Skip to content
ENExplore Calculators

Azure Storage Exposure Calculator

Score an Azure storage account's exposure from public network access, anonymous blob access, Shared Key auth, TLS floor and SAS token lifetime.

About Azure Storage Exposure Calculator

The index adds the points carried by each control that decides whether a blob can be read from the internet. Shared Key authorisation is scored separately from network reachability because an account key is a permanent, non-revocable credential that bypasses Entra ID conditional access entirely, and a leaked key plus 'enabled from all networks' is a complete compromise of the account. Azure storage accounts fail differently from S3: the usual leak path is not a public container but a SAS token with a one-year expiry signed by an account key that nobody can rotate without breaking production.

Formulas

Azure Storage Exposure

Exposure index = public network access points + anonymous blob access points + Shared Key points + TLS floor points + min(15, public container ratio × 1.2) + SAS risk points, clamped to 0–100.

publicNetworkAccess
0–25 points for network reachability
sharedKeyAuth
12 points while account-key authorisation is enabled
containerPts
Public containers ÷ all containers × 100 × 1.2, capped at 15

SAS token risk

SAS risk points = min(12, log2(longest SAS lifetime in days) × 1.4) + min(6, active tokens × 0.06).

sasTtlDays
Longest lifetime granted to any live SAS token
sasTokens
Count of SAS tokens currently valid

Worked example

With the default values below, Azure Storage Exposure Calculator returns Exposure Index of 54.3. Change any input above and every figure here is recalculated in your browser.

Inputs used

Storage account public network accessone of Disabled, private endpoint only — 0, Enabled from selected virtual networks — 10, Enabled from all networks — 25
Enabled from selected virtual networks — 10
Allow blob anonymous accessone of Disabled at account level — 0, Enabled, every container private — 8, Enabled with public containers — 20
Enabled, every container private — 8
Shared Key (account key) authorisationone of Disabled, Entra ID only — 0, Enabled — 12
Enabled — 12
Minimum TLS versionone of TLS 1.2 or higher — 0, TLS 1.1 — 5, TLS 1.0 — 8
TLS 1.2 or higher — 0
Containers in the accountaccepts 1–200,000 containers
42 containers
Containers with a public access levelaccepts 0–200,000 containers
3 containers
Active SAS tokensaccepts 0–200,000 tokens
64 tokens
Longest SAS token lifetimeaccepts 0–3,650 days
365 days
Data stored in the accountaccepts 0–100,000 TB
18 TB

Results

Exposure Index
54.3 / 100
Exposure Level
Medium
Public Container Ratio
7.14%
SAS Token Risk Points
15.8 points
Data in the Exposed Path
9.78 TB
Dominant Exposure Path
SAS tokens are long-lived and numerous
Recommended Remediation
Disable Shared Key authorisation, move callers to Entra ID, then rotate both account keys

Step by step

  1. 1Values used
  2. 2Azure Storage Exposure
  3. 3SAS token risk
  4. 4Exposure Index= 54.3 / 100
  5. 5Exposure Level= Medium
  6. 6Public Container Ratio= 7.14
  7. 7SAS Token Risk Points= 15.8 points
  8. 8Data in the Exposed Path= 9.78 TB
  9. 9Dominant Exposure Path= SAS tokens are long-lived and numerous

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Azure Storage Exposure calculated?

Exposure index = public network access points + anonymous blob access points + Shared Key points + TLS floor points + min(15, public container ratio × 1.2) + SAS risk points, clamped to 0–100. The index adds the points carried by each control that decides whether a blob can be read from the internet. Shared Key authorisation is scored separately from network reachability because an account key is a permanent, non-revocable credential that bypasses Entra ID conditional access entirely, and a leaked key plus 'enabled from all networks' is a complete compromise of the account.

Why does Azure Storage Exposure matter?

Azure storage accounts fail differently from S3: the usual leak path is not a public container but a SAS token with a one-year expiry signed by an account key that nobody can rotate without breaking production.

What values do I need to enter?

This calculator takes 9 inputs: Storage account public network access, Allow blob anonymous access, Shared Key (account key) authorisation, Minimum TLS version, Containers in the account, Containers with a public access level, Active SAS tokens, Longest SAS token lifetime, Data stored in the account. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is Shared Key worse than a SAS token?

Because it cannot be scoped or revoked individually. An account key grants everything in the account, is not covered by conditional access or Entra ID logging, and rotating it invalidates every SAS token derived from it at once — which is exactly why teams put off rotation for years.

What is a user-delegation SAS?

A SAS signed with an Entra ID credential rather than the account key. It inherits the signer's RBAC permissions, appears in Entra sign-in logs, is capped at seven days, and can be revoked by removing the signer's role assignment. It is the only SAS type worth issuing.

Related Calculators

Azure Storage Exposure Calculator | Calcrivo