Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
storage_account_key_access_disabledProvider: Azure
Service:
storageSeverity: HIGH
Categories:
identity-access, secretsResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage accounts are evaluated for whether Shared Key (account key) authorization is disabled, requiring identity-based access via Microsoft Entra ID and RBAC.Risk
Allowing Shared Key undermines confidentiality, integrity, and availability:- A leaked key grants broad read/write/delete across the account
- Access bypasses RBAC and Conditional Access, reducing accountability
- Activity is hard to attribute, easing data exfiltration and tampering
Recommendation
Disallow Shared Key and require Microsoft Entra ID with least-privilege RBAC for all data access.- Prefer user delegation SAS over account/service SAS
- Apply Conditional Access and separation of duties
- Monitor and phase out key-based clients; rotate and revoke unused keys
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account update —name <storage-account-name> —resource-group <resource-group> —allow-shared-key-access false
References
- https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent
- https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/StorageAccounts/disable-shared-key-authorization.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_account_key_access_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks