Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
storage_default_to_entra_authorization_enabledProvider: Azure
Service:
storageSeverity: MEDIUM
Categories:
identity-accessResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage accounts withDefault to Microsoft Entra authorization in the Azure portal use token-based Microsoft Entra ID (Azure RBAC) by default to access blobs, files, queues, and tables, rather than account keys
Risk
Defaulting to access keys/Shared Key enables broad, non-scoped access and weak auditing. A stolen key grants full data access, risking confidentiality (exfiltration), integrity (unauthorized writes/deletes), and availability (destructive actions). It can also bypass least privilege and enable lateral movement via key reuse.Recommendation
Enable this setting so the portal uses Microsoft Entra ID by default. Apply least privilege with Azure RBAC, prefer managed identities and user-delegation SAS, and where feasible disable Shared Key use. Rotate any existing keys, and monitor access with logs to enforce defense in depth.Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/StorageAccounts/enable-microsoft-entra-authorization-by-default.html
- https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory
- https://learn.microsoft.com/en-us/azure/storage/files/authorize-data-operations-portal
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_default_to_entra_authorization_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks