Maintained with ☕️ by
IcePanel logo

Generally Available: Entra ID and RBAC support for GetAccountInfo and other supplemental APIs for Azure Storage

Share

Services

To align with security best practices, Entra ID and RBAC support is now generally available for the following APIs for Azure Storage: * [Get Account Information](https://learn.microsoft.com/rest/api/storageservices/get-account-information?tabs=microsoft-entra-id#authorization) * [Get Container ACL](https://learn.microsoft.com/rest/api/storageservices/get-container-acl?tabs=microsoft-entra-id#authorization) * [Set Container ACL](https://learn.microsoft.com/rest/api/storageservices/set-container-acl?tabs=microsoft-entra-id#authorization) * [Get Queue ACL](https://learn.microsoft.com/rest/api/storageservices/get-queue-acl?tabs=microsoft-entra-id#authorization) * [Set Queue ACL](https://learn.microsoft.com/rest/api/storageservices/set-queue-acl?tabs=microsoft-entra-id#authorization) * [Get Table ACL](https://learn.microsoft.com/rest/api/storageservices/get-table-acl?tabs=microsoft-entra-id#authorization) * [Set Table ACL](https://learn.microsoft.com/rest/api/storageservices/set-table-acl?tabs=microsoft-entra-id#authorization) To learn more, refer to [Authorize with Microsoft Entra ID (REST API) - Azure Storage | Microsoft Learn.](https://learn.microsoft.com/rest/api/storageservices/authorize-with-azure-active-directory#permissions-for-blob-service-operations) These APIs now support OAuth 2.0 based Authentication via Entra ID on storage. As part of this enhancement the REST API responses for unauthorized access have been changed. Previously, if you tried to use these APIs with OAuth, we returned a 404 status code. Now, if you use these APIs with OAuth but do not have the right permissions (e.g. GetAccountInformation requires Azure RBAC action: Microsoft.Storage/storageAccounts/blobServices/getInfo/action), we will return a 403 status code (unauthorized access). If you send an anonymous request for [bearer challenge](https://learn.microsoft.com/rest/api/storageservices/authorize-with-azure-active-directory#bearer-challenge), we will return a 401 status code, which is the same behavior as with the other APIs. If you have taken a dependency on the 404 error code for these operations, we recommend that you change your application code to support both 404 and 403 error codes, since the SDKs will not automatically make this change. Note that the best practice for checking unsupported APIs is not to take a dependency on error codes, but to refer to [Authorize with Microsoft Entra ID (REST API) - Azure Storage | Microsoft Learn.](https://learn.microsoft.com/rest/api/storageservices/authorize-with-azure-active-directory)