In Azure Storage, to ensure that newly added content cannot be modified or deleted for a fixed retention period, you must configure a container-level immutable storage policy, also known as a time-based retention policy or immutability policy. This feature is implemented through a stored access policy in Azure Blob Storage using the WORM (Write Once, Read Many) capability.
According to Microsoft's Azure Storage documentation, immutability policies can be configured in two ways:
Time-based retention policy - prevents data from being modified or deleted for a fixed duration (e.g., 1 year).
Legal hold - preserves data until the hold is explicitly cleared.
To implement the time-based retention policy, you configure a container-level access policy under Immutable blob storage settings. Once configured, any new blobs written to the container will be locked for the specified retention period and cannot be modified or deleted, ensuring compliance with retention regulations like SEC
17a-4(f) or GDPR.
The access level, access tier, or IAM settings do not provide this immutability. They control access permissions, performance, and user roles but do not enforce write-once protection.
Thus, the correct approach is to configure an access policy that enforces immutability for one year.