A storage data request is authorized one of four ways: an Entra ID token (recommended), Shared Key (an account key or connection string), a SAS token, or anonymously. Each account setting below switches one of them off. The control plane (creating the account, changing its settings) is ordinary Azure RBAC on Microsoft.Storage/storageAccounts; this document is about the data plane.

Entra ID: data roles

Need	Role (scope: account or container; queue; table; share)
Read blobs	Storage Blob Data Reader
Read, write, delete blobs	Storage Blob Data Contributor
Also set ACLs and owners on ADLS Gen2	Storage Blob Data Owner
Make a user delegation key (for a user delegation SAS)	Storage Blob Delegator; also Queue, File and Table Delegator
Queues	Storage Queue Data Reader / Contributor / Message Sender / Message Processor
Tables	Storage Table Data Reader / Contributor
Files over REST with Entra ID (these override file ACLs)	Storage File Data Privileged Reader / Contributor

Owner, Contributor and Storage Account Contributor grant no data access through Entra ID. They do include Microsoft.Storage/storageAccounts/listkeys/action (so does Reader and Data Access), so while Shared Key is allowed, anyone holding them can read data with the key. Turning off Shared Key closes that path.
Propagation. Microsoft's page says both "up to 10 minutes" and "up to 30 minutes". At management-group scope, data actions can take up to 12 hours. Retry before you reassign.
The token scope is https://storage.azure.com/.default for every storage service. The @azure/storage-* clients request it for you.
Assigning the roles idempotently: guides/rbac/assign-roles.md.

Shared Key

Setting	Values and default
`allowSharedKeyAccess`	`null` (the default) is equivalent to true. `false` refuses account keys, connection strings, account SAS and service SAS with `KeyBasedAuthenticationNotPermitted`
`allowSharedKeyAccessForServices` (2026-06-01 API)	`{ blob, file, table, queue }` each with `enabled`. Present in the REST spec since 2025-08-01; rechecked 2026-10-20, Learn's "Prevent Shared Key authorization" page (updated August 2026) still describes only the account-wide `allowSharedKeyAccess`. The hub hasn't tested how the two combine: don't rely on per-service settings yet
`defaultToOAuthAuthentication`	Default `false`. When `true`, the portal opens blob data with Entra ID instead of the key ("Default to Microsoft Entra authorization in the Azure portal")

What breaks when Shared Key is off (Microsoft's list, plus tool behaviour):

A user delegation SAS still works; account and service SAS don't. Microsoft's shared-key page says user delegation SAS is "Blob Storage only", while its SAS overview (and the Queue and File SDKs) support it for Queue, Table and Files too. Test before you rely on non-Blob user delegation SAS with Shared Key off.
The portal uses Shared Key for Azure Files by default; Cloud Shell's file share stops mounting; Storage Explorer has no Entra support for Files.
The Azure CLI: az storage … data commands try the account key when --auth-mode is omitted. Always pass --auth-mode login (or set AZURE_STORAGE_AUTH_MODE=login).
A ReadOnly lock on the account blocks listKeys (it's a POST), so key-based tools and the portal's key path fail there too.
Terraform azurerm needs storage_use_azuread = true in the provider block.

Migrate in this order: find key-based traffic (the account's Transactions metric split by authentication; in logs, StorageBlobLogs | where AuthenticationType in ("AccountKey", "SAS")), move each client to Entra ID, then set allowSharedKeyAccess: false. The built-in policy Storage accounts should prevent shared key access audits or enforces it.

Anonymous (public) access

allowBlobPublicAccess defaults to false in the 2026-06-01 spec ("default interpretation") and for accounts made by az storage account create.
An anonymous read succeeds only if the account allows it, the container's access level allows it, and the request is a read. The account setting overrides every container.
With anonymous access off, an anonymous request gets 401 (service version 2019-12-12 and later), or 409 or 404 with older versions.
On ADLS Gen2, anonymous read on a container bypasses its ACLs for reads.

Defaults that changed or surprise

Where	Default
`az storage account create --kind`	`StorageV2`
`az storage account create --sku`	`Standard_RAGRS` (geo-redundant, read access). Pass `--sku Standard_LRS` or `Standard_ZRS` if that isn't what you want
`minimumTlsVersion` in the REST spec	"default interpretation is TLS 1.0", but the service has refused TLS 1.0/1.1 since February 3, 2026. Set `TLS1_2` explicitly (`TLS1_3` can't be the minimum yet)
`supportsHttpsTrafficOnly`	`true` since API 2019-04-01
`publicNetworkAccess`	Optional: `Enabled`, `Disabled` or `SecuredByPerimeter`; `reference/storage/network-and-firewall.md`

Errors from each gate: reference/storage/access-errors.md. Azure Files over SMB and NFS: reference/storage/files-access-and-errors.md; Tables from TypeScript: reference/storage/tables.md.