Azure APRL and Custom Controls

Storage Accounts should have anonymous blob public access disabled so that blobs cannot be read by unauthenticated users, preventing accidental data exposure from misconfigured container permissions. This is a local custom check, not an automated APRL-mapped check or a universal Well-Architected Framework requirement; apply it according to your organization's baseline and workload requirements.

Remediation action:

1. In the Azure portal, navigate to the Storage Account.
2. Select Configuration in the left menu.
3. Under Blob public access, select Disabled.
4. Click Save.
5. If any containers previously relied on anonymous access for legitimate scenarios, replace them with Shared Access Signatures (SAS) or Azure AD-based access.

Using Azure CLI: az storage account update --name <account> --resource-group <rg> --allow-blob-public-access false

Related links

• Configure anonymous read access for containers and blobs

%TestResult%