Azure Storage account security: public blob access, shared keys, and SAS tokens

Two settings decide anonymous access

Anonymous blob access requires both the account setting allowBlobPublicAccess to be true and a container’s access level set to Blob or Container. Turning the account setting off overrides every container. New accounts default to disallowing it, but older accounts may still allow it.

Shared key authorization lets anyone with an account key do anything to the account. Disabling it with allowSharedKeyAccess false forces Entra ID authorization, which is auditable per identity.

SAS tokens

A shared access signature grants scoped access by URL. Account SAS and service SAS are signed with the account key, so they cannot be revoked individually except by rotating the key or using a stored access policy. User delegation SAS is signed with Entra ID credentials and is the preferred kind. Always set short expiry, minimal permissions, and HTTPS only.

Lab: audit a subscription

In a sandbox subscription, list every storage account with its public access, shared key, minimum TLS, and network default action. Create one account with public access allowed and a public container, confirm you can fetch a blob anonymously with curl, then disable public access at the account level and confirm the same request now fails.

az storage account list --query '[].{name:name,publicBlob:allowBlobPublicAccess,sharedKey:allowSharedKeyAccess,tls:minimumTlsVersion,network:networkRuleSet.defaultAction}' -o table

az storage account update -n mylabstorage -g lab-rg --allow-blob-public-access false

Enforce with Azure Policy

Built-in Azure Policy definitions can audit or deny storage accounts that allow public access, allow shared key access, or accept TLS below 1.2. Assign them at a management group so new subscriptions inherit the guardrail.