Blob Records Must Not Be Changed? Configure Retention and Legal Hold

Published on:
#azure-storage#blob-storage#immutability#retention#legal-hold

Invoices need protection against overwrites and deletion. Some records have a fixed retention period; others must remain unchanged until an investigation ends. Immutable Blob Storage provides time-based retention for a defined period and a legal hold until an authorized administrator clears it.

Retention ends by time; a hold ends by decision.

Prepare Test Records

Create a storage account in the Azure portal:

Resource group: rg-cloudtrips-immutable-test-weu
Storage account name: stctimmutableweu
Region: West Europe
Performance: Standard
Redundancy: LRS

Adjust the globally unique name if needed. Keep hierarchical namespace and version-level immutability disabled for this container-level lab. Allow your computer’s network to reach the account.

Use an account administrator with permission to configure container policies and Storage Blob Data Contributor for blob operations. Create two private containers, retention-test and hold-test, and upload a small record.txt into each.

Set Time-Based Retention

Open retention-test → Access policy → Immutable blob storage → Add policy. Select Time-based retention, enter 1 day, and save. Keep protected append writes disabled and the policy Unlocked for this test.

Container policy showing one-day time-based retention in Unlocked state

Check the duration and Unlocked state. Retention applies relative to each blob’s creation time. While active, it blocks blob overwrites and deletion; an authorized administrator can still change or remove this unlocked test policy. Locking is irreversible and prevents shortening or removing the policy.

Try deleting record.txt from the container’s blob list.

Blob deletion rejected because the time-based immutability policy is active

Expect an immutability-policy error and confirm the blob remains. This demonstrates data-operation protection even while the test policy is unlocked.

Open hold-test → Access policy → Immutable blob storage → Add policy. Select Legal hold, add the tag case001, and save with protected append writes disabled.

Container legal hold showing the case001 tag

The tag identifies why the records are held. The hold has no expiry date: it protects blobs until all hold tags are cleared. Try deleting record.txt from hold-test.

Deletion of record.txt in hold-test rejected because a legal hold is active

Check that the deletion error identifies the active legal hold and that record.txt remains. Confirm downloading still works.

Remove Test Protection and Clean Up

Delete the unlocked retention policy from retention-test. Clear the case001 legal hold from hold-test. Delete both test blobs and confirm the operations now succeed, then delete rg-cloudtrips-immutable-test-weu.