Set Up an Azure Storage Account

BYOVault's Storage tab asks for three things — a container name, a storage account name, and an access key. Here's exactly where each one comes from, starting with nothing.

1. Create the storage account

  1. Go to the Azure Portal, search Storage accounts in the top search bar, and click + Create.
  2. Pick or create a resource group — any name works (e.g. rg-backups).
  3. Storage account name: must be globally unique across all of Azure, lowercase letters and numbers only, no dashes or spaces (e.g. acmebackup2026). Write this down — it’s the Storage account name field in BYOVault’s form.
  4. Region: pick whichever is closest to you or your compliance requirements.
  5. Performance: Standard. Redundancy: LRS is the cheapest option and fine to start with.
  6. The wizard has several more tabs (Advanced, Networking, Data protection, Security, Encryption, Tags) before Review + Create. The defaults on every one of them are fine — see the note below for the one setting that actually matters.
  7. Click Review + Create, then Create. This takes about a minute to finish deploying.
Security tab: leave “Enable storage account key access” checked
BYOVault authenticates using the storage account’s access key (the same one you’ll copy in step 3) — that’s exactly what this setting on the Security tab controls, and it’s checked by default. If it’s ever unchecked here (at creation or later), the access key stops working entirely and every write from BYOVault will fail. Public network access on the Networking tab should also stay at its default (“Enable from all networks”) — restricting it to specific IPs/VNets will block BYOVault’s own servers, which don’t write from your network.

2. Create a container

  1. Once deployment finishes, click Go to resource.
  2. In the left sidebar, under Data storage, click Containers.
  3. Click + Container, give it a name (e.g. backup-data), leave Anonymous access level as Private, and click Create.

This container name is the Container / Bucket name field in BYOVault’s Storage form.

3. Get the access key

  1. Still inside the storage account, go to Security + networking → Access keys in the left sidebar.
  2. Click Show next to key1.
  3. Copy the Key value itself — not the connection string, not the key name. This is the Access key field in BYOVault’s Storage form.
Rotating later is safe
If you ever regenerate key1 (e.g. after a suspected leak), update the Access key field in BYOVault’s Storage tab with the new value — nothing about your existing backed-up data changes, since the key only authorizes access, it isn’t used to derive or wrap anything.

4. Enter it into BYOVault

Back in BYOVault, on the tenant’s Storage tab, select Azure Blob Storage as the provider and fill in the three values from above. See Storage Credentials for exactly how BYOVault stores this access key once you save it.

PreviousPreserve (Legal Hold)NextAWS S3 Bucket