Check ID: storage_account_key_access_disabled
Provider: Azure
Service: storage
Severity: HIGH
Categories: identity-access, secrets
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts are evaluated for whether Shared Key (account key) authorization is disabled, requiring identity-based access via Microsoft Entra ID and RBAC.

Risk

Allowing Shared Key undermines confidentiality, integrity, and availability:
  • A leaked key grants broad read/write/delete across the account
  • Access bypasses RBAC and Conditional Access, reducing accountability
  • Activity is hard to attribute, easing data exfiltration and tampering

Recommendation

Disallow Shared Key and require Microsoft Entra ID with least-privilege RBAC for all data access.
  • Prefer user delegation SAS over account/service SAS
  • Apply Conditional Access and separation of duties
  • Monitor and phase out key-based clients; rotate and revoke unused keys

Remediation

az storage account update —name <storage-account-name> —resource-group <resource-group> —allow-shared-key-access false

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_account_key_access_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks