A healthcare organization needs to store patient records that must be immutable and cannot be modified or deleted for 7 years due to regulatory compliance. Which Azure feature should they use?
Immutable blob storage applies time-based retention or legal hold policies, preventing modification or deletion for a specified period. This satisfies the healthcare scenario's seven-year regulatory requirement for records that cannot be altered or removed, enforced at the storage layer.
Why this answer
Azure Blob Storage immutable storage is correct because it provides WORM (Write Once, Read Many) capabilities that prevent data from being modified or deleted for a specified retention period. This directly meets the regulatory requirement for patient records to remain immutable for 7 years, as the policy is enforced at the storage level and cannot be overridden by any user, including administrators.
Exam trap
The trap here is that candidates confuse Azure Policy (which enforces resource-level compliance rules) with data-level immutability, but Azure Policy cannot prevent data modification within a blob—only Azure Blob Storage immutable storage provides that guarantee.
How to eliminate wrong answers
Option A is wrong because Microsoft Purview is a data governance and catalog service for discovering and classifying data, not a storage-level immutability enforcement mechanism. Option B is wrong because Azure Policy enforces organizational rules and compliance across Azure resources (e.g., restricting resource locations), but it cannot prevent modification or deletion of data within a storage blob. Option D is wrong because Microsoft Defender for Cloud is a security posture management and threat protection service, not a data immutability feature.