<\/ol>\n\n\n\n
                                          Step 8.8: Validate persistent mounting<\/h2>\n\n\n\n
                                          Check whether the portal-generated script added an \/etc\/fstab<\/code> entry:<\/p>\n\n\n\n
                                          grep -n \"$STORAGE_ACCOUNT.file.core.windows.net\" \/etc\/fstab\n<\/code><\/pre>\n\n\n\n
                                          Before testing, back up the file:<\/p>\n\n\n\n
                                          sudo cp \/etc\/fstab \/etc\/fstab.before-azure-files-lab\n<\/code><\/pre>\n\n\n\n
                                          Test all configured mounts without rebooting:<\/p>\n\n\n\n
                                          sudo mount -a\nfindmnt \"$AZURE_FILES_MOUNT\"\n<\/code><\/pre>\n\n\n\n
                                          Do not reboot until sudo mount -a<\/code> completes without errors.<\/p>\n\n\n\n
                                          \n\n\n\n
                                          Exercise 9: Create and attach a managed disk<\/h1>\n\n\n\n
                                          Step 9.1: Attach a new data disk<\/h2>\n\n\n\n
                                            \n
                                          1. In the Azure portal, open the Ubuntu VM.<\/li>\n\n\n\n
                                          2. Under Settings<\/strong>, select Disks<\/strong>.<\/li>\n\n\n\n
                                          3. Under Data disks<\/strong>, select Create and attach a new disk<\/strong>.<\/li>\n\n\n\n
                                          4. Configure:<\/li>\n<\/ol>\n\n\n\n
                                            Setting<\/th>Value<\/th><\/tr><\/thead>
                                            Disk name<\/td>disk-lab-data-01<\/code><\/td><\/tr>
                                            Storage type<\/td>Standard SSD LRS<\/td><\/tr>
                                            Size<\/td>4 GiB or the smallest permitted lab size<\/td><\/tr>
                                            Encryption<\/td>Platform-managed key<\/td><\/tr>
                                            Host caching<\/td>Leave at the displayed default<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                              \n
                                            1. Select Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                                              The portal creates the managed disk and updates the VM configuration. The number of supported data disks depends on the VM size.<\/p>\n\n\n\n
                                              \n\n\n\n
                                              Exercise 10: Prepare the managed disk in Ubuntu<\/h1>\n\n\n\n
                                              Important safety warning<\/h2>\n\n\n\n
                                              Never assume the new disk is \/dev\/sdc<\/code>.<\/p>\n\n\n\n
                                              Depending on the VM size, Azure managed disks can appear through either a SCSI or NVMe interface. The operating-system disk, temporary disk and data disk can therefore have different device names. Formatting the wrong disk causes data loss.<\/p>\n\n\n\n
                                              Step 10.1: Install required utilities<\/h2>\n\n\n\n
                                              sudo apt-get update\nsudo apt-get install -y parted xfsprogs\n<\/code><\/pre>\n\n\n\n
                                              Step 10.2: List the block devices<\/h2>\n\n\n\n
                                              lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL,SERIAL\n<\/code><\/pre>\n\n\n\n
                                              Look for a disk that:<\/p>\n\n\n\n
                                                \n
                                              • Matches the size selected in the portal.<\/li>\n\n\n\n
                                              • Has type disk<\/code>.<\/li>\n\n\n\n
                                              • Has no filesystem.<\/li>\n\n\n\n
                                              • Has no partition.<\/li>\n\n\n\n
                                              • Has no mount point.<\/li>\n<\/ul>\n\n\n\n
                                                A typical SCSI result might be:<\/p>\n\n\n\n
                                                sda      30G disk\n\u251c\u2500sda1   29G part ext4 \/\nsdb      14G disk\n\u2514\u2500sdb1   14G part ext4 \/mnt\nsdc       4G disk\n<\/code><\/pre>\n\n\n\n
                                                In this example, \/dev\/sdc<\/code> is the new disk. \/dev\/sdb<\/code> is already mounted and must not be formatted.<\/p>\n\n\n\n
                                                A VM using NVMe might instead display a device such as:<\/p>\n\n\n\n
                                                nvme0n2   4G disk\n<\/code><\/pre>\n\n\n\n
                                                Step 10.3: Set the correct device variable<\/h2>\n\n\n\n
                                                For a SCSI disk:<\/p>\n\n\n\n
                                                DISK=\"\/dev\/sdc\"\nPARTITION=\"${DISK}1\"\n<\/code><\/pre>\n\n\n\n
                                                For an NVMe disk:<\/p>\n\n\n\n
                                                DISK=\"\/dev\/nvme0n2\"\nPARTITION=\"${DISK}p1\"\n<\/code><\/pre>\n\n\n\n
                                                Inspect the selected device again:<\/p>\n\n\n\n
                                                lsblk \"$DISK\"\n<\/code><\/pre>\n\n\n\n
                                                Continue only when it is unquestionably the new, empty data disk.<\/p>\n\n\n\n
                                                Step 10.4: Create a GPT partition<\/h2>\n\n\n\n
                                                sudo parted \"$DISK\" \\\n  --script \\\n  mklabel gpt \\\n  mkpart xfspart xfs 0% 100%\n<\/code><\/pre>\n\n\n\n
                                                Notify the kernel:<\/p>\n\n\n\n
                                                sudo partprobe \"$DISK\"\n<\/code><\/pre>\n\n\n\n
                                                Verify the partition:<\/p>\n\n\n\n
                                                lsblk \"$DISK\"\n<\/code><\/pre>\n\n\n\n
                                                Step 10.5: Create an XFS filesystem<\/h2>\n\n\n\n
                                                sudo mkfs.xfs \"$PARTITION\"\n<\/code><\/pre>\n\n\n\n
                                                Microsoft’s current managed-disk examples use GPT and XFS and provide separate partition naming examples for SCSI and NVMe devices.<\/p>\n\n\n\n
                                                Step 10.6: Mount the filesystem<\/h2>\n\n\n\n
                                                sudo mkdir -p \/datadrive\nsudo mount \"$PARTITION\" \/datadrive\n<\/code><\/pre>\n\n\n\n
                                                Validate:<\/p>\n\n\n\n
                                                findmnt \/datadrive\ndf -hT \/datadrive\n<\/code><\/pre>\n\n\n\n
                                                Step 10.7: Persist the mount in \/etc\/fstab<\/code><\/h2>\n\n\n\n
                                                Back up the current file:<\/p>\n\n\n\n
                                                sudo cp \/etc\/fstab \/etc\/fstab.before-managed-disk-lab\n<\/code><\/pre>\n\n\n\n
                                                Retrieve the filesystem UUID:<\/p>\n\n\n\n
                                                DISK_UUID=$(sudo blkid -s UUID -o value \"$PARTITION\")\necho \"$DISK_UUID\"\n<\/code><\/pre>\n\n\n\n
                                                Add the entry only when it is not already present:<\/p>\n\n\n\n
                                                grep -q \"UUID=$DISK_UUID\" \/etc\/fstab \\\n  || echo \"UUID=$DISK_UUID \/datadrive xfs defaults,nofail 1 2\" \\\n  | sudo tee -a \/etc\/fstab\n<\/code><\/pre>\n\n\n\n
                                                Using the UUID is safer than using \/dev\/sdc1<\/code> or an NVMe path because device names can change. The nofail<\/code> option helps prevent a missing data disk from blocking VM startup.<\/p>\n\n\n\n
                                                Step 10.8: Test the persistent configuration<\/h2>\n\n\n\n
                                                cd \"$HOME\"\nsudo umount \/datadrive\nsudo mount -a\nfindmnt \/datadrive\n<\/code><\/pre>\n\n\n\n
                                                Create a test file:<\/p>\n\n\n\n
                                                echo \"Managed disk validation: $(date --iso-8601=seconds)\" \\\n  | sudo tee \/datadrive\/managed-disk-test.txt\n<\/code><\/pre>\n\n\n\n
                                                Validate:<\/p>\n\n\n\n
                                                sudo cat \/datadrive\/managed-disk-test.txt\ndf -hT \/datadrive\n<\/code><\/pre>\n\n\n\n
                                                \n\n\n\n
                                                Exercise 11: Integrate all three storage services<\/h1>\n\n\n\n
                                                This exercise proves that the VM can use the managed disk, Azure Files and Blob Storage together.<\/p>\n\n\n\n
                                                Step 11.1: Create evidence on the managed disk<\/h2>\n\n\n\n
                                                sudo tee \/datadrive\/storage-lab-evidence.txt > \/dev\/null <<EOF\nAzure storage lab completed\nVM: $(hostname)\nTimestamp: $(date --iso-8601=seconds)\nSource location: Azure Managed Disk mounted at \/datadrive\nEOF\n<\/code><\/pre>\n\n\n\n
                                                Allow the current user to read it:<\/p>\n\n\n\n
                                                sudo chmod 644 \/datadrive\/storage-lab-evidence.txt\n<\/code><\/pre>\n\n\n\n
                                                Step 11.2: Copy the file to Azure Files<\/h2>\n\n\n\n
