You migrate App1 to Azure. You need to ensure that the data storage for App1 meets the security and compliance requirement What should you do?

To meet fundamental security and compliance requirements for data in Azure Blob Storage, the most critical initial step is to control its accessibility. Modifying the access level of the blob container to 'Private (no anonymous access)' ensures that data is not publicly exposed on the internet. This setting mandates that every request to access the data must be authenticated and authorized, forming the baseline for a secure configuration. Most compliance frameworks require strict control over data exposure, making the prevention of anonymous access a primary objective.

A. An access policy is used to manage permissions for Shared Access Signatures (SAS), which is a method for delegated access, not the primary control against public access.

C. Azure resource locks prevent accidental deletion or modification of the Azure resource (e.g., the storage account), but they do not secure the data within it from unauthorized access.

D. Azure RBAC assignments are essential for granting permissions to authenticated identities, but they are bypassed for read requests if the container is configured for anonymous public access.

1. Microsoft Learn: Configure anonymous public read access for containers and blobs. In the "Set the public access level for a container" section

the documentation states

"To grant anonymous users read access to a container and its blobs

first set the container's public access level... For optimal security

Microsoft recommends that you disallow public access to your storage account." This highlights that managing the access level is the direct control for public/anonymous access.

2. Microsoft Learn: Security recommendations for Blob storage. Under the "Data protection" section

a key recommendation is to "Prevent anonymous public read access to containers and blobs." This directly supports modifying the access level as a primary security action.

3. Microsoft Learn: Authorize access to data in Azure Storage. The "Overview" section explains the different authorization mechanisms. It implicitly supports that if anonymous access is enabled

it can bypass other authorization schemes like Azure AD (RBAC) for public read requests

making the access level setting a foundational security control.