Question

A financial services company must retain scanned loan documents in Azure Blob Storage for regulatory compliance. Auditors require that once a document is written, it cannot be modified or deleted for a fixed 7-year period, and this protection must survive attempts by any user—including storage account administrators. Which approach should you recommend?

Accepted Answer

Enable a time-based retention immutability policy in locked state on the blob container using WORM (Write Once, Read Many) storage

Answer

Apply an Azure RBAC deny assignment on the storage account to block delete operations for all users

Answer

Configure a blob lifecycle management rule that prevents deletion for 7 years and moves data to the archive tier

Answer

Enable soft delete for blobs with a 2555-day retention period and turn on blob versioning