Microsoft Azure Essentials Fundamentals of Azure Second Edition e-optimized 5x11 pdf

Securing your storage account  
The first thing to think about is securing your storage account.  
Storage account keys  
Each storage account has two authentication keys—a primary and a secondary—either of which can 
be used for any operation. There are two keys to allow occasional rollover of the keys to enhance 
security. It is critical that these keys be kept secure because their possession, along with the account 
name, allows unlimited access to any data in the storage account.  
Say you’re using key 1 for your storage account in multiple applications. You can regenerate key 2 and 
then change all the applications to use key 2, test them, and deploy them to production. Then, you 
can regenerate key 1, which removes access from anybody who is still using it. A good example of 
when you might want to do this is if your team uses a storage explorer that retains the storage 
account keys, and someone leaves the team or the company—you don’t want them to have access to 
your data after they leaves. This can happen without a lot of notice, so you should have a procedure in 
place to know all the apps that need to change, and then practice rotating keys on a regular basis so 
that it’s simple and not a big problem when it is necessary to rotate the keys in a hurry.