Azure Defender: Unusual unauthenticated access to your storage account

Had a brief head scratching moment today with an Azure Defender alert.

A production storage account with a $web container that's apparently been accessed anonymously without SAS token or other authentication. Initially not an ideal situation with a prod resource....

Checking public access level

First port of call is to check the public access level for the container. In this case, I was presented with access level "Private" for this container.

This will confuse analysts as it did me....

What is the $web container?

In a storage account you can store a static website, which can be enabled via "Static website" under "Data Management". As soon as you enable this the "$web" container is created which is used to host your web files. See below.

Understanding $web container access level

"You can modify the public access level of the $web container, but this has no impact on the primary static website endpoint because these files are served through anonymous access requests. That means public (read-only) access to all files."

Disabling public access on a storage account does not affect static websites that are hosted in that storage account.

The key to the question is here:

Essentially, if you "Disable public access to blobs" in a storage account it will not apply to a $web container, as it is assumed that web request (anonymous) activity will occur seeing as you/they are hosting a static website.

I hope that clears things up

Have a good day!

More about Azure Defender here:

Update 09/11/2021

Had an email from Microsoft - they've had issues their side for a week due to a patch for storage containers which has seen been reversed. This also may have caused these alerts to flag.

Para escoger equipaciones para equipos de fútbol, es práctico verificar las medidas indicadas y el tipo de ajuste. Las fotografías y la ficha del producto deberían confirmar el precio total, el plazo de entrega y las condiciones de devolución.