                                                sudo cp \\\n  \/datadrive\/storage-lab-evidence.txt \\\n  \"$AZURE_FILES_MOUNT\/storage-lab-evidence.txt\"\n<\/code><\/pre>\n\n\n\n
                                                Validate:<\/p>\n\n\n\n
                                                cat \"$AZURE_FILES_MOUNT\/storage-lab-evidence.txt\"\n<\/code><\/pre>\n\n\n\n
                                                Step 11.3: Upload the same file to Blob Storage<\/h2>\n\n\n\n
                                                az storage blob upload \\\n  --account-name \"$STORAGE_ACCOUNT\" \\\n  --container-name \"$BLOB_CONTAINER\" \\\n  --name \"storage-lab-evidence.txt\" \\\n  --file \"\/datadrive\/storage-lab-evidence.txt\" \\\n  --auth-mode login\n<\/code><\/pre>\n\n\n\n
                                                Step 11.4: Validate all three copies<\/h2>\n\n\n\n
                                                Managed disk:<\/p>\n\n\n\n
                                                sha256sum \/datadrive\/storage-lab-evidence.txt\n<\/code><\/pre>\n\n\n\n
                                                Azure Files:<\/p>\n\n\n\n
                                                sha256sum \"$AZURE_FILES_MOUNT\/storage-lab-evidence.txt\"\n<\/code><\/pre>\n\n\n\n
                                                Download the blob:<\/p>\n\n\n\n
                                                az storage blob download \\\n  --account-name \"$STORAGE_ACCOUNT\" \\\n  --container-name \"$BLOB_CONTAINER\" \\\n  --name \"storage-lab-evidence.txt\" \\\n  --file \"$HOME\/storage-lab-evidence-from-blob.txt\" \\\n  --auth-mode login\n<\/code><\/pre>\n\n\n\n
                                                Blob download:<\/p>\n\n\n\n
                                                sha256sum \"$HOME\/storage-lab-evidence-from-blob.txt\"\n<\/code><\/pre>\n\n\n\n
                                                All three SHA-256 values must be identical.<\/p>\n\n\n\n
                                                \n\n\n\n
                                                Final validation checklist<\/h1>\n\n\n\n
                                                Blob Storage<\/h2>\n\n\n\n
                                                  \n
                                                • blob-lab<\/code> exists.<\/li>\n\n\n\n
                                                • Anonymous access is private.<\/li>\n\n\n\n
                                                • VM system-assigned identity is enabled.<\/li>\n\n\n\n
                                                • VM has Storage Blob Data Contributor.<\/li>\n\n\n\n
                                                • az login --identity<\/code> succeeds.<\/li>\n\n\n\n
                                                • Blob upload succeeds.<\/li>\n\n\n\n
                                                • Blob list displays the uploaded file.<\/li>\n\n\n\n
                                                • Downloaded blob matches the original.<\/li>\n<\/ul>\n\n\n\n
                                                  Azure Files<\/h2>\n\n\n\n
                                                    \n
                                                  • files-lab<\/code> exists.<\/li>\n\n\n\n
                                                  • TCP 445 connectivity succeeds.<\/li>\n\n\n\n
                                                  • cifs-utils<\/code> is installed.<\/li>\n\n\n\n
                                                  • findmnt -t cifs<\/code> displays the share.<\/li>\n\n\n\n
                                                  • Ubuntu can create a file on the share.<\/li>\n\n\n\n
                                                  • The file appears in the portal.<\/li>\n\n\n\n
                                                  • sudo mount -a<\/code> succeeds.<\/li>\n<\/ul>\n\n\n\n
                                                    Managed Disk<\/h2>\n\n\n\n
                                                      \n
                                                    • Managed disk is attached to the VM.<\/li>\n\n\n\n
                                                    • Correct empty disk device was identified.<\/li>\n\n\n\n
                                                    • GPT partition exists.<\/li>\n\n\n\n
                                                    • XFS filesystem exists.<\/li>\n\n\n\n
                                                    • Disk is mounted at \/datadrive<\/code>.<\/li>\n\n\n\n
                                                    • \/etc\/fstab<\/code> uses the filesystem UUID.<\/li>\n\n\n\n
                                                    • \/etc\/fstab<\/code> includes nofail<\/code>.<\/li>\n\n\n\n
                                                    • sudo mount -a<\/code> succeeds.<\/li>\n\n\n\n
                                                    • A file can be created and read on the disk.<\/li>\n<\/ul>\n\n\n\n
                                                      Integrated validation<\/h2>\n\n\n\n
                                                        \n
