services / Azure / Storage Blob Service Containers

A blob container is a namespace within an Azure Storage account's blob service that groups and holds blobs, similar to a directory. Containers also carry their own metadata, stored access policies, and immutability/legal-hold protections.

Container-level operations affect every blob grouped under the container at once and control the access-policy and immutability settings that govern them; scope matches the underlying blobs.yml rating for consistency.

Microsoft.​Storage/​storageAccounts/​blobServices/​containers/​lease/​action

Acquires, renews, releases, or breaks a lease (lock) on the container. An attacker can acquire and continually renew an exclusive lease to block other writers/deleters from modifying or removing the container's blobs, or can break a lease an application depends on for coordination, disrupting normal operations.

Risks

1. Denial-of-service (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links