# Ensure That 'Allow Blob Anonymous Access' Is Set to 'Disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000234853-ensure-that-allow-blob-anonymous-access-is-set-to-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   Level 1

Description:  
 The 'Allow Blob Anonymous Access' setting controls whether blobs in an Azure Storage Account can be accessed publicly without authentication. Disabling anonymous access ensures that blobs are only accessible to authorized users, protecting sensitive data from public exposure.

Rationale:  
 Allowing anonymous access to blobs can lead to unintentional data leaks or unauthorized data consumption. Disabling this setting enforces access control policies and enhances data security by requiring authentication for all blob access.

Impact:

Pros:  

-   Prevents unauthorized public access to blob data.  
    
-   Enhances compliance with data privacy and security regulations.  
    
-   Supports secure application architectures.  
    

Cons:  

-   May disrupt applications or services relying on public blob access.  
    
-   Requires review and possible modification of access patterns.  
    

Default Value:  
 Anonymous access is disabled by default on most Azure Storage Accounts but should be verified.

Pre-requisites:

-   Permissions to modify storage account access settings.  
    
-   Understanding of application requirements regarding blob accessibility.  
    

### Remediation

Test Plan:

**Using Azure Portal:**

1.  Sign in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to the Storage Account.  
    
3.  Under Configuration or Settings, check the Allow Blob Anonymous Access option.
    
4.  Verify it is set to Disabled.  
    

**Using Azure CLI:**

1.  Check anonymous access setting:  
    
    \# az storage account show --name <storage-account-name> --resource-group <resource-group> --query allowBlobPublicAccess
    
2.  Confirm the output is false.  
    

### **Implementation Plan**

**Using Azure Portal:**

1.  In the storage account Configuration settings, disable Allow Blob Anonymous Access.  
    
2.  Save changes and validate access controls.
    

**Using Azure CLI:**

1.  Disable anonymous blob access:  
    
    \# az storage account update --name <storage-account-name> --resource-group <resource-group> --allow-blob-public-access false
    
2.  Confirm the update.  
    

### **Backout Plan**

**Using Azure Portal:**

1.  Enable Allow Blob Anonymous Access if required.
    
2.  Inform stakeholders and monitor for any issues.  
    

**Using Azure CLI:**

Enable anonymous blob access:

\# az storage account update --name <storage-account-name> --resource-group <resource-group> --allow-blob-public-access true

References: 

-   [Configure Public Access for Azure Storage  
    ](https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure)
    
-   [Azure Storage Security Best Practices  
      
    ](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-security-guide)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.