Back to Checks
azure

Storage account default network access rule is set to Deny

storage_default_network_access_rule_is_denied
Service: storageSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts configure the default network access rule to Deny, so the public endpoint only accepts traffic from explicitly allowed virtual networks, IP ranges, or private endpoints

Prowler logoProwlerprowler-provider-azure

Risk

With the default action set to Allow, the public endpoint is reachable from any network. This removes a network boundary, so stolen access keys or leaked SAS tokens can be abused from anywhere, enabling data exfiltration, tampering, and destructive writes-impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_default_network_access_rule_is_denied

Recommendation

Set the default network access to Deny and permit only required sources: selected VNets, specific IP ranges, or preferably private endpoints. Apply least privilege, minimize service bypass, and use short-lived, scoped SAS to limit blast radius if credentials leak.

Remediation

CLI

az storage account update --name <STORAGE_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP_NAME> --default-action Deny

Terraform

# Set default network access to Deny on an existing Storage Account
resource "azurerm_storage_account_network_rules" "<example_resource_name>" {
  storage_account_id = "<example_resource_id>"
  default_action     = "Deny" # Critical: sets default network access to Deny so the check passes
}

NativeIaC

// Set default network access to Deny for a Storage Account
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
  properties: {
    networkAcls: {
      defaultAction: 'Deny' // Critical: sets default network access to Deny so the check passes
    }
  }
}

Other

1In the Azure portal, open your Storage account
2Go to Security + networking > Networking
3Under Public network access, select Enable > Enabled from selected virtual networks and IP addresses
4Click Save
5This sets the default network access rule to Deny

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_default_network_access_rule_is_denied(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has network access rule set to Deny."

                if storage_account.network_rule_set.default_action == "Allow":
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has network access rule set to Allow."

                findings.append(report)

        return findings

References