Use blob-relative values in Azure Storage path conditions

Source facts

For the Blob path attribute, Microsoft says condition values omit the container name and any leading slash. The path characters are supplied without URL encoding. The same formatting instructions apply to the Blob prefix attribute.

Available condition attributes also depend on the selected actions. Selecting several actions together can reduce the available attributes because each selected action must support them. Microsoft Learn.

Applicability

Identify the exact role-assignment condition, selected actions, container, and intended blob-relative path. Separate the resource’s full URL from the attribute value used in the condition, and check the current source’s feature status for any additional attributes.

DSE recommendation

DSE recommends a condition test table showing the intended object, the actual value entered, and the expected authorization result. Review formatting errors before changing the role scope or removing a condition. Have the data owner approve any expansion of the allowed prefix; a failed request should not automatically justify broader access.

Verification

Using a controlled identity and harmless blobs, test an intended path and a neighboring excluded path. Include a name containing characters that require URL encoding in a request URL, while keeping the condition value in the documented form. Inspect the selected actions and effective assignments, then preserve the condition and observed results without copying sensitive data.

Official references

Microsoft Learn: Actions and attributes for Azure role assignment conditions for Azure Blob Storage. Source retrieved September 9, 2026.