Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
storage_default_network_access_rule_is_deniedProvider: Azure
Service:
storageSeverity: HIGH
Categories:
internet-exposed, trust-boundariesResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage accounts configure the default network access rule toDeny, so the public endpoint only accepts traffic from explicitly allowed virtual networks, IP ranges, or private endpoints
Risk
With the default action set toAllow, the public endpoint is reachable from any network. This removes a network boundary, so stolen access keys or leaked SAS tokens can be abused from anywhere, enabling data exfiltration, tampering, and destructive writes-impacting confidentiality, integrity, and availability.
Recommendation
Set the default network access toDeny and permit only required sources: selected VNets, specific IP ranges, or preferably private endpoints. Apply least privilege, minimize service bypass, and use short-lived, scoped SAS to limit blast radius if credentials leak.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account update —name <STORAGE_ACCOUNT_NAME> —resource-group <RESOURCE_GROUP_NAME> —default-action Deny
References
- https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-set-default-access
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/StorageAccounts/restrict-default-network-access.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_default_network_access_rule_is_denied. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks