Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
storage_smb_protocol_version_is_latestProvider: Azure
Service:
storageSeverity: MEDIUM
Categories:
vulnerabilitiesResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage file shares (SMB) are configured to allow only the latest SMB protocol version, blocking legacy SMB versions at the storage account levelRisk
Allowing legacy SMB versions enables protocol downgrade and weak cipher negotiation, reducing confidentiality and integrity. Adversaries can intercept or alter traffic, bypass strong signing/encryption, and exploit known flaws for lateral movement or credential replayRecommendation
Restrict SMB to the newest version (e.g.,SMB 3.1.1) and disable older versions. Enforce encryption in transit and prefer Kerberos over NTLM. Validate client compatibility, apply least privilege on shares, and monitor access to maintain defense in depth
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account file-service-properties update —resource-group <RESOURCE_GROUP> —account-name <STORAGE_ACCOUNT_NAME> —versions SMB3.1.1
References
- https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol#smb-security-settings
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/StorageAccounts/latest-smb-protocol-version.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_smb_protocol_version_is_latest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks