Data migration to Azure storage account(s)

Storage accounts with secure access

Every request to Azure Storage must be authorized. Azure Storage supports several authorization methods.

• Azure Active Directory (Azure AD) integration for blob, queue, and table data

Azure Storage supports authentication and authorization with Azure AD for the Blob and Queue services via Azure role-based access control (Azure RBAC). Authorization with Azure AD is also supported for the Table service in preview. Authorizing requests with Azure AD is recommended for superior security and ease of use. For more information, see Authorize access to data in Azure Storage.

• Azure AD authorization over SMB for Azure Files

Azure Files supports identity-based authorization over SMB (Server Message Block) through either Azure Active Directory Domain Services (Azure AD DS) or on-premises Active Directory Domain Services (preview). Domain-joined Windows VMs can access Azure file shares using Azure AD credentials.

• Authorization with Shared Key

The Azure Storage Blob, Files, Queue, and Table services support authorization with Shared Key. A client using Shared Key authorization passes a header with every request that is signed using the storage account access key.

• Authorization using shared access signatures (SAS)

A shared access signature (SAS) is a string containing a security token that can be appended to the URI for a storage resource. The security token encapsulates constraints such as permissions and the interval of access.

• Anonymous access to containers and blobs

A container and its blobs may be publicly available. When you specify that a container or blob is public, anyone can read it anonymously; no authentication is required.

Storage accouts with encryption

There are several encryptions to storage accounts with two basic kinds of encryption available for Azure Storage.

• Encryption at rest

Azure Storage encryption protects and safeguards data to meet organizational security and compliance commitments. Azure Storage automatically encrypts all data prior to persisting to the storage account and decrypts it prior to retrieval. The encryption, decryption, and key management processes are transparent to users. Customers can also choose to manage their own keys using Azure Key Vault.

• Client-side encryption

The Azure Storage client libraries provide methods for encrypting data from the client library before sending it across the wire and decrypting the response. Data encrypted via client-side encryption is also encrypted at rest by Azure Storage.

Storage accouts with redundancy

Azure Storage always stores multiple copies of data so that it's protected from planned and unplanned events, including transient hardware failures, network or power outages, and massive natural disasters. Redundancy ensures that storage accounts meets their availability and durability targets even in the face of failures.

When deciding which redundancy option is best for client's scenario, we are considering the tradeoffs between lower costs and higher availability. The factors that help determine which redundancy option we should choose includes: How data is replicated in the primary region - Whether data is replicated to a second region that is geographically distant to the primary region, to protect against regional disasters (geo-replication) - Whether applications requires read access to the replicated data in the secondary region if the primary region becomes unavailable for any reason (geo-replication with read access).

The services that comprise Azure Storage are managed through a common Azure resource called a storage account. The storage account represents a shared pool of storage that can be used to deploy storage resources such as blob containers (Blob Storage), file shares (Azure Files), tables (Table Storage), or queues (Queue Storage).

The redundancy setting for a storage account is shared for all storage services exposed by that account. All storage resources deployed in the same storage account have the same redundancy setting. IP systems Solutions assist clients to determine and isolate different types of resources in separate storage accounts if they have different redundancy requirements.

Proper data migration and planning can save client's money and time spent otherwise spent on dealing with obstacles that could easily be predicted.