maybe you could accomplish this with the infinitely confusing "condition" feature: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes#list-blobs