How to prevent users from deleting files from Azure Storage

Dominic Buschi 1

We use RBAC to authorize users. Users have Contributor rights to Azure Storage accounts. Is there a way to remove DELETE permissions? Users should be able to add and update content, but not to remove anything. Note: We are using Soft Delete and Versioning to ensure against accidental delete but it would be nicer to just prevent deletions altogether.
Thanks for your help!

1 answer

Takahito Iwasa 4,841 Reputation points MVP

2022-05-05T20:57:50.763+00:00

Hi, @Dominic Buschi

I heard your scenario was like immutable storage.

If that is appropriate, you can use the WORM (Write Once, Read Many) state feature to allow only create and reference and block deletes and updates.

https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview

Even if you prevent the file from being deleted, you can update it with a dummy file, so the WORM setting is suitable for some scenarios.
Please sign in to rate this answer.

1 person found this answer helpful.
Dominic Buschi 1 Reputation point

2022-05-06T07:25:18.45+00:00

Thanks for your response! I have looked at immutable storage. It meets my requirements in a sense that nothing can be deleted, and I would retain all previous versions. but it's overkill in the sense that even administrators cannot delete anything once the policy is locked. For that reason, I am currently leaning toward the combination of Soft Delete and Versioning.
But I was hoping to find a more straight-forward way of preventing users from deleting files.

Sumarigo-MSFT 43,401 Reputation points Microsoft Employee

2022-05-17T10:10:29.69+00:00

@Dominic Buschi Adding more information to the above response!

Microsoft recommends locking all of your storage accounts with an Azure Resource Manager lock to prevent accidental or malicious deletion of the storage account. Azure Storage Locks:

Based on your scenario you may go with Soft delete, Kindly lets us know if you have any question, I will be happy to assist you. Apologies for the delay response

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Sign in to comment