Generate and assign a new Storage Account Identity for this storage account for use with key management services like Azure KeyVault.azure-storage-sid Specify the security identifier (SID) for Azure Storage. The key is auto-generated and serves as a password, rather than an as a cryptographic key. Key Vault manages storage account keys by storing them as Key Vault secrets. You can use the Key Vault managed storage account key feature to list (sync) keys with an Azure storage account, and regenerate (rotate) the keys periodically. Oct 12, 2017 Overview In this scenario, you want to provide your customer with a secured URL to download a file from Azure Storage. You can do this programmatically of course but another option is to use the Azure Storage Explorer to create a Shared Access Signature (SAS) for your customer. Then provide the URL necessary with the. Alternatively, get the Account SAS Token from the Azure Portal. Go to your Storage Account; Select Shared access signature from the menu on the left; Click on Generate SAS and connection string (after setup) Shared Key Credential. Use Account name and Account key. Account name is your Storage Account name. Go to your Storage Account. Generate and assign a new Storage Account Identity for this storage account for use with key management services like Azure KeyVault.

-->

A connection string includes the authorization information required for your application to access data in an Azure Storage account at runtime using Shared Key authorization. You can configure connection strings to:

  • Connect to the Azure storage emulator.
  • Access a storage account in Azure.
  • Access specified resources in Azure via a shared access signature (SAS).

Protect your access keys

Your storage account access keys are similar to a root password for your storage account. Always be careful to protect your access keys. Use Azure Key Vault to manage and rotate your keys securely. Avoid distributing access keys to other users, hard-coding them, or saving them anywhere in plain text that is accessible to others. Rotate your keys if you believe they may have been compromised.

If possible, use Azure Active Directory (Azure AD) to authorize requests to Blob and Queue storage instead of Shared Key. Azure AD provides superior security and ease of use over Shared Key. For more information about authorizing access to data with Azure AD, see Authorize access to Azure blobs and queues using Azure Active Directory.

View and copy a connection string

To view and copy your storage account access keys or connection string from the Azure portal:

  1. Navigate to the Azure portal.

  2. Locate your storage account.

  3. Under Settings, select Access keys. Your account access keys appear, as well as the complete connection string for each key.

  4. Find the Key value under key1, and click the Copy button to copy the account key.

  5. Alternately, you can copy the entire connection string. Find the Connection string value under key1, and click the Copy button to copy the connection string.

You can use either key to access Azure Storage, but in general it's a good practice to use the first key, and reserve the use of the second key for when you are rotating keys.

To view or read an account's access keys, the user must either be a Service Administrator, or must be assigned an RBAC role that includes the Microsoft.Storage/storageAccounts/listkeys/action. Some built-in RBAC roles that include this action are the Owner, Contributor, and Storage Account Key Operator Service Role roles. For more information about the Service Administrator role, see Classic subscription administrator roles, Azure RBAC roles, and Azure AD roles. For detailed information about built-in roles for Azure Storage, see the Storage section in Azure built-in roles for Azure RBAC.

Store a connection string

Your application needs to access the connection string at runtime to authorize requests made to Azure Storage. You have several options for storing your connection string:

  • You can store your connection string in an environment variable.
  • An application running on the desktop or on a device can store the connection string in an app.config or web.config file. Add the connection string to the AppSettings section in these files.
  • An application running in an Azure cloud service can store the connection string in the Azure service configuration schema (.cscfg) file. Add the connection string to the ConfigurationSettings section of the service configuration file.

Storing your connection string in a configuration file makes it easy to update the connection string to switch between the storage emulator and an Azure storage account in the cloud. You only need to edit the connection string to point to your target environment.

You can use the Microsoft Azure Configuration Manager to access your connection string at runtime regardless of where your application is running.

Configure a connection string for the storage emulator

The storage emulator supports a single fixed account and a well-known authentication key for Shared Key authentication. This account and key are the only Shared Key credentials permitted for use with the storage emulator. They are:

Note

The authentication key supported by the storage emulator is intended only for testing the functionality of your client authentication code. It does not serve any security purpose. You cannot use your production storage account and key with the storage emulator. You should not use the development account with production data.

The storage emulator supports connection via HTTP only. However, HTTPS is the recommended protocol for accessing resources in a production Azure storage account.

Connect to the emulator account using a shortcut

The easiest way to connect to the storage emulator from your application is to configure a connection string in your application's configuration file that references the shortcut UseDevelopmentStorage=true. Here's an example of a connection string to the storage emulator in an app.config file:

Connect to the emulator account using the well-known account name and key

To create a connection string that references the emulator account name and key, you must specify the endpoints for each of the services you wish to use from the emulator in the connection string. This is necessary so that the connection string will reference the emulator endpoints, which are different than those for a production storage account. For example, the value of your connection string will look like this:

This value is identical to the shortcut shown above, UseDevelopmentStorage=true.

