Private access to exact container in Azure Storage Explorer

Question

I need to store some sensitive data in one container in Storage Explorer. The container has Container Public Access Level set as No public access. But still all members have access to this container. Where to change the settings (Azure Active Directory, Access policy, Acess control) to be absolutely sure that no one except two people can see the content. I need to have it under control before I put something there.

Answer 1

Storage Explorer supports Azure RBAC access to Storage Accounts, Blobs, and Queues which give you fine-grained access control over your Azure resources. Azure roles and permissions can be managed from the Azure portal.

You can scope access to Azure blob resources at the an individual container level: Authorize access to blobs using Active Directory - Azure Storage | Microsoft Docs

• Select the container for which users access has to be controlled.

• Click Access control (IAM) in the container and Click on add assignment .

1. Select appropriate role to allow for the users.

• And then select the users who can have the access to that container according to the role .Please check the data actions and not data actions to see what exact permissions apply to them

References:

1. storage-explorer-security
2. Assign roles

Just like role assignment,you can check Azure deny assignments can attach few deny actions to a user, group, or service principal for scope required to deny access.

It blocks users from performing specific Azure resource actions even if role is been granted access. deny-assignments-portal

Note:Azure Blueprints and Azure managed apps are the only way that deny assignments are used within Azure.