Anonymous access to an Azure storage container
Use az CLI output and jq to find storage accounts that allow anonymous blob access, then find the container that lets anyone list and download invoices.
Briefing
Defender for Cloud lists "Storage account public access should be disallowed" for two accounts. One serves website images on purpose. You need to find out whether the other one matters.
allowBlobPublicAccess on the account is the master switch. Each container then sets publicAccess to off, blob (read a blob if you know its name), or container (list and read everything).
cloud-shell · Cloud CLI review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.