Rotate Azure Storage Keys and Apply Lifecycle Policies with PowerShell
Rotate storage account keys, audit stored access policies, apply blob lifecycle rules, and lock down public access from one PowerShell workflow.
Azure Storage is one of the cheapest things on your bill until it isn't. Forgotten blobs in hot tier, lifecycle rules that were never applied, account keys that have not been rotated in years, and containers left open to anonymous access are all silent problems waiting for an audit.
The Az.Storage module makes every part of storage management scriptable. PSForge gives you the tasks already shaped into something you can compose into a single audit and remediation workflow.
What goes wrong with storage accounts at scale
- Blobs sit in hot tier when they should be in cool or archive
- Lifecycle management rules are missing or inconsistent across accounts
- Storage account keys have not been rotated in years and are shared across teams
- Containers have stored access policies that nobody remembers approving
- Public containers exist that should never have been public
- Soft-deleted blobs and snapshots accumulate retention costs
Why a workflow beats a one-off cleanup
Cleaning up storage once feels productive but does not stick. A workflow that runs monthly is what keeps the bill and the security posture from drifting again.
PSForge lets you assemble the audit, key rotation, lifecycle apply, and reporting tasks into a single workflow, generate the PowerShell, and schedule it from Azure Automation.
A note on SAS
Azure does not give you a server-side list of every ad-hoc SAS token that has ever been issued, so this workflow does not pretend to enumerate them. Instead it focuses on the things you can actually control: storage account keys (which back service SAS), stored access policies on containers (which can revoke entire classes of SAS at once), and a clear preference for user delegation SAS so usage shows up in Entra ID sign-in logs.
Example Azure Storage hygiene workflow
- Enumerate every storage account in the subscription with its tier and replication
- Audit which accounts have lifecycle management rules applied
- Apply a standard lifecycle policy to accounts that are missing one
- Report on storage account key age and rotate keys older than the defined threshold
- List stored access policies on each container and flag policies with long expirations
- Find publicly accessible containers and report them for review
- Export a summary of changes and findings to a compliance log
Final thoughts
Storage hygiene is one of the highest-ROI things a cloud team can automate.
PSForge makes it easy to build a single PowerShell workflow that keeps lifecycle rules, SAS tokens, and public exposure under control on a schedule.