                                                      • The evidence file exists on the managed disk.<\/li>\n\n\n\n
                                                      • The evidence file exists in Azure Files.<\/li>\n\n\n\n
                                                      • The evidence file exists in Blob Storage.<\/li>\n\n\n\n
                                                      • SHA-256 checksums match.<\/li>\n<\/ul>\n\n\n\n
                                                        \n\n\n\n
                                                        Troubleshooting<\/h1>\n\n\n\n
                                                        Blob command returns AuthorizationPermissionMismatch<\/code><\/h2>\n\n\n\n
                                                        Check:<\/p>\n\n\n\n
                                                          \n
                                                        1. The VM’s system-assigned identity is enabled.<\/li>\n\n\n\n
                                                        2. The role was assigned to the VM managed identity, not to the student.<\/li>\n\n\n\n
                                                        3. The role is Storage Blob Data Contributor<\/strong>.<\/li>\n\n\n\n
                                                        4. The role scope includes the storage account.<\/li>\n\n\n\n
                                                        5. Several minutes have passed since assignment.<\/li>\n<\/ol>\n\n\n\n
                                                          Retry:<\/p>\n\n\n\n
                                                          az logout\naz login --identity\n<\/code><\/pre>\n\n\n\n
                                                          Then rerun the blob command. Azure RBAC changes can take up to approximately 10 minutes to propagate.<\/p>\n\n\n\n
                                                          Blob command returns network or 403 errors<\/h2>\n\n\n\n
                                                          Check:<\/p>\n\n\n\n
                                                            \n
                                                          • Storage account Networking<\/strong>.<\/li>\n\n\n\n
                                                          • Public network access is enabled for the core lab.<\/li>\n\n\n\n
                                                          • The VM has outbound HTTPS access.<\/li>\n\n\n\n
                                                          • The correct storage account name is being used.<\/li>\n<\/ul>\n\n\n\n
                                                            TCP 445 test fails<\/h2>\n\n\n\n
                                                            nc -zvw3 \"${STORAGE_ACCOUNT}.file.core.windows.net\" 445\n<\/code><\/pre>\n\n\n\n
                                                            Check:<\/p>\n\n\n\n
                                                              \n
                                                            • VM NSG outbound rules.<\/li>\n\n\n\n
                                                            • Azure Firewall or third-party firewall rules.<\/li>\n\n\n\n
                                                            • User-defined routes.<\/li>\n\n\n\n
                                                            • DNS resolution.<\/li>\n\n\n\n
                                                            • Storage account firewall rules.<\/li>\n<\/ul>\n\n\n\n
                                                              SMB Azure Files requires TCP 445.<\/p>\n\n\n\n
                                                              Azure Files mount returns Permission denied<\/code><\/h2>\n\n\n\n
                                                              Check:<\/p>\n\n\n\n
                                                                \n
                                                              • The storage account key has not been regenerated.<\/li>\n\n\n\n
                                                              • Storage account key access remains enabled.<\/li>\n\n\n\n
                                                              • The credential file contains the correct account name and current key.<\/li>\n\n\n\n
                                                              • The credential file permissions are 600<\/code>.<\/li>\n\n\n\n
                                                              • The share name is exactly files-lab<\/code>.<\/li>\n<\/ul>\n\n\n\n
                                                                The cleanest lab recovery is to reopen the file share’s Connect<\/strong> page and generate a fresh Linux script.<\/p>\n\n\n\n
                                                                Managed disk does not appear<\/h2>\n\n\n\n
                                                                Run:<\/p>\n\n\n\n
                                                                lsblk\nsudo udevadm settle\nlsblk\n<\/code><\/pre>\n\n\n\n
