services / Azure / Storage Blob Service Containers

A blob container is a namespace within an Azure Storage account's blob service that groups and holds blobs, similar to a directory. Containers also carry their own metadata, stored access policies, and immutability/legal-hold protections.

Container-level operations affect every blob grouped under the container at once and control the access-policy and immutability settings that govern them; scope matches the underlying blobs.yml rating for consistency.

Microsoft.​Storage/​storageAccounts/​blobServices/​containers/​delete

Deleting a container destroys every blob it holds in a single operation, so the potential blast radius is larger than deleting an individual blob and can encompass an arbitrarily large dataset.

Risks

1. Data destruction (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links