Blob containers and access levels in Azure - Step-by-Step Execution

Process Flow - Blob containers and access levels

Create Blob Container

↓

Set Access Level

↓

Access Level Options

First, create a blob container. Then choose an access level: Private (no public access), Blob public (public read for blobs only), or Container public (public read for blobs and container listing).

Execution Sample

Azure

az storage container create --name mycontainer --account-name mystorage
az storage container set-permission --name mycontainer --account-name mystorage --public-access blob

Creates a blob container named 'mycontainer' and sets its access level to allow public read access to blobs only.

Process Table

Step	Command	Action	Access Level Set	Result
1	az storage container create --name mycontainer --account-name mystorage	Create container 'mycontainer'	Private (default)	Container created with private access
2	az storage container set-permission --name mycontainer --account-name mystorage --public-access blob	Set access level to Blob public	Blob public	Blobs readable publicly, container listing not allowed
3	Access container blobs anonymously	Try to read blob	Blob public	Success: Blob data accessible
4	Access container listing anonymously	Try to list blobs	Blob public	Fail: Listing denied
5	az storage container set-permission --name mycontainer --account-name mystorage --public-access container	Set access level to Container public	Container public	Blobs and container listing readable publicly
6	Access container listing anonymously	Try to list blobs	Container public	Success: Blob list accessible
7	az storage container set-permission --name mycontainer --account-name mystorage --public-access off	Set access level to Private	Private	No public access to blobs or listing
8	Access blob anonymously	Try to read blob	Private	Fail: Access denied

💡 Access level set to Private, no public access allowed, ending demonstration.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 5	After Step 7
Access Level	N/A	Private (default)	Blob public	Container public	Private

Key Moments - 3 Insights

Why can I read blobs but not list them after setting access to Blob public?

Because Blob public access allows anonymous read of blobs only, but container listing is still restricted. See execution_table rows 3 and 4.

What changes when I set access to Container public?

Both blob data and container listing become publicly accessible. See execution_table rows 5 and 6.

What happens if I set access to Private after public access?

All anonymous access is blocked, including reading blobs and listing. See execution_table rows 7 and 8.

Visual Quiz - 3 Questions

Look at the execution_table, what is the access level after Step 2?

A Private

B Container public

C Blob public

D Off

💡 Hint

Check the 'Access Level Set' column in row for Step 2.

At which step does anonymous listing of blobs become possible?

A Step 3

B Step 5

C Step 4

D Step 7

💡 Hint

Look for when 'Access container listing anonymously' succeeds in the 'Result' column.

If you set access level to Private, what happens when trying to read blobs anonymously?

A Access denied

B Access allowed

C Only container listing allowed

D Only blob read allowed

💡 Hint

See Step 8 in execution_table for anonymous blob read result.

Concept Snapshot

Blob containers hold blobs (files) in Azure Storage.
Access levels control public visibility:
- Private: no public access
- Blob public: public read of blobs only
- Container public: public read of blobs and container listing
Set access with Azure CLI or portal.
Choose level based on security needs.

Full Transcript

This visual execution shows how to create an Azure blob container and set its access level. First, the container is created with private access by default. Then, the access level is changed to Blob public, allowing anonymous users to read blobs but not list them. Next, setting access to Container public allows anonymous users to list blobs as well. Finally, setting access back to Private blocks all anonymous access. The execution table traces each step, showing commands, actions, access levels, and results. Variable tracking shows how the access level changes over time. Key moments clarify common confusions about what each access level permits. The quiz tests understanding of access level effects and anonymous access behavior.

Practice

1. What does setting a blob container's access level to private mean?

easy

A. Anyone can read blobs but cannot list them.

B. Anyone can read and list blobs in the container.

C. Only the owner can read or list blobs in the container.

D. The container is deleted automatically after 24 hours.

Solution

1. Step 1: Understand the meaning of private access level

   Private means no public access; only authorized users can access blobs.

