--- cuppy_hub: azure cuppy_path: reference/storage/access-models.md cuppy_section: docs cuppy_doc: QV1H-KB8H cuppy_doc_uuid: 83c91612-4ca1-410e-9498-4cec029efdae cuppy_permalink: https://cuppy.io/azure/d/QV1H-KB8H cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/storage/access-models cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 1a79e155fd9fcc1e9dd89971e7ddf6703354d3dbc35a622dddf4d9596f3c23ed # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Storage access models — Entra data roles, Shared Key, SAS and anonymous access **A storage data request is authorized one of four ways:** an Entra ID token (recommended), Shared Key (an account key or connection string), a SAS token, or anonymously. Each account setting below switches one of them off. The control plane (creating the account, changing its settings) is ordinary Azure RBAC on `Microsoft.Storage/storageAccounts`; this document is about the **data plane**. ## Entra ID: data roles | Need | Role (scope: account or container; queue; table; share) | |---|---| | Read blobs | Storage Blob Data Reader | | Read, write, delete blobs | Storage Blob Data Contributor | | Also set ACLs and owners on ADLS Gen2 | Storage Blob Data Owner | | Make a user delegation key (for a user delegation SAS) | Storage Blob Delegator; also Queue, File and Table Delegator | | Queues | Storage Queue Data Reader / Contributor / Message Sender / Message Processor | | Tables | Storage Table Data Reader / Contributor | | Files over REST with Entra ID (these override file ACLs) | Storage File Data Privileged Reader / Contributor | - **Owner, Contributor and Storage Account Contributor grant no data access through Entra ID.** They do include `Microsoft.Storage/storageAccounts/listkeys/action` (so does **Reader and Data Access**), so while Shared Key is allowed, anyone holding them can read data **with the key**. Turning off Shared Key closes that path. - **Propagation.** Microsoft's page says both "up to 10 minutes" and "up to 30 minutes". At management-group scope, data actions can take up to 12 hours. Retry before you reassign. - The token scope is `https://storage.azure.com/.default` for every storage service. The `@azure/storage-*` clients request it for you. - Assigning the roles idempotently: `guides/rbac/assign-roles.md`. ## Shared Key | Setting | Values and default | |---|---| | `allowSharedKeyAccess` | `null` (the default) **is equivalent to true**. `false` refuses account keys, connection strings, account SAS and service SAS with `KeyBasedAuthenticationNotPermitted` | | `allowSharedKeyAccessForServices` (2026-06-01 API) | `{ blob, file, table, queue }` each with `enabled`. Present in the REST spec since 2025-08-01; rechecked 2026-10-20, Learn's "Prevent Shared Key authorization" page (updated August 2026) still describes only the account-wide `allowSharedKeyAccess`. The hub hasn't tested how the two combine: don't rely on per-service settings yet | | `defaultToOAuthAuthentication` | Default `false`. When `true`, the portal opens blob data with Entra ID instead of the key ("Default to Microsoft Entra authorization in the Azure portal") | **What breaks when Shared Key is off** (Microsoft's list, plus tool behaviour): - A **user delegation SAS** still works; account and service SAS don't. Microsoft's shared-key page says user delegation SAS is "Blob Storage only", while its SAS overview (and the Queue and File SDKs) support it for Queue, Table and Files too. Test before you rely on non-Blob user delegation SAS with Shared Key off. - The portal uses Shared Key for **Azure Files** by default; Cloud Shell's file share stops mounting; Storage Explorer has no Entra support for Files. - The Azure CLI: `az storage …` data commands **try the account key when `--auth-mode` is omitted**. Always pass `--auth-mode login` (or set `AZURE_STORAGE_AUTH_MODE=login`). - A **ReadOnly** lock on the account blocks `listKeys` (it's a POST), so key-based tools and the portal's key path fail there too. - Terraform `azurerm` needs `storage_use_azuread = true` in the provider block. **Migrate in this order:** find key-based traffic (the account's **Transactions** metric split by authentication; in logs, `StorageBlobLogs | where AuthenticationType in ("AccountKey", "SAS")`), move each client to Entra ID, then set `allowSharedKeyAccess: false`. The built-in policy **Storage accounts should prevent shared key access** audits or enforces it. ## Anonymous (public) access - `allowBlobPublicAccess` defaults to **false** in the 2026-06-01 spec ("default interpretation") and for accounts made by `az storage account create`. - An anonymous read succeeds only if the **account** allows it, the **container**'s access level allows it, and the request is a read. The account setting overrides every container. - With anonymous access off, an anonymous request gets 401 (service version 2019-12-12 and later), or 409 or 404 with older versions. - On ADLS Gen2, anonymous read on a container bypasses its ACLs for reads. ## Defaults that changed or surprise | Where | Default | |---|---| | `az storage account create --kind` | `StorageV2` | | `az storage account create --sku` | **`Standard_RAGRS`** (geo-redundant, read access). Pass `--sku Standard_LRS` or `Standard_ZRS` if that isn't what you want | | `minimumTlsVersion` in the REST spec | "default interpretation is TLS 1.0", but the service has refused TLS 1.0/1.1 since February 3, 2026. Set `TLS1_2` explicitly (`TLS1_3` can't be the minimum yet) | | `supportsHttpsTrafficOnly` | `true` since API 2019-04-01 | | `publicNetworkAccess` | Optional: `Enabled`, `Disabled` or `SecuredByPerimeter`; `reference/storage/network-and-firewall.md` | Errors from each gate: `reference/storage/access-errors.md`. Azure Files over SMB and NFS: `reference/storage/files-access-and-errors.md`; Tables from TypeScript: `reference/storage/tables.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.