Store: archive delivery notes in a private container

The business request

Barrio Demo receives goods and needs to retain the delivery note proving receipt. You will create a document archive in Azure, upload the sample delivery note, and check who can read it.

The document ALM001 contains two lines: 12 units of CAF-250 and 8 of ARR-1KG. Archiving the document does not update store stock: that integration would be an additional process.

Storage and its operations may incur charges under your subscription. Use a practice resource and delete it when finished if no longer needed.

1. Create the resource group

In Azure Portal, search for Resource groups → Create.

1. Select the practice subscription.
2. Name: rg-barrio-demo-lab.
3. Select a region available for your subscription.
4. Add tags negocio = barrio-demo and entorno = laboratorio.
5. Review and create.

The group lets you manage practice resources together. Its region stores group metadata; each resource has its own location.

2. Create the storage account

Search for Storage accounts → Create and use the previous group.

If the wizard offers a primary service choice, use Azure Blob Storage. Review the settings and create the account.

For this practice, the endpoint can be publicly reachable with authentication. If environment policies restrict networking to specific addresses, use an authorized computer and network. Do not change organizational policies to follow this exercise.

Private container means reading the document requires authorization; it does not mean you have configured a private network endpoint.

3. Prepare access with Microsoft Entra

In the account, open Access control (IAM) and check your user's role assignment:

• Storage Blob Data Contributor allows reading, writing, and deleting blobs.
• A management role with read access, such as Reader, lets you browse to the resource in the portal.

Permission to manage the account does not always mean you have a data role. If you need an assignment, ask the administrator or create it yourself only if authorized. For this case you can scope it to the practice storage account.

Wait for role assignment propagation. In the portal's blob browser, check that the authentication method is Microsoft Entra user account, rather than assuming the portal uses that method: it may offer account-key access.

This exercise does not require distributing keys or generating a SAS.

4. Create the archive and upload the delivery note

Open Data storage → Containers → Create container.

Name: albaranes. Anonymous access: Private / no anonymous access. Create the container.

Download this page's CSV and upload it using Upload, retaining the filename albaran-alm-001.csv. Do not paste it on a public page or enable anonymous access to simplify downloading.

Check the blob's name, size, and last modified date. Download it again from the portal and open it: both lines and quantities 12 and 8 must be retained.

As an extension, you can organize prefixes such as year/month, but the main case file can remain at the container root.

5. Verify access

Anonymous denial may produce different codes depending on configuration. The criterion is that the document is not delivered, not a specific error number.

If your user cannot download, review the authentication method, data roles, and network restrictions before changing the resource.

Deliverables and cleanup

Submit a screenshot of the group with its account, another of the private container, and the retrieved document. Record authenticated and anonymous access tests.

You have built a basic delivery note archive. You have not yet configured legal retention, recovery from deletions, or a complete backup strategy.

To clean up, identify rg-barrio-demo-lab and check that it contains only your exercise resources. If you do not need to keep them, delete that group from the portal and confirm the exact name. Do not delete a shared group.

Official documentation

• Create a storage account — Microsoft Learn.
• Upload and download blobs with Azure Portal — Microsoft Learn.
• Assign blob data access roles — Microsoft Learn.
• Prevent anonymous access to containers and blobs — Microsoft Learn.