Specify an HTTP proxy

You can also specify an HTTP proxy to use when you're testing your service against the storage emulator. This can be useful for observing HTTP requests and responses while you're debugging operations against the storage services. To specify a proxy, add the DevelopmentStorageProxyUri option to the connection string, and set its value to the proxy URI. For example, here is a connection string that points to the storage emulator and configures an HTTP proxy:

For more information about the storage emulator, see Use the Azure storage emulator for development and testing.

Configure a connection string for an Azure storage account

To create a connection string for your Azure storage account, use the following format. Indicate whether you want to connect to the storage account through HTTPS (recommended) or HTTP, replace myAccountName with the name of your storage account, and replace myAccountKey with your account access key:

DefaultEndpointsProtocol=[http https];AccountName=myAccountName;AccountKey=myAccountKey

For example, your connection string might look similar to:

DefaultEndpointsProtocol=https;AccountName=storagesample;AccountKey=<account-key>

Although Azure Storage supports both HTTP and HTTPS in a connection string, HTTPS is highly recommended.

Tip

You can find your storage account's connection strings in the Azure portal. Navigate to SETTINGS > Access keys in your storage account's menu blade to see connection strings for both primary and secondary access keys.

Create a connection string using a shared access signature

If you possess a shared access signature (SAS) URL that grants you access to resources in a storage account, you can use the SAS in a connection string. Because the SAS contains the information required to authenticate the request, a connection string with a SAS provides the protocol, the service endpoint, and the necessary credentials to access the resource.

To create a connection string that includes a shared access signature, specify the string in the following format:

Each service endpoint is optional, although the connection string must contain at least one.

Note

Using HTTPS with a SAS is recommended as a best practice.

If you are specifying a SAS in a connection string in a configuration file, you may need to encode special characters in the URL.

Service SAS example

Here's an example of a connection string that includes a service SAS for Blob storage:

And here's an example of the same connection string with encoding of special characters:

Account SAS example

Here's an example of a connection string that includes an account SAS for Blob and File storage. Note that endpoints for both services are specified:

And here's an example of the same connection string with URL encoding:

Create a connection string for an explicit storage endpoint

You can specify explicit service endpoints in your connection string instead of using the default endpoints. To create a connection string that specifies an explicit endpoint, specify the complete service endpoint for each service, including the protocol specification (HTTPS (recommended) or HTTP), in the following format:

One scenario where you might wish to specify an explicit endpoint is when you've mapped your Blob storage endpoint to a custom domain. In that case, you can specify your custom endpoint for Blob storage in your connection string. You can optionally specify the default endpoints for the other services if your application uses them.

Here is an example of a connection string that specifies an explicit endpoint for the Blob service:

This example specifies explicit endpoints for all services, including a custom domain for the Blob service:

The endpoint values in a connection string are used to construct the request URIs to the storage services, and dictate the form of any URIs that are returned to your code.

If you've mapped a storage endpoint to a custom domain and omit that endpoint from a connection string, then you will not be able to use that connection string to access data in that service from your code.

Important

Service endpoint values in your connection strings must be well-formed URIs, including https:// (recommended) or http://. Because Azure Storage does not yet support HTTPS for custom domains, you must specify http:// for any endpoint URI that points to a custom domain.

Create a connection string with an endpoint suffix

To create a connection string for a storage service in regions or instances with different endpoint suffixes, such as for Azure China 21Vianet or Azure Government, use the following connection string format. Indicate whether you want to connect to the storage account through HTTPS (recommended) or HTTP, replace myAccountName with the name of your storage account, replace myAccountKey with your account access key, and replace mySuffix with the URI suffix:

Here's an example connection string for storage services in Azure China 21Vianet:

Parsing a connection string

The Microsoft Azure Configuration Manager Library for .NET provides a class for parsing a connection string from a configuration file. The CloudConfigurationManager class parses configuration settings. It parses settings for client applications that run on the desktop, on a mobile device, in an Azure virtual machine, or in an Azure cloud service.

To reference the CloudConfigurationManager package, add the following using directives:

Here's an example that shows how to retrieve a connection string from a configuration file:

Using the Azure Configuration Manager is optional. You can also use an API such as the .NET Framework's ConfigurationManager Class.

Next steps

-->

An Azure storage account contains all of your Azure Storage data objects: blobs, files, queues, tables, and disks. The storage account provides a unique namespace for your Azure Storage data that is accessible from anywhere in the world over HTTP or HTTPS. Data in your Azure storage account is durable and highly available, secure, and massively scalable.

