Check ID: storage_default_to_entra_authorization_enabled
Provider: Azure
Service: storage
Severity: MEDIUM
Categories: identity-access
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts with Default to Microsoft Entra authorization in the Azure portal use token-based Microsoft Entra ID (Azure RBAC) by default to access blobs, files, queues, and tables, rather than account keys

Risk

Defaulting to access keys/Shared Key enables broad, non-scoped access and weak auditing. A stolen key grants full data access, risking confidentiality (exfiltration), integrity (unauthorized writes/deletes), and availability (destructive actions). It can also bypass least privilege and enable lateral movement via key reuse.

Recommendation

Enable this setting so the portal uses Microsoft Entra ID by default. Apply least privilege with Azure RBAC, prefer managed identities and user-delegation SAS, and where feasible disable Shared Key use. Rotate any existing keys, and monitor access with logs to enforce defense in depth.

Remediation

az storage account update -g <resource-group-name> -n <storage-account-name> --set defaultToOAuthAuthentication=true

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_default_to_entra_authorization_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks