Storage accounts should prevent anonymous public read access

What does the recommendation "Storage accounts should prevent anonymous public read access" check?

Flags any storage account where 'Allow Blob anonymous access' is enabled, which means a container or blob can be set to public read so anyone on the internet can list or download objects without credentials. It checks whether the option is possible at the account level, not whether a container is currently public.

Why does "Storage accounts should prevent anonymous public read access" matter?

Anonymous-readable containers sit behind a large share of cloud data leaks: backups, exports and personal data one unauthenticated GET away. Attackers scan for them continuously and discovery is usually automated within minutes of exposure. Disabling anonymous access at the account level removes the option entirely, so a single misconfigured container can no longer be made public by accident.

How do I fix "Storage accounts should prevent anonymous public read access"?

1. Set 'allowBlobPublicAccess' to false on the storage account to block anonymous access account-wide.
2. For content that must be public, front it with Azure Front Door or Azure CDN over a private origin rather than exposing the container directly.
3. Default new storage accounts to anonymous-access-disabled in your Bicep or Terraform modules so the safe setting is the one nobody has to remember.

# Close the highest-impact storage exposure first: anonymous read AND plain HTTP.
for acct in $(az storage account list \
    --query "[?allowBlobPublicAccess].name" -o tsv); do
  az storage account update --name "$acct" \
    --allow-blob-public-access false \
    --https-only true \
    --min-tls-version TLS1_2
  echo "$acct: anonymous access disabled, secure transfer required, min TLS 1.2"
done

# Ratchet it shut: deny any future account that allows anonymous access.
az policy assignment create \
  --name deny-anon-blob \
  --policy 13e6c4f1-e83f-4b50-a677-2cf6e2b9c885 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"