                                                                For SCSI-based VMs:<\/p>\n\n\n\n
                                                                sudo apt-get install -y lsscsi\nlsscsi\n<\/code><\/pre>\n\n\n\n
                                                                For NVMe-based VMs:<\/p>\n\n\n\n
                                                                sudo apt-get install -y nvme-cli\nsudo nvme list\n<\/code><\/pre>\n\n\n\n
                                                                Do not format a device until its size, interface, existing partitions and mount status have been verified.<\/p>\n\n\n\n
                                                                \/etc\/fstab<\/code> validation fails<\/h2>\n\n\n\n
                                                                Restore the appropriate backup:<\/p>\n\n\n\n
                                                                sudo cp \/etc\/fstab.before-managed-disk-lab \/etc\/fstab\n<\/code><\/pre>\n\n\n\n
                                                                Or, for the Azure Files backup:<\/p>\n\n\n\n
                                                                sudo cp \/etc\/fstab.before-azure-files-lab \/etc\/fstab\n<\/code><\/pre>\n\n\n\n
                                                                Then test:<\/p>\n\n\n\n
                                                                sudo mount -a\n<\/code><\/pre>\n\n\n\n
                                                                Never reboot after changing \/etc\/fstab<\/code> until sudo mount -a<\/code> completes successfully.<\/p>\n\n\n\n
                                                                \n\n\n\n
                                                                Cleanup<\/h1>\n\n\n\n
                                                                Important<\/h2>\n\n\n\n
                                                                Do not delete the resource group when it also contains the pre-existing VM or other shared classroom resources.<\/p>\n\n\n\n
                                                                Step 1: Remove the Azure Files mount<\/h2>\n\n\n\n
                                                                cd \"$HOME\"\nsudo umount \"$AZURE_FILES_MOUNT\"\n<\/code><\/pre>\n\n\n\n
                                                                Remove the Azure Files entry from \/etc\/fstab<\/code>:<\/p>\n\n\n\n
                                                                sudo nano \/etc\/fstab\n<\/code><\/pre>\n\n\n\n
                                                                Delete only the line containing:<\/p>\n\n\n\n
                                                                .file.core.windows.net\n<\/code><\/pre>\n\n\n\n
                                                                Remove the credentials file:<\/p>\n\n\n\n
                                                                sudo rm -f \"\/etc\/smbcredentials\/${STORAGE_ACCOUNT}.cred\"\n<\/code><\/pre>\n\n\n\n
                                                                Optionally remove the mount directory:<\/p>\n\n\n\n
                                                                sudo rmdir \"$AZURE_FILES_MOUNT\" 2>\/dev\/null || true\n<\/code><\/pre>\n\n\n\n
                                                                Step 2: Remove the managed disk mount<\/h2>\n\n\n\n
                                                                cd \"$HOME\"\nsudo umount \/datadrive\nsudo nano \/etc\/fstab\n<\/code><\/pre>\n\n\n\n
                                                                Delete only the line that mounts the managed-disk UUID at \/datadrive<\/code>.<\/p>\n\n\n\n
                                                                Validate:<\/p>\n\n\n\n
                                                                sudo mount -a\n<\/code><\/pre>\n\n\n\n
                                                                Step 3: Detach the managed disk<\/h2>\n\n\n\n
                                                                  \n
                                                                1. Open the VM in the Azure portal.<\/li>\n\n\n\n
                                                                2. Select Disks<\/strong>.<\/li>\n\n\n\n
                                                                3. Locate disk-lab-data-01<\/code>.<\/li>\n\n\n\n
                                                                4. Select the detach option.<\/li>\n\n\n\n
                                                                5. Select Save<\/strong>.<\/li>\n\n\n\n
                                                                6. Search for Disks<\/strong> in the portal.<\/li>\n\n\n\n
                                                                7. Open disk-lab-data-01<\/code>.<\/li>\n\n\n\n
                                                                8. Select Delete<\/strong>.<\/li>\n\n\n\n
                                                                9. Confirm deletion.<\/li>\n<\/ol>\n\n\n\n
