> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/azure-entities/azure-resource-management/storagecontainer.md).

# StorageContainer

The **StorageContainer** entity (`AZStorageContainer`) represents a blob container inside an Azure Storage Account. Forestall collects containers as resources in their own right. Their anonymous access level, immutability and encryption settings can be queried, and a role assignment scoped to a single container is resolved to that container.

| Field                       | Type    | Possible Operators                            | Description                                                                                                                                                                                                |
| --------------------------- | ------- | --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| FSName                      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Display name used by Forestall to identify the object.                                                                                                                                                     |
| Guid                        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Unique identifier of the object in Forestall, a combination of the selected scan's GUID and the object's own identifier.                                                                                   |
| Name                        | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Name of the blob container.                                                                                                                                                                                |
| PublicAccess                | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Anonymous access level of the container: `None` (private), `Blob` (anonymous read of blobs) or `Container` (anonymous read and listing). Overridden when the storage account disallows blob public access. |
| LeaseStatus                 | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Whether the container has an active lease (`locked` / `unlocked`).                                                                                                                                         |
| LeaseState                  | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Lease state of the container: `available`, `leased`, `expired`, `breaking` or `broken`.                                                                                                                    |
| LastModifiedTime            | DATE    | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY    | Date and time the container or its properties were last modified. Blob operations do not change it.                                                                                                        |
| HasImmutabilityPolicy       | BOOLEAN | N/A (toggle)                                  | Whether the container has a time-based immutability (WORM) policy.                                                                                                                                         |
| HasLegalHold                | BOOLEAN | N/A (toggle)                                  | Whether a legal hold is in effect: blobs can be created and read but not modified or deleted.                                                                                                              |
| DefaultEncryptionScope      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Default encryption scope for blobs uploaded to the container.                                                                                                                                              |
| DenyEncryptionScopeOverride | BOOLEAN | N/A (toggle)                                  | Whether uploads are prevented from using an encryption scope other than the default.                                                                                                                       |