Storage account has 'Allow blob public access' disabled

Check ID: storage_blob_public_access_level_is_disabled
Provider: Azure
Service: storage
Severity: HIGH
Categories: internet-exposed
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts with blob public access disabled prevent containers or blobs from being set to a public access level. Setting allow blob public access to false enforces no anonymous reads across the account.

Risk

Allowing public access permits unauthenticated users to read blob data or enumerate container contents when any container is made public, compromising confidentiality. Exposed objects can be scraped at scale, enabling data exfiltration and intelligence gathering without audit attribution.

Recommendation

Disable blob public access at the account and enforce authenticated access based on least privilege. Prefer private endpoints or restricted networks, use short-lived SAS or federated identities, and apply RBAC with container-level permissions. Monitor access and review exposure regularly.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az storage account update -g <RESOURCE_GROUP> -n <STORAGE_ACCOUNT_NAME> —allow-blob-public-access false

resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"
  allow_blob_public_access = false # Critical: disables anonymous/public blob access
}

// Storage account with blob public access disabled
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: { name: 'Standard_LRS' }
  properties: {
    allowBlobPublicAccess: false // Critical: disables anonymous/public blob access at the account
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_blob_public_access_level_is_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Storage account has shared key access disabled Storage account has blob versioning enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires