Azure Data Lake Storage Security

Authentication & Identity
Network Security
Encryption at Rest & In‑Transit
Access Control (IAM & ACLs)
Security Best Practices

Authentication & Identity

Azure Data Lake Storage (ADLS) integrates with Azure Active Directory (Azure AD) to provide secure, token‑based authentication. Use Azure AD for:

Managed identities for Azure resources
Service principals and client secrets
Conditional Access policies

Example: Acquire a token with Azure CLI

az account get-access-token --resource https://storage.azure.com/

Network Security

Restrict connectivity using:

Virtual Network Service Endpoints
Private Endpoints (Azure Private Link)
Firewall rules & IP allow lists

Sample firewall rule to allow a single IP:

az storage account network-rule add \
    --resource-group MyResourceGroup \
    --account-name mystorageaccount \
    --ip-address 203.0.113.5

Encryption at Rest & In‑Transit

Data is encrypted using Microsoft-managed keys by default (CMK). For compliance, you can use customer‑managed keys (CMK) stored in Azure Key Vault.

Enable customer‑managed keys:

az storage account update \
    --name mystorageaccount \
    --resource-group MyResourceGroup \
    --encryption-key-source Microsoft.Keyvault \
    --encryption-key-vault myKeyVault \
    --encryption-key-name myKey

All data transfers use HTTPS (TLS 1.2+). Enforce HTTPS‑only requests:

az storage account update \
    --name mystorageaccount \
    --resource-group MyResourceGroup \
    --allow-blob-public-access false \
    --https-only true

Access Control (IAM & ACLs)

Control access at two levels:

IAM role assignments – grant permissions on the storage account or container.
POSIX‑style ACLs – fine‑grained file‑and‑directory permissions.

Assign the built‑in Storage Blob Data Owner role:

az role assignment create \
    --assignee user@example.com \
    --role "Storage Blob Data Owner" \
    --scope /subscriptions/xxxx-xxxx/resourceGroups/MyResourceGroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount

Set an ACL on a directory via Azure CLI:

az storage fs access set \
    --account-name mystorageaccount \
    --file-system myfilesystem \
    --path /data/finance \
    --acl "user::rwx,group::r-x,other::---"

Security Best Practices

Enable Azure Defender for Storage for threat detection.
Use Private Endpoints to eliminate exposure to the public internet.
Rotate customer‑managed keys regularly via Azure Key Vault policies.
Audit access with Azure Monitor and enable diagnostic logs.
Apply least‑privilege IAM – assign only the needed roles.

Table of Contents

Authentication & Identity

Network Security

Encryption at Rest & In‑Transit

Access Control (IAM & ACLs)

Security Best Practices