                                                                  Step 4: Delete storage resources<\/h2>\n\n\n\n
                                                                  Either delete individual resources:<\/p>\n\n\n\n
                                                                    \n
                                                                  • Delete blob-lab<\/code>.<\/li>\n\n\n\n
                                                                  • Delete files-lab<\/code>.<\/li>\n<\/ul>\n\n\n\n
                                                                    Or delete the complete lab storage account:<\/p>\n\n\n\n
                                                                      \n
                                                                    1. Open the storage account.<\/li>\n\n\n\n
                                                                    2. Select Delete<\/strong>.<\/li>\n\n\n\n
                                                                    3. Enter the storage account name.<\/li>\n\n\n\n
                                                                    4. Confirm deletion.<\/li>\n<\/ol>\n\n\n\n
                                                                      Step 5: Review the managed identity<\/h2>\n\n\n\n
                                                                      The VM’s system-assigned identity may remain enabled for future exercises. If the instructor requires its removal:<\/p>\n\n\n\n
                                                                        \n
                                                                      1. Open the VM.<\/li>\n\n\n\n
                                                                      2. Select Identity<\/strong>.<\/li>\n\n\n\n
                                                                      3. Set System assigned<\/strong> to Off<\/strong>.<\/li>\n\n\n\n
                                                                      4. Select Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
                                                                        \n\n\n\n
                                                                        Production-hardening discussion<\/h1>\n\n\n\n
                                                                        The core lab prioritizes repeatability. A production implementation should additionally evaluate:<\/p>\n\n\n\n
                                                                          \n
                                                                        1. Private endpoints or selected virtual-network access instead of allowing all networks.<\/li>\n\n\n\n
                                                                        2. Separate storage accounts based on workload, security boundary and lifecycle.<\/li>\n\n\n\n
                                                                        3. Provisioned v2 Azure Files for new production file-share deployments.<\/li>\n\n\n\n
                                                                        4. Managed identity or another approved identity-based method for Azure Files instead of storage account keys.<\/li>\n\n\n\n
                                                                        5. Storage-account key rotation when keys remain enabled.<\/li>\n\n\n\n
                                                                        6. Azure Backup for important file shares.<\/li>\n\n\n\n
                                                                        7. Blob soft delete, versioning and lifecycle-management policies.<\/li>\n\n\n\n
                                                                        8. Zone-redundant or geo-redundant storage based on recovery requirements.<\/li>\n\n\n\n
                                                                        9. Azure Monitor diagnostic settings, alerts and storage metrics.<\/li>\n\n\n\n
                                                                        10. Least-privilege role assignments scoped to the required container or service.<\/li>\n<\/ol>\n\n\n\n
                                                                          Microsoft recommends managed identities over storage account keys where supported, and Azure Storage network controls can restrict storage endpoints to approved networks and resources.<\/p>\n","protected":false},"excerpt":{"rendered":"
                                                                          Blob Storage, Azure Files and Managed Disks Interface: Azure portal for resource creation and configurationClient system: Existing Azure VM running Ubuntu Server 24.04 LTSValidation date: July 19,… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1036","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1036"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1036\/revisions"}],"predecessor-version":[{"id":1037,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1036\/revisions\/1037"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}