2. Step 2: Compare with other access levels

   Unlike blob or container levels, private restricts all public read or list operations.

3. Final Answer:

   Only the owner can read or list blobs in the container. -> Option C

4. Quick Check:

   Private access = owner-only access [OK]

Hint: Private means no public read or list access [OK]

Common Mistakes:

• Confusing private with blob-level public read
• Thinking private allows public listing
• Assuming private deletes container automatically

2. Which of the following is the correct way to set a blob container's access level to allow public read of blobs but not listing containers using Azure CLI?

easy

A. az storage container set-permission --name mycontainer --public-access container

B. az storage container set-permission --name mycontainer --public-access blob

C. az storage container set-permission --name mycontainer --public-access private

D. az storage container set-permission --name mycontainer --public-access none

Solution

1. Step 1: Identify the access level for public read of blobs only

   The blob access level allows public read of blobs but not container listing.

2. Step 2: Match the Azure CLI command syntax

   The command uses --public-access blob to set this level correctly.

3. Final Answer:

   az storage container set-permission --name mycontainer --public-access blob -> Option B

4. Quick Check:

   Blob access = public read blobs only [OK]

Hint: Use '--public-access blob' for public blob read only [OK]

Common Mistakes:

• Using 'container' instead of 'blob' for public read
• Using 'private' which disables public access
• Using 'none' which is invalid in Azure CLI

3. Given a container with access level set to container, what will happen if an anonymous user tries to list blobs in the container?

medium

A. The user can list blobs and read blob content anonymously.

B. The container will block all anonymous requests.

C. The user can read blobs but cannot list them.

D. The user will receive an error because listing is not allowed.

Solution

1. Step 1: Understand the container access level

   This level allows anonymous users to list blobs and read blob content.

2. Step 2: Analyze anonymous user permissions

   Anonymous users can list blobs and read blobs but cannot modify or delete.

3. Final Answer:

   The user can list blobs and read blob content anonymously. -> Option A

4. Quick Check:

   Container access = public list and read [OK]

Hint: Container access allows public list and read [OK]

Common Mistakes:

• Confusing container with blob access level
• Assuming anonymous users cannot list blobs
• Thinking container blocks anonymous requests

4. You set a blob container's access level to blob but anonymous users report they cannot list blobs. What is the most likely cause?

medium

A. The storage account is disabled.

B. The container name is incorrect in the URL.

C. The blobs are encrypted and cannot be read.

D. Blob access level does not allow listing blobs publicly.

Solution

1. Step 1: Recall what blob access level permits

   Blob access allows anonymous read of blobs but not listing blobs in the container.

2. Step 2: Evaluate other options for likelihood

   Incorrect container name or disabled account would cause different errors; encryption does not block listing.

3. Final Answer:

   Blob access level does not allow listing blobs publicly. -> Option D

4. Quick Check:

   Blob access = no public listing [OK]

Hint: Blob access disables public listing, only allows read [OK]

Common Mistakes:

• Expecting blob access to allow listing
• Blaming encryption for listing issues
• Ignoring container name correctness

5. You want to share some files publicly but prevent users from listing all files in your Azure blob container. Which access level should you choose and why?

hard

A. Set access level to blob to allow public read of blobs but block listing.

B. Set access level to private to block all public access.

C. Set access level to container to allow public read and listing.

D. Set access level to public to allow full access.

Solution

1. Step 1: Identify the requirement for public read without listing

   You want users to read files but not see all file names.

2. Step 2: Match access level to requirement

   blob access allows public read of blobs but prevents listing container contents.

3. Step 3: Exclude other options

   private blocks public read; container allows listing; public is not a valid access level.

4. Final Answer:

   Set access level to blob to allow public read of blobs but block listing. -> Option A

5. Quick Check:

   Blob access = public read, no listing [OK]

Hint: Use blob access to share files without listing [OK]

Common Mistakes:

• Choosing container access which allows listing
• Using private which blocks public read
• Thinking 'public' is a valid access level