Storage account has cross-tenant replication disabled

Check ID: storage_cross_tenant_replication_disabled
Provider: Azure
Service: storage
Severity: HIGH
Categories: trust-boundaries
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts are assessed for whether cross-tenant object replication is disallowed via AllowCrossTenantReplication=false, limiting replication policies to the same tenant.

Risk

Permitting cross-tenant replication can copy sensitive blobs into external tenants, undermining confidentiality. A compromised or mismanaged destination enables data exfiltration; mirrored updates/deletes can impact integrity and retention, complicating auditability and incident response.

Recommendation

Enforce AllowCrossTenantReplication=false and keep replication within the same tenant. Apply least privilege and separation of duties for replication management, backed by policy-based governance to prevent drift. If cross-tenant transfer is required, use formal data-sharing controls, monitoring, and time-bound approvals.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az storage account update —name <storage-account-name> —resource-group <resource-group> —allow-cross-tenant-replication false

resource "azurerm_storage_account" "main" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_resource_name>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  cross_tenant_replication_enabled = false # Critical: disallow cross-tenant object replication
}

// Disables cross-tenant replication on the storage account
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    allowCrossTenantReplication: false // Critical: disallow cross-tenant object replication
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_cross_tenant_replication_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Storage account has blob versioning enabled Storage account default network access rule is set to Deny

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires