Are unauthorized API calls to a storage account billed?

Question

Are unauthorized API calls to a storage account billed?

Thomas Lauronen 31

I've been struggling to get this question answered by support. If someone makes an unauthorized API call to a storage account, will the owner of the account be billed? Documentation seems to imply that this is the case, but I'm yet to get a definite yes or no.

Accepted answer

1 additional answer

Your answer

Answer 1

Amrinder Singh 5,870 Microsoft Employee Volunteer Moderator

Hi Thomas Lauronen - Thanks for reaching out.

The unauthorized failure/error operations are billable and here is the reference documentation for the same.

https://learn.microsoft.com/en-us/rest/api/storageservices/storage-analytics-logged-operations-and-status-messages

Please let us know if you have any further queries. I’m happy to assist you further.

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Amrinder Singh 5,870 Reputation points Microsoft Employee Volunteer Moderator

2024-05-23T13:46:33.02+00:00

Hi Thomas Lauronen - Following up to check if there are any follow up queries ahead.
Thomas Lauronen 31 Reputation points

2024-05-23T21:44:50.46+00:00

Thank you for the response, and the billable column refers to a Blob Service REST API call even if Storage Analytics is not enabled?
Amrinder Singh 5,870 Reputation points Microsoft Employee Volunteer Moderator

2024-05-24T05:30:46.4866667+00:00

Hi Thomas Lauronen - That's correct and it points to the response status and whether that's billable or not.

Billable: A yes/no value that indicates whether or not the request is billable

Hope that helps!

Answer 2

Nehruji R 8,181 Microsoft External Staff Moderator

Hello Thomas Lauronen,

Greetings! Welcome to Micrsoft Q&A Platform.

Adding to above response. Unauthorized API calls to a storage account can indeed have billing implications.

For example- When you enable Storage Analytics for your Azure Storage account, it keeps track of data plane operations (such as read, write, and delete requests) happening over the account. These logs are essential for troubleshooting scenarios. However, there is a billing associated with this logging.

To avoid unexpected charges, ensure proper access controls and authentication mechanisms for your storage accounts and regularly review your storage analytics logs to identify any unusual activity.

Hope this answer help! Please let us know if you have any further queries. I’m happy to assist you further.

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Thomas Lauronen 31 Reputation points

2024-05-23T21:50:28.4733333+00:00

Thank you for responding! In my scenario Storage Analytics would not be enabled. However, you raise an excellent point that the billing implications of logging operations may often be overlooked.
Nehruji R 8,181 Reputation points Microsoft External Staff Moderator

2024-05-24T06:27:57.9666667+00:00

If Storage Analytics is enabled, you will have the detailed logs of data plane operations and you can easily track the unauthorized API calls by the logs and still if not enabled you can consider the following to avoid risks and minimize potential costs,

Ensure that you have proper access controls in place for your storage account. Limit access to authorized users and applications. Use shared access signatures (SAS) or Azure AD authentication to control who can perform operations on the storage account.

Configure network security rules for your storage account. You can use virtual networks, firewalls, and service endpoints to restrict access to specific IP ranges or virtual networks.

Even without Storage Analytics, set up monitoring and alerts. Azure Monitor can help you create custom alerts based on metrics or logs. For example, you can set an alert if the number of requests exceeds a certain threshold.

Periodically review your storage account activity. While you won’t have detailed logs, you can still check for any unusual patterns or unexpected usage.

Hope my suggestion's will be helpful! Please let us know if you have any further queries.

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Jason Viloria 0 Reputation points

2024-06-04T12:24:30.92+00:00
If I have a storage account that should be accessed only from 3 IPs and various vnet's would it be enough to do in networking for the storage account:

Virtual Networks : Add only the vnets that need to access the account.

Firewall - Add the 3 public IP's that shall be allowed to access.

In Access Control, add only the managed identities that are allowed to read or write to the storage account.

My concern is that someone on the internet could just keep hitting the storage account URL and rack up costs.

Share via

Are unauthorized API calls to a storage account billed?

1 additional answer

Your answer