How to find storage accounts with public access in Azure

Before you start

Use an Azure account with read access to the storage accounts you want to check. Resource Graph returns only the resources the account can read, and the built-in Reader role at the subscription or a parent scope gives that access. The PowerShell example uses Az.Accounts and Az.ResourceGraph.

The query reads the allowBlobPublicAccess property of every storage account in Resource Graph's Resources table, which the Azure portal shows as Allow Blob anonymous access. It keeps accounts where the property is true or not set, the same rule Microsoft's own remediation script uses. Resource Graph is indexed with a short delay, so a recent change may not appear yet. The script reads Azure and exports a CSV without changing anything. Its finally block disconnects the account and clears its local Azure contexts, so you may need to sign in again to use them.

Option 1

Find storage accounts with public blob access using PowerShell

Install the modules once and connect to Azure. The query lists each storage account whose setting is true or not set.

Install-Module -Name Az.Accounts, Az.ResourceGraph -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptionIds = @(
        Get-AzSubscription |
        Where-Object State -eq 'Enabled' |
        Select-Object -ExpandProperty Id
    )
    if ($subscriptionIds.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $query = @(
        'Resources'
        '| where type =~ "microsoft.storage/storageaccounts"'
        '| extend setting = iff(isnull(properties.allowBlobPublicAccess),'
        '    "not set", tostring(properties.allowBlobPublicAccess))'
        '| where setting != "false"'
        '| project id, name, subscriptionId, resourceGroup, location, setting'
        '| order by id asc'
    ) -join ' '
    $rows = [System.Collections.Generic.List[object]]::new()
    $skipToken = $null
    do {
        $arguments = @{
            Query = $query
            Subscription = $subscriptionIds
            First = 1000
        }
        if ($skipToken) { $arguments.SkipToken = $skipToken }
        $page = Search-AzGraph @arguments
        foreach ($record in $page.Data) { $rows.Add($record) }
        $skipToken = $page.SkipToken
    } while ($skipToken)
    if ($rows.Count -eq 0) {
        Write-Output 'No storage accounts allow public blob access in the indexed resources.'
    } else {
        $rows | Select-Object name, resourceGroup, subscriptionId, location, setting, id |
            Export-Csv -Path './storage-public-blob-access.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) storage accounts saved to storage-public-blob-access.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The export has each account's name, resource group, subscription, location, the setting (true or not set) and its full resource ID. An empty result writes a message, not an empty CSV. To narrow the search, keep only the subscription IDs you want in $subscriptionIds. To list every account with its setting, remove the line that filters on setting. The query keeps id in the output because Azure's continuation token needs it to page past 1,000 results.

Option 2

Review storage accounts in Azure Resource Graph Explorer

1. Sign in to the Azure portal with read access to the subscriptions.
2. Search for resource graph > choose Resource Graph Explorer.
3. To change its scope, choose Directory, then choose the directory, management group or subscription to query.
4. Paste this query in Query 1 and choose Run query:
   KQL

   Resources
   | where type =~ 'microsoft.storage/storageaccounts'
   | extend setting = iff(isnull(properties.allowBlobPublicAccess), 'not set',
       tostring(properties.allowBlobPublicAccess))
   | where setting != 'false'
   | project name, resourceGroup, subscriptionId, location, setting, id
   | order by id asc

5. Review the accounts in Results. To keep a copy, choose Download as CSV.

To check 1 account instead, open it in the Azure portal, choose Settings > Configuration and read Allow Blob anonymous access. Do not change it to test, since that rejects every anonymous read of the account.

Explorer suits an occasional query across subscriptions. Use PowerShell when you need a repeatable CSV or automatic paging.

Common questions

Does "allowed" mean my blobs are public?

No. The account setting only lets a container be made public. Blob data can be read anonymously only when the account allows it and a container's access level is Blob or Container, and the account's firewall rules still apply. For a flagged account, open Data storage > Containers in the Azure portal, or run Get-AzStorageContainer for the account and read PublicAccess, where Off means private.

Why does an account show "not set"?

Azure leaves the property blank when nobody set it, and Resource Graph shows null. Microsoft's sample script treats blank like true, so this guide and Altivane do too. Open the account's Configuration page before deciding.

What else should I check after storage accounts?

Public IP addresses are the other common way Azure resources reach the internet, and an address attached to nothing can usually go. See how to find unused public IP addresses in Azure.