Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
Anonymous public read access to containers and blobs in Azure Storage might present security risks. This control checks that `allowBlobPublicAccess` is set to `false` on storage accounts, so containers or blobs cannot be set to a public access level.
Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data but might present security risks. Allowing public access permits unauthenticated users to read blob data or enumerate container contents when any container is made public, compromising confidentiality.
What this control checks
Storage accounts must have Allow Blob Anonymous Access set to Disabled
Common pitfalls
Setting is independent from Public Network Access
This is independent from the account's 'Public Network Access' setting, which is evaluated by storage_account_public_network_access_disabled.
Policy audit skips some ARO storage accounts
The audit policy excludes storage accounts in resource groups containing /resourceGroups/aro- whose names are like cluster* or imageregistry*.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure your Storage account public access to be disallowed" (13502221-8df0-4414-9937-de9c5c4e396b) and "Storage account public access should be disallowed" (4fa4b6c0-31ca-4c0d-b10d-24b96f62a751); Prowler check storage_blob_public_access_level_is_disabled (prowler azure --checks storage_blob_public_access_level_is_disabled); PowerPipe control azure_compliance.control.storage_account_blob_public_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov checks CKV2_AZURE_47 and CKV_AZURE_190.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...).
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 12 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
10 more clauses
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.2.6: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- 12 Asset management
- 10.3.9 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'
- 9.3.8 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.7 Ensure that 'Public access level' is disabled for storage accounts with blob containers
- 3.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled`
- 4.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled`
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(1) Access control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_blob_public_access_disabled - Checkov Checks:
CKV2_AZURE_47,CKV_AZURE_190 - Powerpipe Control:
azure_compliance.control.storage_account_blob_public_access_disabled - Prowler Check:
storage_blob_public_access_level_is_disabled - Azure Policy Definitions:
13502221-8df0-4414-9937-de9c5c4e396b,4fa4b6c0-31ca-4c0d-b10d-24b96f62a751
Last reviewed: 2026-10-15