A storage account left open to public access is one of the most common ways cloud data leaks. The good news: you can find every one across your whole estate in about thirty seconds, which is exactly the sort of check the Well-Architected security pillar wants you doing regularly.
Azure Resource Graph again, this time for storage accounts that allow public blob access:
az graph query -q "Resources | where type =~ 'microsoft.storage/storageaccounts' | where properties.allowBlobPublicAccess == true | project name, resourceGroup, location"
Anything that comes back is an account where a mis-set container could be readable by anyone on the internet. To close one down:
az storage account update --name <account> --resource-group <rg> --allow-blob-public-access false
That switches off public access at the account level, so no container underneath it can be made public by mistake. Run the query on a schedule and a nasty surprise becomes a routine check.
At scale you'd back this with a deny policy so it can never be switched on, plus private endpoints and network rules. The query alone, run this week, still finds the doors that are already open.
More useful tidbits coming — one a week.