Azure Blob Storage account creation: To allow public access vs disable/limited public access

As you mentioned, when creating the Storage account in Azure the options for Network Access, is it safe to use the enable public access from all networks?

• Yes, but with proper security measures.

• If public access is enabled, anyone with the blob URL can view the data unless you restrict permissions correctly. Configure anonymous read access for containers and blobs - Azure Storage

• Enabling public access grants permissions at the container level in the storage account, allowing you to keep sensitive data containers private while enabling public access only for necessary folders.

• If your users have Static IPs means you can restrict access to only specific IP addresses and block unwanted traffic.

• Even if network access is enabled for all network's also people cannot easily authenticate. Because it needs anyone of authentication.

  1. Access key - Manage account access keys - Azure Storage | Microsoft Learn
  2. Microsoft Entra id - Authorize access to blob data in the Azure portal - Azure Storage | Microsoft Learn
  3. Shared Access Signature- Create shared access signature (SAS) tokens for storage containers and blobs - Azure AI services | Microsoft Learn

• If the user has any one of this only, they can be able to authenticate.

• Non-public is more secure compared to this, if you are enabled to virtual network and firewall particular user can access through only same virtual network, if they have access also, they can't be able to access if they are not in same virtual network.

Reference:

Configure Azure Storage firewalls and virtual networks | Microsoft Learn