Share via

Access to hidden storage accounts for read permissions to users.

Girish Prajwal 706 Reputation points
2020-10-20T05:43:49.923+00:00

Hi Team,

Is there a way to hide particular storage account so that user with read access not able to view it when using storage explorer.

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,844 questions
0 comments
Accepted answer
  1. Sumarigo-MSFT 44,671 Reputation points Microsoft Employee
    2020-10-20T09:44:53.597+00:00

    @Girish Prajwal Question, if a user can read a blob from a storage account, the name of the storage account is present in the URL/properties of the blob (so, the user can still tell there is an account and access via script/programmatically).

    ‘Storage Blob Data Reader’ may limit the ability to list the account (: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-reader)

    You need a read permission or Reader role on the subscription to enumerate resources, including storage accounts.
    Storage Blob Data Reader role grants permissions for reading blob content and metadata in the storage account.

    Also, Let me explain how this roles works and the define of the RBAC, see here

    If it's for Azure Files You can do an AD integration with SMB to grant access to users. Here you can learn more about it : https://azure.microsoft.com/en-us/blog/better-security-with-enhanced-access-control-experience-in-azure-files/ also if possible review the RBAC roles article What is Azure role-based access control (Azure RBAC)?

    33500-capture.png
    Hope this helps!

    Kindly let us know if the above helps or you need further assistance on this issue.

    ------------------------------------------------------------------------------------------------------------

    Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Girish Prajwal 706 Reputation points
    2020-10-21T09:21:04.407+00:00

    To continue on the previous query
    @Sumarigo-MSFT,

    I have users with read permissions on few of the subscriptions. I don't want them to see any storage accounts where they have read permissions whenever they access it from Storage Explorer/via portal storage explorer.

    Your answer as mentioned above, does it work in my scenario. Please elaborate.