Private Blob URL access

Question

Private Blob URL access

Wajih ARFAOUI 0

Hello,

I would like to know which is the best approach to be able to share urls of files stored in my blob storage that can be just accessible by an authorised group of people.

I am using copilot for creating a custom chatbot, this chatbot when answering questions will provide the urls of files he used for creating the answer and by clicking on the urls in the browser i want just authorised people to be able to see the content of that file otherwise it shows an error !

I appreciate your help

Vinod Kumar Reddy Chilupuri 3,035 Reputation points Microsoft External Staff

2025-03-12T16:29:08.8633333+00:00
Hi Wajih ARFAOUI,

To share URLs of files stored in your Azure Blob Storage that are accessible only by an authorized group of people, the best approach is to use Shared Access Signatures (SAS). A SAS allows you to grant limited access to your storage resources for a specified period of time and with specific permissions

Create a SAS token, you can specify the permissions (like read, write, etc.) and set an expiration time. This way, only those with the SAS token can access the files.

Implement Azure RBAC to control access to your blob storage. With RBAC, you can assign permissions to specific users or groups, ensuring that only authorized individuals can access the resources. Azure role-based access control (Azure RBAC).

Secure Your Storage Account: Make sure to disallow shared key authorization and use Microsoft Entra ID for authentication. This enhances security by avoiding the need to share storage account keys.

The easiest and most secure way to access your Azure Storage resources is to sign in with your Azure account. Signing in uses Microsoft Entra authentication, which allows you to:

Give access to specific users and groups.

Revoke access to specific users and groups at any time.

Enforce access conditions, such as requiring multi-factor authentication.

Generate SAS tokens that are only valid for as long as necessary to reduce the risk of unauthorized access.

https://learn.microsoft.com/en-us/azure/storage/common/storage-explorer-security#microsoft-entra-authentication
https://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-storage#use-a-shared-access-signature-instead-of-a-storage-account-key

Hope the above suggestion helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Private Blob URL access

Your answer