Let a user view and modify only on container in a storage account

Question

I want the user to see only one container and hide others in a storage account.

The problem, that I can give Read access on the storage account level which means that the user will see all containers, and if I give access on the Container level the user won't be able to see anything.

Thank you

Answer 1

Make sure that you're using Role Based assignments, eg. Storage Blob Data Reader or Storage Blob Data Contributor

Then to grant access to just a single container, you'll assign an RBAC role at the container scope. https://learn.microsoft.com/en-us/azure/storage/blobs/blob-containers-portal#manage-azure-rbac-role-assignments-for-the-container

Answer 2

@Quitrie LAGRANDE

I would like to highlight that users must have Reader permissions for storage in order to access storage account resources/containers. These permissions do not grant the ability to modify data in Azure storage.

 In order to meet your requirement, I would suggest granting Reader permissions at the storage account level and Storage Blob data contributor permissions at the container level. This will enable users to access the specific container while maintaining restrictions on access to other containers within the storage account.

Assign an Azure role for access to blob data - Azure Storage | Microsoft Learn

Another solution is to generate a SAS (Shared Access Signature) token at the storage container level and then attach it to an individual blob container within the storage explorer. This approach allows for controlled and secure access to that specific container, maintaining the required restrictions.

Hope this helps. Please let us know if you have any further questions and we will be glad to assist you further. Thank you!

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.