A single toggle in Azure Storage decides whether your files sit behind proper access controls or whether anyone with the right link can browse them like a public library. Businesses rarely flip that toggle on purpose. It happens during a rushed migration, a quick fix for a broken integration, or a container created for testing that never gets locked back down. By the time anybody thinks to check, the container has often been sitting open for months, quietly indexed and forgotten.
Public containers are more common than most owners realise
Azure Blob Storage defaults to private, which sounds reassuring until you look at how often that default gets overridden. A developer struggling to get an app talking to storage will sometimes set the container to public rather than fix the authentication properly, intending to revert it later. Later rarely comes, because the fix worked, the deadline passed, and the task quietly slipped off everybody’s list. Search engines index these containers, security researchers scan for them constantly, and customer contracts, invoices, or scanned ID documents end up sitting in plain view for anyone who stumbles across the link.
This is precisely the blind spot that thorough Azure pen testing testing is designed to expose, because a tester will enumerate storage accounts and containers the same way an opportunistic attacker would, rather than trusting that the settings match what was intended when the account was first provisioned.
Access keys and SAS tokens carry their own risks
Even when containers are private, the credentials used to reach them can undo that protection. Storage account access keys grant broad control and rarely expire unless someone rotates them manually, which in practice means they often never do. Shared Access Signature tokens are meant to be safer, scoped and time-limited, but we regularly find them hard-coded into scripts, committed to repositories, or left with permissions and expiry dates so generous they might as well be permanent keys handed out to anyone who finds them.
William has seen how quickly this becomes a genuine incident rather than a theoretical risk.
“We found a SAS token embedded in a public GitHub repository that had been valid for over a year, pointing straight at a container full of customer export files. The client had no idea it existed until we showed them the download logs.”
— William Fieldhouse, Director of Aardwolf Security Ltd
That kind of exposure does not show up in a routine glance at the Azure portal. It takes someone deliberately hunting for leaked credentials and misconfigured access the way an attacker would, then tracing every place a token might have been pasted, shared, or forgotten across old repositories, chat logs, and half-finished internal documentation. The credential itself is rarely the hard part to find once you know where attackers actually look.
Treat storage settings as a recurring check, not a one-off
Storage configurations drift every time someone touches them, so a single audit gives you comfort for a matter of weeks, not years. Rotate keys on a schedule, favour short-lived SAS tokens over static ones, and review container permissions after every project rather than assuming they held. Build the habit of checking rather than trusting, because in cloud storage the two are rarely the same thing. If you want a clear, independent penetration testing quote covering your storage estate alongside the rest of your Azure environment, Aardwolf Security is a straightforward call away.
