Your finance team writes audit logs as append blobs to a container named audit. Regulations require Write Once, Read Many (WORM) protection for six years, but the application must continue appending to the existing append blobs during the retention period. After initial testing, the policy must be enforced so it can’t be shortened. What should you configure to meet these requirements?

The correct solution is to configure a time-based immutability policy on the container. This policy supports WORM (Write Once, Read Many) requirements. Enabling allowProtectedAppendWrites is crucial because it permits new blocks to be added to existing append blobs while preventing modification or deletion of existing data, fulfilling the requirement to continue appending. Locking the policy ensures it cannot be shortened or deleted, meeting the enforcement requirement. Blob versioning and soft delete protect against accidental deletion or modification but do not provide WORM compliance or prevent new appends to existing blobs under a WORM policy. A legal hold prevents deletion but doesn't allow appends to existing blobs under WORM, nor does it guarantee a fixed retention period like a time-based policy. An Azure Policy initiative to deny Delete and Put Blob operations would prevent all writes (including appends), not just modifications or deletions, and doesn't offer WORM compliance.