services / Azure / Storage Blob Service Containers

A blob container is a namespace within an Azure Storage account's blob service that groups and holds blobs, similar to a directory. Containers also carry their own metadata, stored access policies, and immutability/legal-hold protections.

Container-level operations affect every blob grouped under the container at once and control the access-policy and immutability settings that govern them; scope matches the underlying blobs.yml rating for consistency.

Microsoft.​Storage/​storageAccounts/​blobServices/​containers/​setLegalHold/​action

Sets a legal hold on the container, blocking deletion of its blobs until cleared. The opposite of clearLegalHold; an attacker's use is limited to nuisance denial of legitimate data lifecycle/deletion operations rather than direct data loss or exposure.

Risks

1. Data manipulation (HIGH)

Scope: LOW

This privilege allows access to data that are not meant to be public, but are otherwise not sensitive.

Links