#Blobattribute readwrite how to

This is just one scenario showcasing Azure ABAC conditions using blob index tags.

Pretty cool! This means I can have thousands of blobs within one or more Storage Accounts, and by granting exactly one RBAC role assignment with ABAC conditions I can control which blobs users can access based on a value tagged in their Custom Security Attributes. When the user tries to click and read the other two blobs it will result in a No Access error: However, the user should only be able to click and read the contents of the blob that has the same Blob index tag value as the user’s Custom Security Attribute value, as the Storage Blob Data Reader role assignment with ABAC conditions is only valid for blobs where the index tag matches. The user should now see the 3 blobs that were uploaded.

Make sure that Authentication method is set to Azure AD User Account. Go to the Storage Account, then Containers blade and click on the container.Log in to the Azure Portal as the test user that was given the Customer Security Attribute earlier.Now it’s time to log in to the Azure Portal with the test user to verify that ABAC conditions actually works. Then upload the two other files - but this time set no value or some other Blob index tag value, meaning that the user should not be able to read these blobs. Note: The key value is the same key as configured in the ABAC conditions (step 5), while value is the same value as set in the Custom Security Attribute on the user. Create a new private container, then open it.Ĭlick Upload, select the first file and click Advanced - make sure to add the correct Blob index tag key and value.Go to the Storage Account created earlier in the Azure Portal, visit the Containers blade.I have prepared 3 text files with random content on my local machine. In order to test the configuration I first need to upload some blobs with index tags in a container within the Storage Account.

#Blobattribute readwrite how to

matching name on containers within the Storage Account - visit Microsoft Docs for more examples on how to configure ABAC. There are other ways to configure ABAC, e.g. I have now configured an Azure RBAC role assignment with ABAC conditions for Storage Blob index tags. AND StringEquals Click Review + assign to save the new role assignment with conditions. Make a POST request to endpoint /directory/attributeSets (beta) with the properties id (Attribute Set name), description and maxAttributesPerSet in the body: Go to Graph Explorer and sign in to the tenant.

Always test new stuff in a demo tenant!įirst I create a new Attribute Set named ProjectData by using Graph Explorer, see my blogpost on how to get started. Note: Once you create an Attribute Set, it cannot be deleted from the tenant nor have its Attribute Set name changed. See my blogpost for details on how to create such attributes, what permissions are needed to do such operations etc. We will need a Custom Security Attribute in the tenant for this purpose. So, let’s try out this public preview feature! Configure Custom Security Attribute Now you can grant users access to Azure Blob Storage with Attribute-based Access Control (ABAC) utilizing Custom Security Attributes instead of just through Role-Based Access Control (RBAC), which means fine-grained access control with fewer Azure role assignments. In the Introducing Azure AD custom security attributes article posted in the Azure Active Directory blog on December 1, 2021, Microsoft explains that Custom Security Attributes builds on the ABAC public preview.

ABAC brings a new flavor to access control management of Azure resources, and even though only Azure Blob Storage is supported right now ABAC will likely be introduced to a lot of other Azure resources in the future - to solve access scenarios that are complicated or hard to manage with regular Azure RBAC (short for Role-based Access Control). This is a new feature introduced by Microsoft for Azure Blob Storage and is in public preview. Configure Azure Storage blob access with ABAC conditionsĪzure ABAC is short for Attribute-based Access Control.Now I will dive further into this topic and describe how to get a working configuration with ABAC conditions using Custom Security Attributes for Azure Blobs Storage. Last week I published a blog post describing the basics of Custom Security Attributes, and how it can be utilized paired with ABAC.