How do I create an Azure storage account?

An Azure storage account provides a unique namespace to store and access your Azure storage data objects. Every object that you store in Azure Storage has an address that includes your unique account name. The combination of the account name and the Azure Storage blob endpoint forms the base address for the objects in your storage account. All objects in a storage account are billed together as a group.
 

By default, the data in your account is available only to the account owner. If you do not have an existing storage account in your subscription, follow the steps outlined in this procedure:

1. Click Storage Accounts from the menu of services to access the Storage Accounts blade
2. Click Add (+) to create a new storage account. The Create Storage Account blade appears .
3. provide the following information for the new storage account.

      4. Click Review + Create.

      5. Once Validation has passed, click on Create.  After a short moment, your storage account should have been created in your resource group.

 Additional Required Settings

1. Ensure that 'Secure transfer required' is set to 'Enabled'
   1. For each Storage Account go to configuration and ensure that secure transfer required is set to enabled.

2. Ensure Storage logging is enabled for Queue service for read, write, and delete requests
   1. For each storage account use the Use the Diagnostics logs (classic) blade from Monitoring (classic) section.
   2. Set the Status to On, if set to Off.
   3. Select Queue properties.
   4. Select Read, Write and Delete options under the Logging section to enable Storage Logging for Queue service.

3. Ensure that shared access signature tokens are allowed only over https
   1. For each storage account go to Shared Access Signature and set Allowed Protocols to HTTPS only.

4. Ensure that 'Public access level' is set to Private for blob containers
   1. For each storage account go to containers under Blob Service.
   2. For each Container click on Access policy and set the Public Access Lever to Private (No Anonymous Access).

5. Ensure default network access rule for Storage Accounts is set to deny.
   1. For each storage account, click on Firewalls and Virtual Networks under Settings.
   2. Ensure the you have elected to allow access from Selected Networks
   3. Add rules to “allow traffic” from “specific network”

6. Ensure 'Trusted Microsoft Services' is enabled for Storage Account access.
   1. For each storage account click on Firewalls and Virtual Networks.
   2. Ensure that you’ve elect to allow access from “selected networks”.
   3. Enable Check Box for Allow Trusted Microsoft Services to access this storage account.