Azure Storage security starts with boring checks

Storage accounts drift over time. The most common issues come from settings left at their original values.

Public network access sits at the top of the list. Check each account and limit it to selected networks or disable it entirely when only private endpoints should reach the data.

Anonymous blob access comes next. Verify the setting matches the documented requirement rather than the default. Most storage accounts should never allow unauthenticated reads.

SAS token expiry dates slip out of view quickly. Store the date in the owner metadata field so it appears during ordinary listing commands and does not require a separate lookup.

Private endpoint changes alter the network boundary. Update the last reviewed tag immediately afterward. Without the updated timestamp, later reviews use an incorrect baseline.

Identity assignments also require comparison against the runbook. List the current roles, match them to the documented steps, and remove any extras that no longer belong.

These five checks take minutes per account. Running through them on a fixed schedule keeps the exposure surface from expanding through small oversights.