---
title: Publicly accessible Azure Storage blob container is a crown jewel
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Publicly accessible Azure Storage blob
  container is a crown jewel
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Publicly accessible Azure Storage blob container is a crown jewel

## Description{% #description %}

An Azure Storage blob container that holds crown-jewel data is publicly accessible. Crown-jewel resources contain your organization's most sensitive or business-critical data, and a public-access configuration on the container or its parent storage account allows that data to be read without authentication from any network location.

An attacker can enumerate and exfiltrate blobs directly after discovering the container endpoint, without first compromising an identity or pivoting through the network. The combination of public exposure and crown-jewel classification makes this a high-value, low-effort target and a direct path to data compromise.

## Remediation{% #remediation %}

1. Set the container's anonymous access level to **Private (no anonymous access)**. See [Configure anonymous read access for containers and blobs](https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure?tabs=portal).
1. Disallow anonymous access on the parent storage account so that no container in the account can accept anonymous requests. See [Remediate anonymous read access to blob data](https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent?tabs=portal#remediate-anonymous-public-access-for-the-storage-account).