Back to Checks
azure

Storage account has cross-tenant replication disabled

storage_cross_tenant_replication_disabled
Service: storageSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts are assessed for whether cross-tenant object replication is disallowed via AllowCrossTenantReplication=false, limiting replication policies to the same tenant.

Prowler logoProwlerprowler-provider-azure

Risk

Permitting cross-tenant replication can copy sensitive blobs into external tenants, undermining confidentiality. A compromised or mismanaged destination enables data exfiltration; mirrored updates/deletes can impact integrity and retention, complicating auditability and incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_cross_tenant_replication_disabled

Recommendation

Enforce AllowCrossTenantReplication=false and keep replication within the same tenant. Apply least privilege and separation of duties for replication management, backed by policy-based governance to prevent drift. If cross-tenant transfer is required, use formal data-sharing controls, monitoring, and time-bound approvals.

Remediation

CLI

az storage account update --name <storage-account-name> --resource-group <resource-group> --allow-cross-tenant-replication false

Terraform

resource "azurerm_storage_account" "main" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_resource_name>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  cross_tenant_replication_enabled = false # Critical: disallow cross-tenant object replication
}

NativeIaC

// Disables cross-tenant replication on the storage account
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    allowCrossTenantReplication: false // Critical: disallow cross-tenant object replication
  }
}

Other

1In the Azure portal, go to Storage accounts and open your storage account
2Under Data management, select Object replication
3Click Advanced settings
4Uncheck Allow cross-tenant replication
5Click OK/Save
6If the option is unavailable, delete any existing cross-tenant object replication policies first, then retry

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_cross_tenant_replication_disabled(Check):
    """Check if cross-tenant replication is disabled.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> Check_Report_Azure:
        """Execute the check for cross-tenant replication.

        This method checks if cross-tenant replication is disabled. If it is, the check passes; otherwise, it fails.

        Returns:
            Check_Report_Azure: A report containing the result of the check.
        """
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                if not storage_account.allow_cross_tenant_replication:
                    report.status = "PASS"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has cross-tenant replication disabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has cross-tenant replication enabled."
                findings.append(report)
        return findings

References