How to disable the Azure policy 'Storage account public access should be disallowed'?

Question

How to disable the Azure policy 'Storage account public access should be disallowed'?

Aleksey 25

When setting the 'Public read access for blob only' Access level for an Azure Container, it reverts back to 'No public access' after a short period.

It seems that the Azure policy 'Storage account public access should be disallowed' is responsible for this behavior.

What steps are needed to disable this policy? User's image

Alex Burlachenko 13,330 Reputation points Volunteer Moderator

2025-07-17T09:27:38.79+00:00
Hey mr.Aleksey, ca va?

thanks for bringing this up) so first things to disable that pesky 'storage account public access should be disallowed' policy, u gotta dance through the azure portal a bit.

pop open the azure portal (https://portal.azure.com) and head straight to 'policy' under the 'policy | compliance' section. u can find it in the left sidebar or just search for it like a normal person would. now look for 'definitions' - thats where all the policies live, sleeping until they decide to ruin ur day. find that specific policy by searching 'storage account public access should be disallowed'. its usually under the 'storage' category because, well, obvious reasons. once u found it, dont just click randomly - check if its assigned at management group, subscription or resource group level. this matters because u need to modify the right assignment. in ur screenshot i see 'ASC default' subscription so thats probably where the action is.

now heres the fun part lol ))))))))) u got an options

if u want to completely nuke the policy, just delete the assignment. bold move. if u prefer to keep it but make it stop bothering u, create an exemption (see that 'create exemption' button in ur screenshot? thats ur new best friend). or u can tweak its parameters to be less strict, but thats advanced mode.

for most cases, creating exemption is the way to go. click that button, select the scope (where u want to allow public access), give it a cute name like 'let_my_blobs_breathe', and provide a reason that wont make security team cry. maybe 'business requirement' or 'temporary testing' - u know the drill.

exemptions need 'exempt' permission which not everyone has. if u hit a wall here, u might need to bother ur azure admin with puppy eyes.

as well check this https://docs.microsoft.com/en-us/azure/governance/policy/concepts/exemption-structure

if u work with public blob access often, maybe setup some alerts to monitor changes? azure monitor can help with that too. worth looking into even if u use other cloud stuff.

after making changes, give it like 15-30 mins to propagate. azure policies dont always update instantly, they like to take their sweet time. if it still reverts, double check u modified the right assignment and didnt miss any other policies lurking around.

hope this helps

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx. P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/
Aleksey 25 Reputation points

2025-07-19T10:05:33.24+00:00

Hi Alex, thanks for the instructions! It was fun to read)))

But after that I disabled it - nothing changed(

I.e. after setting the 'Public read access for blob only' Access level for an Azure Container, it reverts back to 'No public access' after a short period.

1 answer

Your answer

Aleksey 25 Reputation points

2025-07-19T10:05:33.24+00:00

Hi Alex, thanks for the instructions! It was fun to read)))

But after that I disabled it - nothing changed(

I.e. after setting the 'Public read access for blob only' Access level for an Azure Container, it reverts back to 'No public access' after a short period.

Answer 1

Shikha Ghildiyal 6,715 Microsoft Employee Moderator

Hi Aleksey

Thanks for reaching out to Microsoft Q&A.

Go to the policy and click on edit assignments. You will see assignment page.

Scroll down and click on disabled button and save it. policy will be disabled

User's image

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Rahul Jorrigala 3,655 Reputation points Microsoft External Staff Moderator

2025-07-18T01:08:03.49+00:00

Hi Aleksey

Just want to check if the above answer provided by @Shikha Ghildiyal, worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the answer is helpful, please click "accept the answer" and "Yes"

Thankyou
Naveena Patlolla 4,805 Reputation points Microsoft External Staff Moderator

2025-07-18T22:27:49.8166667+00:00

Hi Aleksey
We haven't heard back from you. If you have any questions or need further assistance, feel free to reply and we’ll be happy to continue the conversation.
Aleksey 25 Reputation points

2025-07-19T15:45:59.2733333+00:00

Hi! Thanks for the instructions!

But after that I disabled it - nothing changed(

I.e. after setting the 'Public read access for blob only' Access level for an Azure Container, it reverts back to 'No public access' after a short period.
Rahul Jorrigala 3,655 Reputation points Microsoft External Staff Moderator

2025-07-22T01:25:22.88+00:00

Hello @Aleksey

I have reached out to you in a private message.

Thankyou
Vinod Pittala 6,130 Reputation points Microsoft External Staff Moderator

2025-07-23T09:59:33.1566667+00:00

Hello @Aleksey

I have reached out to you in a private message. please respond there.

Thanks
Naveena Patlolla 4,805 Reputation points Microsoft External Staff Moderator

2025-07-24T18:01:06.8866667+00:00

Hi Aleksey

The Azure policy you are referring to is incorrect. Please check the effect type—it is set to Audit, which means it will only Audit and will not take any action such as Revert or Disable.

Please navigate to Remediation in the right side you will see Remediation task check the Policy related to Storage and Disable it.

And make sure in Storage account Allow Blob Anonymous access is Enabled. Reference below

If the comment was helpful, please click "Upvote"
Naveena Patlolla 4,805 Reputation points Microsoft External Staff Moderator

2025-07-25T21:33:59.64+00:00

Hi Aleksey
Just checking in — have you had a chance to review the latest comment?
Rahul Jorrigala 3,655 Reputation points Microsoft External Staff Moderator

2025-07-28T00:47:16.4666667+00:00

Hi Aleksey

Just want to check if the above comment provided by @Naveena Patlolla worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it"

Thankyou

Share via

How to disable the Azure policy 'Storage account public access should be disallowed'?

1 answer

Your answer