You need to ensure that Azure Blob Storage containers in a storage account can never be made publicly accessible, even by storage account owners or administrators. Which Azure feature enforces this at the organizational level?

Question

Sunny · Accepted Answer

Assign Azure Policy 'Storage account public access should be disallowed' in Deny mode at the subscription or management group level. Azure Policy with a Deny effect prevents the creation or modification of storage accounts with public blob access enabled, even by subscription owners. Applying it at the management group level enforces it across all subscriptions. Per-account settings can be bypassed by privileged admins, but policy enforcement cannot be bypassed.

You need to ensure that Azure Blob Storage containers in a storage account can never be made publicly accessible, even by storage account owners or administrators. Which Azure feature enforces this at the organizational level?

You need to ensure that Azure Blob Storage containers in a storage account can never be made publicly accessible, even by storage account owners or administrators. Which Azure feature enforces this at the organizational level?

📚 What This Question Tests

More Storage Security Practice Questions