Back to Checks
azure

Storage account has 'Allow trusted Microsoft services to access this storage account' enabled

storage_ensure_azure_services_are_trusted_to_access_is_enabled
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:microsoft.storage/storageaccounts

Azure Storage account network rules include the AzureServices bypass so trusted Microsoft services can reach the account even when firewalls restrict public access

Prowler logoProwlerprowler-provider-azure

Risk

Without this exception, platform services relying on the account (backup, monitoring, replication) can be blocked, causing failed backups, missing logs, and stalled workflows-affecting availability and integrity. Teams may over-broaden network access to compensate, increasing confidentiality risk.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_ensure_azure_services_are_trusted_to_access_is_enabled

Recommendation

Enable the trusted services exception (AzureServices) for storage accounts used by platform services.

  • Enforce least privilege with RBAC and managed identities
  • Keep networks restricted; prefer private endpoints
  • Monitor access and review exceptions regularly

Remediation

CLI

az storage account update --name <StorageAccountName> --resource-group <resourceGroupName> --bypass AzureServices

Terraform

# Enable trusted Microsoft services on a Storage Account
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  network_rules {
    bypass = ["AzureServices"] # CRITICAL: Allows trusted Microsoft services to bypass network rules
  }
}

NativeIaC

// Enable trusted Microsoft services on a Storage Account
resource stg 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  kind: 'StorageV2'
  sku: { name: 'Standard_LRS' }
  properties: {
    networkAcls: {
      bypass: 'AzureServices' // CRITICAL: Allows trusted Microsoft services to bypass network rules
    }
  }
}

Other

1In the Azure portal, go to Storage accounts and select your account
2Navigate to Security + networking > Networking
3Under Exceptions, check Allow trusted Microsoft services to access this storage account
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_ensure_azure_services_are_trusted_to_access_is_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) allows trusted Microsoft services to access this storage account."

                if "AzureServices" not in storage_account.network_rule_set.bypass:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) does not allow trusted Microsoft services to access this storage account."

                findings.append(report)

        return findings

References