BlueScope Buildings Used Files.com to Lock Down Azure Blob Storage Without Breaking Its Builder Portal

BlueScope Buildings North America is the largest manufacturer of engineered building solutions on the continent. Its Butler Manufacturing brand helped launch the pre-engineered steel building industry, pioneering the rigid-frame construction that defined the category, and together with Varco Pruden it designs and manufactures customized steel building systems for the low-rise, non-residential market from seven manufacturing facilities, as part of the global BlueScope Steel group.

Those buildings do not reach customers directly. They are sold and erected through a network of independent builders, and that network runs on content: the product images and PDF documents BlueScope publishes to its builder portal. For years, the simplest way to serve that media was also the riskiest. It lived in Azure Blob Storage accounts that faced the public internet, readable by anyone, with no login in the way.

A Builder Portal Built on Anonymous Read Access

Serving images and PDFs straight out of public storage is convenient. A plain URL works in any browser, with nothing to authenticate and nothing to maintain. The cost is that the storage remains open to anonymous reads. At BlueScope, marketing content had built up in the same public-facing storage the portal depended on.

As the company tightened its Azure security posture, that arrangement stopped being acceptable. Storage accounts open to anonymous reads had to be locked down.

The problem was never Azure. The problem was that an external-facing application and a multi-terabyte content estate had been built on top of the exact access model being removed. Flip the storage accounts private and the builder portal's media goes dark, and the marketing archive is stranded with it. The fix had to do three things at once: hold the archive at multi-terabyte scale, keep the portal's media reachable to the people who need it, and connect back to the Azure storage BlueScope was keeping, with access that is controlled rather than anonymous.

Files.com in Front of Storage That No Longer Faces the Internet

BlueScope put Files.com in that position: the destination for the content that moved, and the controlled front for the storage that stayed.

The Azure Blob accounts BlueScope retained went private, and Files.com connected to them through its Azure Blob remote server integrations. Files.com reaches the storage, so the storage never has to face the internet again. The portal media and marketing assets held there are now reached through Files.com rather than through Azure Blob Storage answering anonymous requests directly.

The large marketing archive came off Azure entirely. During the lockdown it moved onto Files.com storage itself, so the security work never had to wait on marketing to find a new home for years of accumulated content.

For the system administrator who runs the platform, wiring those connections was not a project.

“They see it as magic, and I'm sitting here going, it's pretty easy to set up.”

The Accounts Went Private and Nothing Was Stranded

With the content re-homed, BlueScope replaced anonymous public access with governed access, and lost neither the portal nor the archive.

• The Azure storage accounts involved no longer serve anonymous public reads.
• The builder portal's images and PDFs kept flowing. They are hosted behind Files.com under controlled access.
• Files.com storage grew to 3.3 TB, driven largely by the marketing content offloaded during the lockdown, so securing the Azure accounts did not depend on first re-architecting where marketing's files lived.
• The Azure storage BlueScope kept stayed exactly where it was: locked down and fronted through Files.com, not migrated.

A Lockdown That Didn't Break What Was Built on It

Today, BlueScope can keep builder portal content available without leaving the supporting Azure storage accounts open to anonymous reads. The security requirement no longer dictates whether the portal works.

Files.com broke the dependency between the portal's availability and anonymous Azure access. The access model changed. The business built on it did not have to.