Our SQL Server backs up nightly to Blob storage.

I want some staff members (already in the Active Directory) to be able to view the list of backup files and download them to their machine. Then they can restore the database locally and test it.

These members should not be able to delete these blobs. (Obviously, having team members inadvertently deleting backups is a Bad Thing)

Is it possible to provide a group of users read access to a blob container?

I can bring up an Access Control (IAM) blade of the storage account, then assign a user the role of "Reader".

[![enter image description here](https://i.stack.imgur.com/aT92L.png)](https://i.stack.imgur.com/aT92L.png)

This user can now view the initial blade of the storage account.

But if he attempts to bring up the `BLOB SERVICE \ Containers` blade, he is presented with the text "ACCESS DENIED".

Is there are some way I can assign the user read-access to the containers?