What this query does
This Azure Resource Graph health query evaluates storage account transport, exposure, and recovery settings in one result set. It highlights accounts where minimum TLS is below the expected baseline, blob public access is allowed, or blob and file soft delete protections are missing.
What This Query Detects
- Storage accounts configured with a minimum TLS version below 1.2.
- Storage accounts that allow blob public access.
- Blob services without soft delete protection.
- File services without soft delete protection.
Why It Matters
Storage accounts frequently sit on real data exposure and recovery paths. Legacy TLS weakens transport security, public blob access increases accidental exposure risk, and missing soft delete reduces the ability to recover from destructive changes or operator error.
Example Output Fields
Field availability reflects the health query contract and the resource properties available to Azure Resource Graph.
| Field | How to use it |
|---|---|
subscriptionId | Azure subscription that owns the storage account. |
resourceGroup | Resource group containing the storage account. |
storageAccountName | Storage account name. |
location | Azure region in which the account is deployed. |
minimumTlsVersion | Minimum TLS version accepted by the storage account. |
allowBlobPublicAccess | Whether containers may be configured for anonymous blob access. |
blobSoftDeleteEnabled | Whether blob soft delete is enabled. |
fileSoftDeleteEnabled | Whether Azure Files soft delete is enabled. |
publicNetworkAccess | Current public network access setting. |
riskReason | Normalized explanation of the configuration risk detected for the row. |
How To Read The Results
Read riskReason as the direct remediation signal. TLS below 1.2 indicates a transport baseline gap. Blob public access enabled indicates exposure potential, even if no container is currently anonymous. Blob soft delete disabled and File share soft delete disabled indicate weaker recovery protection. One storage account may produce or represent more than one reason, so group by account before assigning remediation ownership.
riskReason reference
TLS below 1.2- The account accepts a legacy minimum TLS version and should be reviewed for TLS 1.2 enforcement.
Blob public access enabled- The account permits containers to enable anonymous access, creating a potential data exposure path.
Blob soft delete disabled- Deleted blobs have reduced recovery protection against mistakes or destructive activity.
File share soft delete disabled- Deleted file shares have reduced recovery protection.
What You Gain On A Dashboard
Dashboard outcomes
- A consolidated view of storage hardening gaps.
- A direct signal for potential data exposure risk.
- A recoverability signal for blob and file workloads.
Best for dashboards focused on
- Storage hardening
- Data exposure risk
- Recovery controls
- Security baseline compliance
See your storage risks in one live dashboard
Connect your Azure environment to VYRE Cloud and turn scattered configuration gaps into a focused view of exposure, protection, and recovery priorities.
Your environment. Your priorities. One dashboard built around the signals that matter.
- Exposure signals
- Protection gaps
- Remediation priorities
Recommended Use Cases
- Storage security baseline reviews across landing zones.
- Prioritizing public access and TLS remediation.
- Tracking soft delete adoption for data recovery controls.
- Preparing focused evidence for cloud security reviews.