diff --git a/docs/spec/v1/buckets.md b/docs/spec/v1/buckets.md
index eb02f5114..9f431d3c4 100644
--- a/docs/spec/v1/buckets.md
+++ b/docs/spec/v1/buckets.md
@@ -339,8 +339,7 @@ with:
   with the `AZURE_CLIENT_ID`
 - Managed Identity with a system-assigned identity
 
-is attempted by default. If no chain can be established, the bucket
-is assumed to be publicly reachable.
+is attempted by default.
 
 When a reference is specified, it expects a Secret with one of the following
 sets of `.data` fields:
@@ -359,23 +358,6 @@ For any Managed Identity and/or Microsoft Entra ID (Formerly Azure Active Direct
 the base URL can be configured using `.data.authorityHost`. If not supplied,
 [`AzurePublicCloud` is assumed](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#AuthorityHost).
 
-##### Azure example
-
-```yaml
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: Bucket
-metadata:
-  name: azure-public
-  namespace: default
-spec:
-  interval: 5m0s
-  provider: azure
-  bucketName: podinfo
-  endpoint: https://podinfoaccount.blob.core.windows.net
-  timeout: 30s
-```
-
 ##### Azure Service Principal Secret example
 
 ```yaml
@@ -1004,9 +986,6 @@ the `.spec.provider` field:
   feature gate `ObjectLevelWorkloadIdentity` must be enabled, otherwise the
   controller will error out.
 
-**Note:** that for a publicly accessible object storage, you don't need to
-provide a `secretRef` nor `serviceAccountName`.
-
 **Important:** `.spec.secretRef` and `.spec.serviceAccountName` are mutually
 exclusive and cannot be set at the same time. This constraint is enforced
 at the CRD level.
diff --git a/internal/bucket/azure/blob.go b/internal/bucket/azure/blob.go
index 94489add9..b4e21ac99 100644
--- a/internal/bucket/azure/blob.go
+++ b/internal/bucket/azure/blob.go
@@ -207,13 +207,8 @@ func NewClient(ctx context.Context, obj *sourcev1.Bucket, opts ...Option) (c *Bl
 		err = fmt.Errorf("failed to create environment credential chain: %w", err)
 		return nil, err
 	}
-	if token != nil {
-		c.Client, err = azblob.NewClient(obj.Spec.Endpoint, token, clientOpts)
-		return
-	}
 
-	// Fallback to simple client.
-	c.Client, err = azblob.NewClientWithNoCredential(obj.Spec.Endpoint, clientOpts)
+	c.Client, err = azblob.NewClient(obj.Spec.Endpoint, token, clientOpts)
 	return
 }
 
@@ -501,7 +496,8 @@ func sasTokenFromSecret(ep string, secret *corev1.Secret) (string, error) {
 //     environment variable, if found.
 //   - azidentity.ManagedIdentityCredential with defaults.
 //
-// If no valid token is created, it returns nil.
+// The chain always contains at least one credential, so this never returns a nil
+// TokenCredential; Azure buckets are not supported without authentication.
 func chainCredentialWithSecret(ctx context.Context, secret *corev1.Secret, opts ...auth.Option) (azcore.TokenCredential, error) {
 	var creds []azcore.TokenCredential
 
@@ -519,11 +515,7 @@ func chainCredentialWithSecret(ctx context.Context, secret *corev1.Secret, opts
 		creds = append(creds, token)
 	}
 
-	if len(creds) > 0 {
-		return azidentity.NewChainedTokenCredential(creds, nil)
-	}
-
-	return nil, nil
+	return azidentity.NewChainedTokenCredential(creds, nil)
 }
 
 // extractAccountNameFromEndpoint extracts the Azure account name from the