Restrict access to a specific container in a Azure Storage BLOB to specific tenant (Azure AD)

Question

We are thinking to create a web application which will allow login to multiple organizations users (multi-tenant)

Logged in users will be able to upload files, so we are going to upload those files to Azure blob storage.

We are planning to keep a separate container for each organization (tenant) in same storage account.

So is there any way to authenticate & restrict organization user to a specific container?

Any custom authentication/authorization? Please suggest.

Answer 1

@Adit Shah Not sure I understand the question: Are you referring to the azure blob container: Assign Azure roles for access rights? If I am wrong, please correct me

Azure Active Directory (Azure AD) authorizes access rights to secured resources through Azure role-based access control (Azure RBAC). Azure Storage defines a set of Azure built-in roles that encompass common sets of permissions used to access blob and queue data. You can also define custom roles for access to blob and queue data.|

When an Azure role is assigned to an Azure AD security principal, Azure grants access to those resources for that security principal. Access can be scoped to the level of the subscription, the resource group, the storage account, or an individual container or queue. An Azure AD security principal may be a user, a group, an application service principal, or a managed identity for Azure resources.

Azure storage supports Azure AD authentication and can be used for authentication instead of storage account name / key, SAS tokens or SAS policy. Azure Storage Explorer can also use Azure AD to authenticate to storage service. You can read more about it here: https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad

It does mean that the application that is accessing storage accounts needs to support ad auth method as well. Can you share what applications will be accessing the storage account? If they don’t support it then SAS tokens / policy can be used.

Additional information: Prevent anonymous public read access to containers and blobs
There is also a similar thread discussion in SO forum which can give some information on your query.

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

--------------------------------------------------------------------------------------------------------------

Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Thanks for the reply @Sumarigo-MSFT.

Now we are using different mechanism.

What we are trying to achieve is assign access particular AD user group to a particular container.

i.e.

Group 1 can access only container1, but not container2
Group 2 can access only container2, but not container1

To achieve this I have given IAM Role Permission on each container accordingly (assigned Storage Blob Data Contributor Role to group).

Code Sample I used: https://github.com/Azure-Samples/storage-dotnet-azure-ad-msal

But to upload/download any file on container I have to assign role of Storage Blob Data Contributor on Storage Account as well. If I give Storage Blob Data Contributor on Storage Account then that Group users can add files to any container.

So is there any way to achieve like,
Group 1 can access only container1, but not container2
Group 2 can access only container2, but not container1

Answer 3

I had similar requirement and tried multiple different ways.

1. Gave storage blob reader at container level to user1. user1 was not able to see the storage account also in portal so this did not work.
2. secondly a gave access of reader at storage account level. After this change user was able to see the storage account in portal but it also gave access to all containers. so this was not right solution.
3. tried giving only reader permission at storage level, still user1 got read permission in all the containers.

Not sure what will be the right solution for this. may be some custom role can be build.

Answer 4

Hello,
Was this ever answered?

Answer 5

Any answers ???