Give Access to storage account in azure

Question

I am new to azure and trying to learn azure storage. Suppose I have created a storage acoount and stored few documents, and want everyone to access mt document. If I give my URL, everyone can access it but I want few users to access my storage account and can also upload documents they want.

Please refer me how to achive this and if possible please refer and link which will be usefull for me. Thanks in Advance.

Answer 1

There are a couple of ways you can do this:

Generate and distribute SAS tokens with read/write privileges. This will give a Url which expires at a given point in time. You can do all this through the portal, through code, or by using context menus within Azure Storage Explorer. Here is a sample of how to do it with code.

You can also assign the AAD users to a role which has permission to manipulate resources in the storage account. Here is a list of current roles so you can select the proper one based on your use case. There are preview roles which don't appear to be working.

EDIT: MS just announced the preview of AAD support down to the scope of a container or queue. This is likely the granularity you were looking for.

EDIT 2 : Full RBAC support for storage is now available

Answer 2

You can generate SAS token This way you can grant access to others without sharing the account keys.

You can create SAS token on specific Service( Blob, Queue, File ) or an Account SAS which allows you to grant permission to multiple services within storage account.( Queue and Table for eg. )

SAS tokens give you granular control over types of access including:

• The interval over which the SAS is valid, including the start time and the expiry time.
• The permissions granted by the SAS. For example, a SAS for a blob might grant read and write permissions to that blob, but not delete permissions.
• An optional IP address or range of IP addresses from which Azure Storage will accept the SAS. For example, you might specify a range of IP addresses belonging to your organization.
• The protocol over which Azure Storage will accept the SAS. You can use this optional parameter to restrict access to clients using HTTPS.

Answer 3

Azure Storage offers these options for authorizing access to secure resources:

• Azure Active Directory (Azure AD) integration (Preview) for blobs and queues. The Azure AD provides role-based access control (RBAC) for fine-grained control over a client's access to resources in a storage account. For more information, see Authenticating requests to Azure Storage using Azure Active Directory (Preview).

• Shared Key authorization for blobs, files, queues, and tables. A client using Shared Key passes a header with every request that is signed using the storage account access key. For more information, see Authorize with Shared Key.

• Shared access signatures for blobs, files, queues, and tables. Shared access signatures (SAS) provide limited delegated access to resources in a storage account. Adding constraints on the time interval for which the signature is valid or on permissions it grants provides flexibility in managing access. For more information, see Using shared access signatures (SAS).

• Anonymous public read access for containers and blobs. Authorization is not required. For more information, see Manage anonymous read access to containers and blobs.

  By default, all resources in Azure Storage are secured and are available only to the account owner. Although you can use any of the authorization strategies outlined above to grant clients access to resources in your storage account, Microsoft recommends using Azure AD when possible for maximum security and ease of use.