Public vs Private Access in Azure Blob Storage

Understanding Access Levels

Azure Blob Storage provides granular control over who can access your data.

Access Level Options

1. Private (No Anonymous Access)

• Default and recommended
• Requires authentication (key or managed identity)
• Use for: sensitive data, private documents

2. Blob (Anonymous Read Access for Blobs)

• Blobs can be read without authentication
• Cannot list containers or access container metadata
• Use for: public assets (images, videos, static websites)

3. Container (Anonymous Read Access)

• Full read access to all blobs in container
• Can list blobs within the container
• Use for: sharing multiple public files

Setting Access Level

Via Portal

1. Go to Storage Account → Containers
2. Select container → Click Change access level
3. Choose: Private, Blob, or Container
4. Save

Via CLI

# Set container to public blob access
az storage container set-permission \
  --name mycontainer \
  --account-name mystorage001 \
  --public-access blob

# Set container to private (no access)
az storage container set-permission \
  --name mycontainer \
  --account-name mystorage001 \
  --public-access off

When to Use Each

Security Best Practices

1. Default to Private - Always start with private access
2. Use Managed Identities - Avoid storing account keys in code
3. Enable Azure Defender - Monitor for suspicious access
4. Use SAS Tokens - Generate time-limited access for specific files

Next Steps

• Learn about Connection Strings & Keys
• Explore SAS Tokens

Azure Integration Hub - Beginner Level