Goal: create, inspect and remove a disposable storage lab. Allow approximately 40 minutes. Cloud operations and deletion can take additional time.

Before starting: use an approved training subscription with permission to create resources. Check your free allowance or credits and the current storage pricing. A free course does not make Azure resources free. If you cannot authorise the lab’s cost or access, use this lesson as a planning exercise and do not execute the write commands.

1. Describe the change

Tell the tutor: I want one disposable resource group and one general-purpose storage account. Explain the permissions, region, name restrictions, security settings and cleanup steps. Do not execute anything. Compare the response with the official storage account creation guide and Azure CLI reference.

2. Confirm context and select names

The following example uses Bash and Azure CLI. Replace the storage name with your own globally unique name using 3–24 lowercase letters and numbers. Choose a region available to your subscription. The example names are for a new lab, not for reusing an existing production group.

az account show --query '{name:name,id:id,tenantId:tenantId}' -o table
DQ_LAB_GROUP="dqz-az104-starter-lab"
DQ_LAB_LOCATION="uksouth"
DQ_LAB_STORAGE="replacewithuniquelabname"
az group exists --name "$DQ_LAB_GROUP"
az storage account check-name --name "$DQ_LAB_STORAGE" -o table

Stop if the resource group already exists: choose a new lab name instead of putting disposable work into a group whose contents you have not inspected. Continue only when the storage name is available and you have confirmed the subscription and region.

3. Create the disposable resources

az group create --name "$DQ_LAB_GROUP" --location "$DQ_LAB_LOCATION" --tags purpose=az104-starter
az storage account create \
  --name "$DQ_LAB_STORAGE" \
  --resource-group "$DQ_LAB_GROUP" \
  --location "$DQ_LAB_LOCATION" \
  --sku Standard_LRS --kind StorageV2 \
  --https-only true --min-tls-version TLS1_2 \
  --allow-blob-public-access false \
  --allow-shared-key-access false

The example selects locally redundant storage, requires HTTPS and disables anonymous blob access and Shared Key authorisation. These settings are not a complete production design. A service’s network endpoint and its data-access permissions are separate boundaries. This exercise does not create a publicly readable blob or grant a data-access role.

4. Inspect the actual result

az storage account show \
  --name "$DQ_LAB_STORAGE" --resource-group "$DQ_LAB_GROUP" \
  --query '{name:name,location:location,kind:kind,sku:sku.name,httpsOnly:enableHttpsTrafficOnly,minimumTls:minimumTlsVersion,publicBlobAccess:allowBlobPublicAccess,sharedKeyAccess:allowSharedKeyAccess}' -o json
az resource list --resource-group "$DQ_LAB_GROUP" -o table

Check the same settings in the Azure portal. Record the name, resource group, region and configuration. Ask the tutor to explain a setting you do not understand; verify the answer in documentation. Management access to inspect the account does not automatically grant permission to read blobs inside it.

5. Remove the lab and verify cleanup

Confirm the active subscription again and inspect every resource in the lab group. Delete the group only if it contains your disposable lab resources. In the Azure portal, select that group, choose Delete resource group and confirm its exact name. Wait for completion, then check:

az group exists --name "$DQ_LAB_GROUP"

A result of false confirms that the group no longer exists in the selected subscription. If it still exists, inspect deletion status, locks and permissions; do not treat a pending request as completion. Review cost information later because billing displays can lag resource deletion.

Completion evidence: your active-context check, the inspected storage configuration, a cleanup result and one concept you can now explain without the tutor.

PreviousNext