Activity Log storage account blocks public blob access

Check ID: monitor_storage_account_with_activity_logs_is_private
Provider: Azure
Service: monitor
Severity: HIGH
Categories: internet-exposed, logging
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Monitor Activity Logs sent to a Storage account are evaluated for Blob public access. The finding identifies whether the account that stores the logs has AllowBlobPublicAccess turned on.

Risk

Exposed log data undermines confidentiality by revealing operations, resource IDs, IPs, and identities. Adversaries gain reconnaissance to map controls, craft targeted attacks, and time actions to avoid detection, enabling lateral movement and broader compromise.

Recommendation

Set AllowBlobPublicAccess=false on the storage account holding logs. Enforce least privilege via RBAC or scoped SAS, use private endpoints and network restrictions, and enable immutability for log containers to add defense in depth and prevent unauthorized access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az storage account update —name <STORAGE_ACCOUNT_NAME> —resource-group <RESOURCE_GROUP_NAME> —allow-blob-public-access false

# Disable public blob access on the storage account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_resource_name>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  allow_blob_public_access = false # Critical: disables public access at the account level
}

// Set storage account to disallow public blob access
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
  properties: {
    allowBlobPublicAccess: false // Critical: disables public access at the account level
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_storage_account_with_activity_logs_is_private. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Activity Log storage account uses a customer-managed key MySQL flexible server audits CONNECTION events

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires