Get-AzureStorageAccountAccessReport

<#
.SYNOPSIS
    Reports access configuration across all storage accounts.

.DESCRIPTION
    Checks public blob access, shared key access, and default network
    action for every storage account in the subscription, so a
    permissive setting left over from a quick test does not stay live
    in production unnoticed.

.EXAMPLE
    .\Get-AzureStorageAccountAccessReport.ps1

.NOTES
    Requires the Az.Storage module and an active Connect-AzAccount session.

.AUTHOR
    Shehryar Hassan
#>

$accounts = Get-AzStorageAccount

$report = $accounts | Select-Object StorageAccountName, ResourceGroupName,
    AllowBlobPublicAccess, EnableHttpsTrafficOnly,
    @{N="DefaultNetworkAction";E={$_.NetworkRuleSet.DefaultAction}}

$report | Format-Table -AutoSize
$report | Where-Object AllowBlobPublicAccess | ForEach-Object { Write-Warning "$($_.StorageAccountName) allows public blob access." }