Back to Checks
azure

Storage account has 'Allow Blob Anonymous Access' disabled

storage_blob_public_access_level_is_disabled
Service: storageSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts with blob anonymous (public) access disabled prevent containers or blobs from being set to a public access level. Setting allowBlobPublicAccess to false enforces no anonymous reads across the account. This is independent from the account's 'Public Network Access' setting, which is evaluated by storage_account_public_network_access_disabled.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing public access permits unauthenticated users to read blob data or enumerate container contents when any container is made public, compromising confidentiality.

Exposed objects can be scraped at scale, enabling data exfiltration and intelligence gathering without audit attribution.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_blob_public_access_level_is_disabled

Recommendation

Disable blob public access at the account and enforce authenticated access based on least privilege. Prefer private endpoints or restricted networks, use short-lived SAS or federated identities, and apply RBAC with container-level permissions. Monitor access and review exposure regularly.

Remediation

CLI

az storage account update -g <RESOURCE_GROUP> -n <STORAGE_ACCOUNT_NAME> --allow-blob-public-access false

Terraform

resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"
  allow_blob_public_access = false # Critical: disables anonymous/public blob access
}

NativeIaC

// Storage account with blob public access disabled
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: { name: 'Standard_LRS' }
  properties: {
    allowBlobPublicAccess: false // Critical: disables anonymous/public blob access at the account
  }
}

Other

1In Azure Portal, go to Storage accounts and select the target account
2Under Settings, open Configuration
3Set "Allow Blob public access" to Disabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_blob_public_access_level_is_disabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has allow blob public access enabled."

                if not storage_account.allow_blob_public_access:
                    report.status = "PASS"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has allow blob public access disabled."

                findings.append(report)

        return findings

References