In this how-to article, you learn to create a storage account using the Azure portal, Azure PowerShell, Azure CLI, or an Azure Resource Manager template.

Note

This article has been updated to use the new Azure PowerShell Azmodule. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020.To learn more about the new Az module and AzureRM compatibility, seeIntroducing the new Azure PowerShell Az module. ForAz module installation instructions, see Install Azure PowerShell.

Prerequisites

If you don't have an Azure subscription, create a free account before you begin.

None.

To create an Azure storage account with PowerShell, make sure you have installed Azure PowerShell module Az version 0.7 or later. For more information, see Introducing the Azure PowerShell Az module.

To find your current version, run the following command:

To install or upgrade Azure PowerShell, see Install Azure PowerShell module.

You can sign in to Azure and run Azure CLI commands in one of two ways:

  • You can run CLI commands from within the Azure portal, in Azure Cloud Shell.
  • You can install the CLI and run CLI commands locally.

Use Azure Cloud Shell

Azure Cloud Shell is a free Bash shell that you can run directly within the Azure portal. The Azure CLI is pre-installed and configured to use with your account. Click the Cloud Shell button on the menu in the upper-right section of the Azure portal:

The button launches an interactive shell that you can use to run the steps outlined in this how-to article:

Install the CLI locally

You can also install and use the Azure CLI locally. This how-to article requires that you are running the Azure CLI version 2.0.4 or later. Run az --version to find the version. If you need to install or upgrade, see Install the Azure CLI.

None.

Sign in to Azure

Sign in to the Azure portal.

Sign in to your Azure subscription with the Connect-AzAccount command and follow the on-screen directions to authenticate.

To launch Azure Cloud Shell, sign in to the Azure portal.

To log into your local installation of the CLI, run the az login command:

N/A

Create a storage account

Now you are ready to create a storage account.

Every storage account must belong to an Azure resource group. A resource group is a logical container for grouping your Azure services. When you create a storage account, you have the option to either create a new resource group, or use an existing resource group. This article shows how to create a new resource group.

A general-purpose v2 storage account provides access to all of the Azure Storage services: blobs, files, queues, tables, and disks. The steps outlined here create a general-purpose v2 storage account, but the steps to create any type of storage account are similar.

To create a general-purpose v2 storage account in the Azure portal, follow these steps:

  1. On the Azure portal menu, select All services. In the list of resources, type Storage Accounts. As you begin typing, the list filters based on your input. Select Storage Accounts.

    Dominate Your Opponents in Real-Time 1v1 Matches!United StatesArgentinaAustraliaAustriaBelgiumBrazilCanadaChileChinaColombiaCzech RepublicDenmarkFinlandFranceGermanyGreeceHong KongHungaryIndiaIrelandIsraelItalyJapanKoreaMexicoNetherlandsNew ZealandNorwayPolandPortugalRussiaSaudi ArabiaSingaporeSlovakiaSouth AfricaSpainSwedenSwitzerlandTaiwanThailandTurkeyUkraineUnited Arab EmiratesUnited KingdomYes! These are the games you loved now remastered for the first time. Command & Conquer - Official EA Site Welcome Back, CommanderCommand & Conquer and Red Alert are two of the most genre defining Real Time Strategy games in history. Command and conquer generals 2 cd key generator download.

  2. On the Storage Accounts window that appears, choose Add.

  3. Select the subscription in which to create the storage account.

    After this, the raw contents of the public key will be displayed alongside its fingerprint and a timestamp comment.Two important fields, Key passphrase and Confirm passphrase, allow you to enter a passphrase to protect the private key.Finally, you will need to export both the private and public keys separately:. Consequently, you won’t be asked for a passphrase when using your key.When the process has finished, the private key and the public key can be found in the /.ssh directory accessible from the Ubuntu terminal, or the following folder from Windows file manager: C:Users%USERNAME%AppDataLocalPackagesCanonicalGroupLimited.UbuntuonWindows79rhkp1fndgscLocalStaterootfsThe AppData and directory is hidden from the default view and will need to be entered manually. Key generation with PuTTYDuration: 3:00To generate a key pair with the PuTTY key generator, simply run puttygen.exe and click the Generate button in the window that appears.You will be asked to move the mouse and press keys to improve the random number generation at the heart of SSH security. As discussed, entering a passphrase will require you to use the same passphrase whenever the key is accessed.However, the passphrase isn’t a requirement, and pressing return (twice) will generate a key pair without one. Generate ssh key ubuntu github

  4. Under the Resource group field, select Create new. Enter a name for your new resource group, as shown in the following image.

  5. Next, enter a name for your storage account. The name you choose must be unique across Azure. The name also must be between 3 and 24 characters in length, and can include numbers and lowercase letters only.

