Azure Storage Account - Container cambia access level in automatico

Question

Azure Storage Account - Container cambia access level in automatico

ducarpit 0

Buonasera,

su Azure ho uno Storage Account con accesso anonimo abilitato, al suo interno ci sono diversi container con Access Level impostato su "Private" ed uno impostato s "Container".

Ho impostato quest'ultimo a "Blob" ma dopo un pò di tempo torna in automatico a "Container" e dai log non riesco a capire chi lo modifica e perchè. Considerando che sono l'unico amministratore dell'account e quindi non può essere un'azione umana...

Avete qualche idea?

Grazie in anticipo,

Christian

0 commenti

2 risposte

Risposta

Answer 1

Ganesh Patapati 12,170 Personale Esterno Microsoft Moderatore

Hello Ducarpit

you can check this over Activity log in the azure portal.

Open Azure Portal
Go to your Storage Account
In the left pane → Monitoring → Activity log

In the above screenshot go for Operation name
Click on Update Storage account Create.
Next, go to change history where you can view the resource updates.
Click on Resource Update to see the change logs and who made the updates.
Then check the properties to see who made the changes or see if there is any policy in place.

NOTE: Confirm that your storage account configuration aligns with your intended access policies, especially considering anonymous access settings.

To figure out what's causing the changes to the access level, you should review the storage analytic blob logs for any calls made to the Set Container ACL API. This API tracks who made the changes, along with details like user agent and client IP address.

References:

Hope the above answer helps! Please let us know do you have any further queries.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

ducarpit 0 Punti di reputazione

2026-02-06T13:41:36.35+00:00

Hi, thank you for your support but unfortunatly i can't find any usefull information on "Activity log", i can only see my operation i used to change the access level from "Container" to "Blob", and i can't click on Change History because it says: "Change history (Change history is not applicable to this type of activity log)".
Moreover, the isn't any action that describe the access level change from "Blob" to Container" :(
Ganesh Patapati 12,170 Punti di reputazione Personale Esterno Microsoft Moderatore

2026-02-09T08:21:02.1566667+00:00

Hello **Ducarpit**Thanks for the reply!

I have started a private message with you. Please review the private chat and share the required details so we can proceed with investigating the issue.
Ganesh Patapati 12,170 Punti di reputazione Personale Esterno Microsoft Moderatore

2026-02-10T14:34:00.4333333+00:00

Hello Ducarpit

Thanks for the reply!

yes, this might be due to the policy where every control plane operations will be recorded in activity log.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Ganesh Patapati 12,170 Punti di reputazione Personale Esterno Microsoft Moderatore

2026-02-12T09:30:46.5666667+00:00

Hello Ducarpit

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" and click "Accept Answer" which may be beneficial to other community members reading this thread.

Answer 2

Maybe, i found the "problem"...
Some months ago, i enabled the backup on this container within the storage account, and i set the georeplica.

It seems there is a policy that restore the access level when the replica syns run.
I found it with:

az storage account or-policy list --account-name <account_name> --resource-group <resource_group> -o json

ChatGTP says this is the "guilty".
I have also another storage account with a separate coninter and the same backup enabled but without georeplicas and i don't notice this behavior.
Do you think this is could be right?
Thanks