Azure Storage Exposure Calculator

Exposure index = public network access points + anonymous blob access points + Shared Key points + TLS floor points + min(15, public container ratio × 1.2) + SAS risk points, clamped to 0–100. The index adds the points carried by each control that decides whether a blob can be read from the internet. Shared Key authorisation is scored separately from network reachability because an account key is a permanent, non-revocable credential that bypasses Entra ID conditional access entirely, and a leaked key plus 'enabled from all networks' is a complete compromise of the account.

Azure storage accounts fail differently from S3: the usual leak path is not a public container but a SAS token with a one-year expiry signed by an account key that nobody can rotate without breaking production.

This calculator takes 9 inputs: Storage account public network access, Allow blob anonymous access, Shared Key (account key) authorisation, Minimum TLS version, Containers in the account, Containers with a public access level, Active SAS tokens, Longest SAS token lifetime, Data stored in the account. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because it cannot be scoped or revoked individually. An account key grants everything in the account, is not covered by conditional access or Entra ID logging, and rotating it invalidates every SAS token derived from it at once — which is exactly why teams put off rotation for years.

A SAS signed with an Entra ID credential rather than the account key. It inherits the signer's RBAC permissions, appears in Entra sign-in logs, is capped at seven days, and can be revoked by removing the signer's role assignment. It is the only SAS type worth issuing.