Back to Checks
azure

Storage account uses Microsoft Entra authorization by default

storage_default_to_entra_authorization_enabled
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts with Default to Microsoft Entra authorization in the Azure portal use token-based Microsoft Entra ID (Azure RBAC) by default to access blobs, files, queues, and tables, rather than account keys

Prowler logoProwlerprowler-provider-azure

Risk

Defaulting to access keys/Shared Key enables broad, non-scoped access and weak auditing. A stolen key grants full data access, risking confidentiality (exfiltration), integrity (unauthorized writes/deletes), and availability (destructive actions). It can also bypass least privilege and enable lateral movement via key reuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_default_to_entra_authorization_enabled

Recommendation

Enable this setting so the portal uses Microsoft Entra ID by default. Apply least privilege with Azure RBAC, prefer managed identities and user-delegation SAS, and where feasible disable Shared Key use. Rotate any existing keys, and monitor access with logs to enforce defense in depth.

Remediation

CLI

az storage account update -g <resource-group-name> -n <storage-account-name> --set defaultToOAuthAuthentication=true

Terraform

# Enable Microsoft Entra authorization by default for the storage account in the portal
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<example_location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  default_to_oauth_authentication = true # Critical: defaults portal data access to Microsoft Entra authorization
}

NativeIaC

// Enable Microsoft Entra (Azure AD) authorization by default in the portal
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<example_location>'
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
  properties: {
    defaultToOAuthAuthentication: true // Critical: defaults portal data access to Microsoft Entra authorization
  }
}

Other

1In the Azure portal, go to Storage accounts and select your account
2Under Settings, select Configuration
3Set "Default to Microsoft Entra authorization in the Azure portal" to Enabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_default_to_entra_authorization_enabled(Check):
    """Check if the default to Microsoft Entra authorization is enabled for the storage account.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).

    """

    def execute(self) -> Check_Report_Azure:
        """Execute the check for the default to Microsoft Entra authorization.

        This method checks if the default to Microsoft Entra authorization is enabled for the storage account.

        Returns:
            Check_Report_Azure: A report containing the result of the check.
        """
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.resource_name = storage_account.name
                report.resource_id = storage_account.id
                report.status = "FAIL"
                report.status_extended = f"Default to Microsoft Entra authorization is not enabled for storage account {storage_account.name} from subscription {subscription_name} ({subscription})."

                if storage_account.default_to_entra_authorization:
                    report.status = "PASS"
                    report.status_extended = f"Default to Microsoft Entra authorization is enabled for storage account {storage_account.name} from subscription {subscription_name} ({subscription})."

                findings.append(report)
        return findings

References