# Ensure the storage container storing the activity logs is not publicly accessible

- Source: https://support.icompaas.com/support/solutions/articles/62000219825-ensure-the-storage-container-storing-the-activity-logs-is-not-publicly-accessible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [5. Logging and Monitoring](https://support.icompaas.com/support/solutions/folders/62000167548)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

The storage account container that stores exported Azure Activity Logs must not be publicly accessible. Activity logs contain sensitive operational information such as authentication events, configuration changes, resource modifications, and administrative actions. If the container is publicly exposed, unauthorised users, including attackers, could download or analyse these logs. This could reveal valuable insights into the environment’s structure, security posture, and potential vulnerabilities.

  

Rationale:

Allowing public access to activity logs can unintentionally provide adversaries with visibility into the account’s activities, configurations, and potential weaknesses. Attackers can use this information to plan targeted attacks or locate misconfigurations. Restricting public access ensures that only authorised users with proper storage account permissions can access these critical logs.

  

Impact:

-   Setting the container Access Policy to Private removes public and anonymous access for all users except authorised storage account owners.
    
-   If access is required for specific users, shared access signatures (SAS), RBAC, or Azure AD permissions must be explicitly configured to allow controlled access.
    

  

Default Value:

By default, public access is set to null, meaning the container allows only private access. The activity log export container is not publicly accessible unless manually changed.

  

Test plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Storage Accounts
    
3.  Open the Storage Account used for Activity Log export
    
4.  Under Data storage, select Containers
    
5.  Select the container used for storing Activity Logs
    
6.  Verify the Public access level is set to Private.
    
7.  If public access is enabled, follow the implementation steps
    

![](https://support.icompaas.com/assets/kb/0013c50d816de577.png)

  

Implementation steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Storage Accounts and select the storage account.
    
3.  Under data storage, click on containers and select the container used for storing logs.
    

                           ![](https://support.icompaas.com/assets/kb/a871ca4426b79727.png)

4.  Select the container used for storing logs and click Change Access Level.
    

![](https://support.icompaas.com/assets/kb/bf2237c24972daa8.png)

5.  Set the Public access level to Private (no anonymous access)
    

![](https://support.icompaas.com/assets/kb/da864e42509508fe.png)

6.  Save the changes
    

  

  Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Search for Storage Accounts
    
3.  Open the Storage Account and under the data storage, click the container
    
4.  Modify Public Access Level back to the previous configuration if operationally required
    
5.  Save the changes
    

  

References:

-   [https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access- configure](https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure)
    
-   [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-network-security#ns-1-implement-security-for-internal-traffic](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-network-security#ns-1-implement-security-for-internal-traffic)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.