Set Up an Azure Storage Account

BYOVault's Storage tab asks for three things — a container name, a storage account name, and an access key. This guide walks through creating each value from a new Azure subscription.

1. Create the storage account

  1. Go to the Azure Portal, search Storage accounts in the top search bar, and click + Create.
  2. Pick or create a resource group — any name is acceptable (e.g. rg-backups).
  3. Storage account name: must be globally unique across all of Azure, lowercase letters and numbers only, no dashes or spaces (e.g. acmebackup2026). Record this value — it’s the Storage account name field in BYOVault’s form.
  4. Region: pick whichever is closest to you or your compliance requirements.
  5. Performance: Standard. Redundancy: LRS is the cheapest option and suitable to start with.
  6. The wizard has several more tabs (Advanced, Networking, Data protection, Security, Encryption, Tags) before Review + Create. The defaults on every one of them are appropriate for most configurations — see the note below for the one setting that actually matters.
  7. Click Review + Create, then Create. Deployment typically completes within a minute.
Security tab: leave “Enable storage account key access” checked

BYOVault authenticates using the storage account’s access key — the same one you’ll copy in step 3. This setting on the Security tab controls that, and it’s checked by default.

If it’s ever unchecked (at creation or later), the access key stops working entirely and every write from BYOVault will fail.

Public network access on the Networking tab should also stay at its default (“Enable from all networks”) — restricting it to specific IPs/VNets will block BYOVault’s own servers, which do not write from your network.

2. Create a container

  1. Once deployment finishes, click Go to resource.
  2. In the left sidebar, under Data storage, click Containers.
  3. Click + Container, give it a name (e.g. backup-data), leave Anonymous access level as Private, and click Create.

This container name is the Container / Bucket name field in BYOVault’s Storage form.

3. Get the access key

  1. Still inside the storage account, go to Security + networking → Access keys in the left sidebar.
  2. Click Show next to key1.
  3. Copy the Key value itself — not the connection string, not the key name. This is the Access key field in BYOVault’s Storage form.
Rotating later is safe
If you ever regenerate key1 (e.g. after a suspected leak), update the Access key field in BYOVault’s Storage tab with the new value — nothing about your existing backed-up data changes, since the key only authorizes access, it isn’t used to derive or wrap anything.

4. Enter it into BYOVault

Back in BYOVault, on the tenant’s Storage tab, select Azure Blob Storage as the provider and fill in the three values from above. See Storage Credentials for exactly how BYOVault stores this access key once you save it.

PreviousOverview & PrerequisitesNextAWS S3 Bucket