services / Azure / Storage Blob Service Blobs

Blobs are the individual data objects (files) stored inside containers of an Azure Storage account's blob service. They hold an organization's unstructured production data such as documents, backups, media, and application data.

Data-plane access to blobs directly exposes stored organizational data; ADLS Gen2 (hierarchical namespace) accounts also expose POSIX ownership/ACLs at the blob level.

Microsoft.​Storage/​storageAccounts/​blobServices/​containers/​blobs/​permanentDelete/​action

Permanently deletes a blob, bypassing soft-delete retention. Soft-delete is the primary recovery control against accidental or malicious blob deletion; this operation defeats that control outright and destroys the data with no possibility of restoration, materially worse than the already-documented plain delete.

Risks

1. Data destruction (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links