services / Azure / Storage Blob Service Containers

A blob container is a namespace within an Azure Storage account's blob service that groups and holds blobs, similar to a directory. Containers also carry their own metadata, stored access policies, and immutability/legal-hold protections.

Container-level operations affect every blob grouped under the container at once and control the access-policy and immutability settings that govern them; scope matches the underlying blobs.yml rating for consistency.

Microsoft.​Storage/​storageAccounts/​blobServices/​containers/​clearLegalHold/​action

Clears a legal hold on the container. Legal holds are a compliance/incident-response immutability control that blocks deletion of blobs while active; removing the hold disables that protective control and clears the way for the container's data to subsequently be deleted or overwritten.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links