Choose how to authorize access to blob data in the Azure portal

When you access blob data by using the Azure portal, the portal makes requests to Azure Storage on your behalf. You can authorize a request to Azure Storage by using either your Microsoft Entra account or the storage account access key. The portal shows which method you're using, and if you have the right permissions, you can switch between the two methods.

Permissions needed to access blob data

You need specific permissions depending on how you want to authorize access to blob data in the Azure portal. In most cases, Azure RBAC provides these permissions. For more information about Azure RBAC, see What is Azure role-based access control (Azure RBAC)?

Use the account access key

To access blob data by using the account access key, you must have an Azure role assigned to you that includes the Azure RBAC action Microsoft.Storage/storageAccounts/listkeys/action. This Azure role can be a built-in role or a custom role.

The following built-in roles, listed from least to greatest permissions, support Microsoft.Storage/storageAccounts/listkeys/action:

• Reader and Data Access
• Storage Account Contributor
• Azure Resource Manager Contributor
• Azure Resource Manager Owner

When you attempt to access blob data in the Azure portal, the portal first checks whether you're assigned a role with Microsoft.Storage/storageAccounts/listkeys/action. If you have a role with this action, the portal uses the account key to access blob data. If you don't have a role with this action, the portal tries to access data by using your Microsoft Entra account.

Use your Microsoft Entra account

To access blob data from the Azure portal by using your Microsoft Entra account, both of the following statements must be true for you:

• You're assigned either a built-in or custom role that provides access to blob data. Built-in data-access roles include Storage Blob Data Reader, Storage Blob Data Contributor, and Storage Blob Data Owner.
• You're assigned the Azure Resource Manager Reader role, at a minimum, scoped to the level of the storage account or higher. The Reader role grants the most restricted permissions, but another Azure Resource Manager role that grants access to storage account management resources is also acceptable.

The Azure Resource Manager Reader role is a management-plane role that lets you view storage account resources, but not modify them. It only grants access to account management resources, not to data in Azure Storage. The Reader role is necessary so that you can navigate to blob containers in the Azure portal, but on its own it doesn't authorize access to blob data. To read or write blob data, you also need a data-plane role such as Storage Blob Data Reader or Storage Blob Data Contributor.

For information about the built-in roles that support access to blob data, see Authorize access to blobs using Microsoft Entra ID.

Custom roles can support different combinations of the same permissions provided by the built-in roles. For more information about creating Azure custom roles, see Azure custom roles and Understand role definitions for Azure resources.

Navigate to blobs in the Azure portal

To view blob data in the portal, use either of the following paths:

• On the storage account Overview page, select the Blobs tile in the Properties tab.
• In the storage account's left menu, expand Data storage, and then select Containers.

Determine the current authentication method

When you navigate to a container, the Azure portal indicates whether you're currently using the account access key or your Microsoft Entra account to authenticate.

Authenticate with the account access key

If you authenticate by using the account access key, you see Access Key specified as the authentication method in the portal:

To switch to the Microsoft Entra account, select the link highlighted in the preceding image. If your assigned Azure roles grant the appropriate permissions, you can proceed. If you don't have the right permissions, you see an error message and no blobs appear in the list.

Select the Switch to access key link to use the access key for authentication again.

Authenticate with your Microsoft Entra account

If you authenticate by using your Microsoft Entra account, you see Microsoft Entra user Account specified as the authentication method in the portal:

To switch to the account access key, select the link highlighted in the preceding image. If you have access to the account key, you can proceed. If you don't have access to the account key, you see an error message and no blobs appear in the list.

Select the Switch to Microsoft Entra user account link to use your Microsoft Entra account for authentication again.

Default to Microsoft Entra authorization in the Azure portal

When you create a new storage account, you can specify that the Azure portal defaults to authorization with Microsoft Entra ID when a user navigates to blob data. You can also configure this setting for an existing storage account. This setting specifies the default authorization method only, so a user can override this setting and choose to authorize data access with the account key.

To make the portal use Microsoft Entra authorization by default when you create a storage account, follow these steps:

1. Create a new storage account, following the instructions in Create a storage account.

2. On the Advanced tab, in the Security section, check the box next to Default to Microsoft Entra authorization in the Azure portal.

   

3. Select the Review + create button to run validation and create the account.

To update this setting for an existing storage account, follow these steps:

1. Navigate to the account overview in the Azure portal.

2. Under Settings, select Configuration.

3. Set Default to Microsoft Entra authorization in the Azure portal to Enabled.

   

The defaultToOAuthAuthentication property of a storage account isn't set by default and doesn't return a value until you explicitly set it.

Next steps

• Authorize access to data in Azure Storage
• Assign an Azure role for access to blob data