Restrict Access to Containers and Blobs
By default, a container and any blobs within it may be accessed only by the owner of the storage account. If you want to give anonymous users read permissions to a container and its blobs, you can set the container permissions to allow public access. Anonymous users can read blobs within a publicly accessible container without authenticating the request.
Containers provide the following options for managing container access:
-
Full public read access: Container and blob data can be read via anonymous request. Clients can enumerate blobs within the container via anonymous request, but cannot enumerate containers within the storage account.
-
Public read access for blobs only: Blob data within this container can be read via anonymous request, but container data is not available. Clients cannot enumerate blobs within the container via anonymous request.
-
No public read access: Container and blob data can be read by the account owner only.
 Note |
|---|
| If your service requires that you exercise more granular control over blob resources, or if you wish to provide permissions for operations other than read operations, you can use a Shared Access Signature to make a resource accessible to users. See Create a Shared Access Signature for more information. |
Features Available to Anonymous Users
The following table shows which operations may be called by anonymous users when a container's ACL is set to allow public access.
| REST Operation | .NET method | Permission with full public read access | Permission with public read access for blobs only |
|---|---|---|---|
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
All |
Owner only |
||
|
All |
Owner only |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
All |
Owner only |
||
|
Create method of CloudPageBlob or CloudBlockBlob |
Owner only |
Owner only |
|
|
DownloadByteArray and others |
All |
All |
|
|
All |
All |
||
|
Owner only |
Owner only |
||
|
All |
All |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
Get Block List (REST API) (committed blocks only) |
All |
All |
|
|
Get Block List (REST API) (uncommitted blocks only or all blocks) |
Owner only |
Owner only |
|
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
Owner only |
Owner only |
||
|
All |
All |
Features by REST API Version
If a container is made public using the 2009-09-19 version of Set Container ACL (REST API), then all anonymous read access to the container and its resources will use the 2009-09-19 read operations if a default version has not been set. You can set the default version for requests to the Blob service by using the Set Blob Service Properties (REST API) operation. If a container was made public using a version of Set Container ACL prior to 2009-09-19, then all anonymous read access to the container and its resources will use the use the pre-release default read operations.
See Also
