Azure Series: Deploying a Complete Web Application on Azure (Beginner to Production) — Part 3

Azure Series — Securing Your Azure Virtual Machine with Managed Identity, Azure Storage, and Best Practices

In Part 2 of this Azure Series, we successfully created and configured a Virtual Machine (VM) in Microsoft Azure. We covered the basics of VM creation, networking, access, and initial setup.

Now, in Part 3, we take a crucial next step.

Creating a VM is only the beginning. In real-world cloud environments, security, identity management, and secure access to resources are just as important as deployment itself.

In this article, we will strengthen our VM setup by introducing secure, production-ready Azure integrations, focusing on identity-based access instead of secrets, keys, or passwords.

What We Will Cover in Part 3

In this part, you will learn how to:

• Configure Managed Identity for an Azure VM
• Access Azure Storage (Blob / File) securely using identity-based authentication
• Avoid using storage keys and passwords
• Apply recommended security configurations for VM connectivity
• Prepare the VM environment for safer and smoother deployment workflows.

This guide is written step by step, assuming basic Azure knowledge, and is ideal for beginners who want to learn real Azure best practices rather than shortcuts.

Why Managed Identity Matters

Traditionally, applications and VMs authenticate to Azure services using:

• Access keys
• Connection strings
• Service principals with secrets

These methods introduce risks:

• Secrets can be leaked
• Keys must be rotated
• Configuration becomes complex

Managed Identity solves this problem.

What is Managed Identity?

Managed Identity is an Azure feature that:

• Automatically creates an identity for your VM in Azure Active Directory
• Eliminates the need to store credentials in code or configuration
• Allows secure, passwordless access to Azure resources

Azure handles the identity lifecycle for you.

Step 1: Enable Managed Identity for the Virtual Machine

1. Go to Azure Portal
2. Navigate to Virtual Machines
3. Select your VM (created in Part 2)
4. In the left menu, click Identity
5. Under System assigned, set Status to On
6. Click Save

Once enabled:

• Azure creates an identity linked to this VM
• The identity can now be granted permissions to other Azure services

— No usernames
— No passwords
— No secrets stored anywhere

Step 2: Understanding System-Assigned vs User-Assigned Identity

For this series, we use System-Assigned Managed Identity.

System-Assigned Identity

• Tied directly to the VM
• Automatically removed if the VM is deleted
• Perfect for simple and secure setups

(User-Assigned identities are useful for advanced scenarios and shared identities, which we will cover in a future article.)

Step 3: Secure Access to Azure Storage Using Identity

Now let’s connect our VM to Azure Storage without using access keys.

Why Avoid Storage Account Keys?

Storage keys:

• Provide full access to storage
• Are hard to rotate safely
• Increase security risks if exposed

Instead, we will use Azure RBAC + Managed Identity.

Step 4: Assign Storage Permissions to the VM Identity

1. Go to Azure Storage Account
2. Select your storage account
3. Open Access Control (IAM)
4. Click Add → Add role assignment

Recommended Roles:

• Storage Blob Data Contributor (for Blob access)
• Storage File Data SMB Share Contributor (for File Share access)

5. Select Storage Blob Data Contributor & Click Next

6. Under Assign access to, select Managed identity

7. Click + Select member

8. Choose Virtual Machine

9. Select your VM

10. Click Review + assign

1. Select your VM
2. Click Review + assign

Now your VM can access storage securely using its identity.

Step 5: Access Azure Blob Storage from the VM (Without Keys)

Once permissions are assigned, your VM can authenticate automatically.

Example (Azure CLI inside VM)

az login --identity
az storage blob list \
  --account-name <storage-account-name> \
  --container-name <container-name> \
  --auth-mode login

No keys. No secrets. Authentication happens using the VM’s identity.

Step 6: Secure Connectivity Best Practices for the VM

Security doesn’t stop at identity. Let’s apply some recommended VM security configurations.

1. Limit Public Access

• Avoid exposing ports unnecessarily
• Use Network Security Groups (NSG) to restrict inbound traffic
• Allow SSH (22) or RDP (3389) only from trusted IPs

2. Prefer Private Access Where Possible

• Use Private Endpoints for Storage access (advanced but recommended)
• Avoid public storage endpoints in production

3. Use Just-In-Time (JIT) VM Access

• Enable JIT access from Microsoft Defender for Cloud
• Open ports only when needed and for limited time

Step 7: Preparing the VM for Safer Deployment Workflows

With identity and security in place, your VM is now ready for real workloads.

Recommended Preparation Steps

• Install required runtime (Docker, .NET, Node.js, Java, etc.)
• Use Managed Identity for:
• Azure Key Vault access
• Azure Container Registry pulls
• Azure Storage operations
• Avoid hard-coding credentials in scripts
• Use environment variables only when necessary (and never secrets)

This setup allows:

• Cleaner deployments
• Better security compliance
• Easier scaling and maintenance

Key Takeaways from Part 3

By the end of this article, you have:

— Enabled Managed Identity for your VM
— Connected Azure Storage using identity-based access
— Eliminated storage keys and passwords
— Applied secure connectivity best practices
— Prepared your VM for production-ready deployments

These are real Azure patterns used in enterprise environments, not shortcuts.

What’s Coming in Part 4?

In Part 4 of this Azure Series, we will move beyond the VM and focus on global access and performance by setting up:

• Azure Front Door for secure and scalable traffic routing
• Front Door mapped with Static Website hosted on Azure Storage
• Custom Domain configuration with HTTPS enabled
• Best practices for improving performance, availability, and security at the edge

This part will show how to expose applications and static content to users safely and efficiently, using Azure’s global networking capabilities.

Final Thoughts

In an era where information is easily searchable and tools like AI can generate quick answers, what truly matters is understanding concepts deeply and applying them correctly.

This series focuses on step-by-step, practical Azure guidance — the kind that helps you build confidence and real-world skills.

At Mass Tech Bytes, we believe learning cloud technology should be clear, secure, and practical, and this series is built with that philosophy in mind.

Contributors

This article was written by Mousumi Bakshi (Senior Solutions Architect)

Stay Connected with Massoftind

Let’s Build the Future Together!

For your Generative AI solutions and project development needs and ongoing updates, technical articles, and insights from our team get in touch with MSS — we’re here to help bring your ideas to life.

👉 Follow us on LinkedIn and Medium for weekly tech insights and practical tips to supercharge your development journey!