Deny assignment for data plane actions

AssafL 1 Reputation point
2024-03-03T13:55:16.23+00:00

Can deny assignments be defined to block data plane actions (prevent deletion of blobs inside a storage account for example)?

I know that Blueprints or Azure policy can provide some level of denial to delete actions it doesn't look like it covers data plane actions

Azure Blueprints
Azure Blueprints
An Azure service that provides templates for quick, repeatable creation of fully governed cloud subscriptions.
72 questions
Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
917 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Stanislav Zhelyazkov 24,686 Reputation points MVP
    2024-03-04T09:47:50.2133333+00:00

    Hi,

    DenyAssignments is old concept that as we can see is replaced by denyAction. Unfortunately none of them support deny deletion of blob. May be you can check Azure ABAC for giving the correct access depending on attributes and preventing giving delete permissions on blobs that you do not want to.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.