Storage Hygiene Scorecard — Access-Security Grades

WHAT IT DOES

Storage Hygiene Scorecard deploys into your own Azure subscription as a managed application. Every day it inspects every storage account's configuration — public blob access, minimum TLS version, shared-key access, SAS expiry policy, and network default action — assigns each a letter grade, and posts the scorecard to Microsoft Teams so drift is caught the day it happens.

WHO IT IS FOR

Security, platform, and compliance teams who need continuous, readable evidence that storage accounts stay within a secure baseline.

WHY IT IS SAFE

There is no vendor backend and no data-plane access. It runs on a consumption Function inside your subscription, reads account configuration with a read-only Reader managed identity you control, and sends the scorecard only to the Teams webhook you configure. It never reads blob, file, queue, or table data. Delete the managed application and every trace is gone.

SETUP

Deploy from the marketplace, paste a Teams webhook URL, and run one script to grant read-only Reader. The first scorecard arrives the next morning.