Check ID: storage_key_rotation_90_days
Provider: Azure
Service: storage
Severity: MEDIUM
Categories: secrets
Resource type: microsoft.storage/storageaccounts

What this check verifies

Azure Storage accounts must define a key expiration period for access-key rotation, with a maximum of 90 days. The evaluation looks for accounts lacking this setting or exceeding that limit.

Risk

Long-lived storage access keys undermine confidentiality and integrity: a leaked or reused key grants full data access and can sign SAS tokens. Extended validity enables persistent unauthorized access, data exfiltration, and tampering, and complicates revocation and incident response.

Recommendation

Enforce a key expiration period of <= 90 days and automate rotation. Prefer Microsoft Entra ID with managed identities over Shared Key; when SAS is needed, use user-delegation SAS. Apply least privilege, minimize key distribution, monitor usage, rotate on suspected exposure, and disable Shared Key when feasible.

Remediation

az storage account update —name <STORAGE_ACCOUNT_NAME> —resource-group <RESOURCE_GROUP_NAME> —key-exp-days 90

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_key_rotation_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks