Deny assignment for data plane actions

AssafL 1 Reputation point
2024-03-03T13:55:16.23+00:00

Can deny assignments be defined to block data plane actions (prevent deletion of blobs inside a storage account for example)?

I know that Blueprints or Azure policy can provide some level of denial to delete actions it doesn't look like it covers data plane actions

Azure Blueprints
Azure Blueprints
An Azure service that provides templates for quick, repeatable creation of fully governed cloud subscriptions.
70 questions
Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
793 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Stanislav Zhelyazkov 21,181 Reputation points MVP
    2024-03-04T09:47:50.2133333+00:00

    Hi,

    DenyAssignments is old concept that as we can see is replaced by denyAction. Unfortunately none of them support deny deletion of blob. May be you can check Azure ABAC for giving the correct access depending on attributes and preventing giving delete permissions on blobs that you do not want to.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments