I'm planning to migrate an on-premises application to Azure. It stores roughly 50 TB of user documents, and we've chosen Azure Blob Storage for its scalability and cost profile.
The planned setup includes RA-GRS, blob versioning, and soft delete to protect against accidental deletion and infrastructure failures. My bigger concern is a compromised administrator account or a serious misconfiguration that could result in someone intentionally deleting the storage account or its contents.
Immutability policies are appealing, but we also need to honor GDPR deletion requests, so a permanently immutable copy may not fit our requirements. Azure Backup for Blob Storage appears promising, though I'm trying to understand its current production readiness and pricing. I'm also considering a separate storage account in another region or subscription, perhaps using archive storage with retention and immutability controls, but maintaining a custom backup process at this scale seems risky.
What approaches have worked reliably in production for protecting large Blob Storage datasets from malicious deletion while still supporting data-erasure requests?
3 Answers
A separate backup solution can also be worth evaluating, especially if it supports controlled retention, immutability, customer-owned storage, and tiering to a region or provider you select. That may reduce the amount of backup infrastructure you have to operate yourself, although you’ll need to compare licensing, restore performance, and egress costs.
Azure Backup for Blob Storage is now generally available, so I’d evaluate that before building a replication system yourself. For this threat model, use point-in-time operational recovery together with a vaulted backup copy in an isolated backup environment. Protect the vault with immutability, and use separate administrative controls or multi-user authorization for destructive actions.
The cost won’t automatically be double the primary storage cost. It depends on the protected data size, change rate, retention period, and storage tier. GDPR deletion may still be workable: erased data can remain in an already-created backup until its retention period expires, with deletion requests reapplied if the data is restored.
If you build a secondary copy, put it in a different region and preferably a separate subscription or tenant. Use a restricted identity for the copy process, keep the backup account on a lower-cost tier where appropriate, and apply retention controls. This gives you stronger isolation than simply replicating into another account under the same administrative boundary.
For the primary environment, use separate admin identities, least-privilege roles, MFA, privileged access workflows, and resource locks. Locks are useful against accidental deletion, but they are not a complete security boundary because sufficiently privileged administrators can remove them.
I’d also consider malware detection and storage threat monitoring on the primary account. Those controls won’t replace an isolated backup, but they can help detect suspicious activity before it spreads.