  6. Select a location for your storage account, or use the default location.

  7. Leave these fields set to their default values:

    FieldValue
    Deployment modelResource Manager
    PerformanceStandard
    Account kindStorageV2 (general-purpose v2)
    ReplicationRead-access geo-redundant storage (RA-GRS)
    Access tierHot

  8. If you plan to use Azure Data Lake Storage, choose the Advanced tab, and then set Hierarchical namespace to Enabled.

  9. Select Review + Create to review your storage account settings and create the account.

  10. Select Create.

For more information about types of storage accounts and other storage account settings, see Azure storage account overview. For more information on resource groups, see Azure Resource Manager overview.

First, create a new resource group with PowerShell using the New-AzResourceGroup command:

If you're not sure which region to specify for the -Location parameter, you can retrieve a list of supported regions for your subscription with the Get-AzLocation command:

Next, create a general-purpose v2 storage account with read-access geo-redundant storage (RA-GRS) by using the New-AzStorageAccount command. Remember that the name of your storage account must be unique across Azure, so replace the placeholder value in brackets with your own unique value:

Important

If you plan to use Azure Data Lake Storage, include -EnableHierarchicalNamespace $True in this list of parameters.

To create a general-purpose v2 storage account with a different replication option, substitute the desired value in the table below for the SkuName parameter.

Replication optionSkuName parameter
Locally redundant storage (LRS)Standard_LRS
Zone-redundant storage (ZRS)Standard_ZRS
Geo-redundant storage (GRS)Standard_GRS
Read-access geo-redundant storage (GRS)Standard_RAGRS
Geo-zone-redundant storage (GZRS) (preview)Standard_GZRS
Read-access geo-zone-redundant storage (RA-GZRS) (preview)Standard_RAGZRS

First, create a new resource group with Azure CLI using the az group create command.

If you're not sure which region to specify for the --location parameter, you can retrieve a list of supported regions for your subscription with the az account list-locations command.

Next, create a general-purpose v2 storage account with read-access geo-redundant storage by using the az storage account create command. Remember that the name of your storage account must be unique across Azure, so replace the placeholder value in brackets with your own unique value:

Important

If you plan to use Azure Data Lake Storage, include --enable-hierarchical-namespace true in this list of parameters.

To create a general-purpose v2 storage account with a different replication option, substitute the desired value in the table below for the sku parameter.

Replication optionsku parameter
Locally redundant storage (LRS)Standard_LRS
Zone-redundant storage (ZRS)Standard_ZRS
Geo-redundant storage (GRS)Standard_GRS
Read-access geo-redundant storage (GRS)Standard_RAGRS
Geo-zone-redundant storage (GZRS) (preview)Standard_GZRS
Read-access geo-zone-redundant storage (RA-GZRS) (preview)Standard_RAGZRS

You can use either Azure Powershell or Azure CLI to deploy a Resource Manager template to create a storage account. The template used in this how-to article is from Azure Resource Manager quickstart templates. To run the scripts, select Try it to open the Azure Cloud shell. To paste the script, right-click the shell, and then select Paste.

Note

This template serves only as an example. There are many storage account settings that aren't configured as part of this template. For example, if you want to use Azure Data Lake Storage, you would modify this template by setting the isHnsEnabledad property of the StorageAccountPropertiesCreateParameters object to true.

To learn how to modify this template or create new ones, see:

  • Azure Resource Manager documentation.
  • Storage account template reference.
  • Additional storage account template samples.

For more information about available replication options, see Storage replication options.

Delete a storage account

Deleting a storage account deletes the entire account, including all data in the account, and cannot be undone.

  1. Navigate to the storage account in the Azure portal.
  2. Click Delete.

To delete the storage account, use the Remove-AzStorageAccount command:

To delete the storage account, use the az storage account delete command:

Key

To delete the storage account, use either Azure PowerShell or Azure CLI.

Alternately, you can delete the resource group, which deletes the storage account and any other resources in that resource group. For more information about deleting a resource group, see Delete resource group and resources.

Azure Generate Storage Account Key App

Warning

It's not possible to restore a deleted storage account or retrieve any of the content that it contained before deletion. Be sure to back up anything you want to save before you delete the account. This also holds true for any resources in the account—once you delete a blob, table, queue, or file, it is permanently deleted.

If you try to delete a storage account associated with an Azure virtual machine, you may get an error about the storage account still being in use. For help troubleshooting this error, see Troubleshoot errors when you delete storage accounts.

Azure Generate Storage Account Key Password

Next steps

What Is Storage Account Key In Azure

In this how-to article, you've created a general-purpose v2 standard storage account. To learn how to upload and download blobs to and from your storage account, continue to one of the Blob storage quickstarts.