A lock-photo container was set to Blob anonymous read so a website could load images, and the storage account still allows public access. What should the security engineer do first for access control?

When a lock-photo container was set to Blob anonymous read and the storage account still allows public access, the first access-control move is to disable allow blob anonymous access at the storage account and serve images with Entra RBAC or a short-lived SAS instead of anonymous read. Account-level denial of anonymous blob access prevents public reads even if a container setting would otherwise permit them. For municipal websites that previously hot-linked anonymous blobs, authenticated delivery closes the unlocked display case on the pier.

Leaving account public access enabled and only flipping the one container to private while other containers may still be exposed anonymously fails by concept: the account still permits anonymous patterns elsewhere, so the estate remains incompletely locked down. Moving the container to a CDN profile and keeping anonymous blob public access enabled as required for any website fails because CDN does not require anonymous origin access; signed URLs or authenticated origins are viable. Switching the container to Container-level anonymous listing so search engines can inventory every lock photo fails by widening anonymous discovery rather than hardening access control.

Exam caveat: disable allow blob anonymous access at the account; then use Entra data-plane RBAC or short-lived SAS for web delivery—CDN is orthogonal and not a reason to keep public blob access on. Operational check: set allowBlobPublicAccess to false on the account, set containers to private, update the website to Entra-authenticated or SAS-backed URLs, verify anonymous GETs return authorization failures, and record the change for canal communications staff.