Back to Checks
azure

Storage account allows only the latest SMB protocol version for file shares

storage_smb_protocol_version_is_latest
Service: storageSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.storage/storageaccounts

Azure Storage file shares (SMB) are configured to allow only the latest SMB protocol version, blocking legacy SMB versions at the storage account level

Prowler logoProwlerprowler-provider-azure

Risk

Allowing legacy SMB versions enables protocol downgrade and weak cipher negotiation, reducing confidentiality and integrity. Adversaries can intercept or alter traffic, bypass strong signing/encryption, and exploit known flaws for lateral movement or credential replay

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_smb_protocol_version_is_latest

Recommendation

Restrict SMB to the newest version (e.g., SMB 3.1.1) and disable older versions. Enforce encryption in transit and prefer Kerberos over NTLM. Validate client compatibility, apply least privilege on shares, and monitor access to maintain defense in depth

Remediation

CLI

az storage account file-service-properties update --resource-group <RESOURCE_GROUP> --account-name <STORAGE_ACCOUNT_NAME> --versions SMB3.1.1

Terraform

# Configure storage account to allow only the latest SMB version for file shares
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  share_properties {
    smb {
      versions = ["SMB3.1.1"] # Critical: restrict to only SMB 3.1.1 (latest)
    }
  }
}

NativeIaC

// Set SMB protocol to only the latest version for Azure Files
resource fileService 'Microsoft.Storage/storageAccounts/fileServices@2023-01-01' = {
  name: '<example_resource_name>/default'
  properties: {
    protocolSettings: {
      smb: {
        versions: 'SMB3.1.1' // Critical: allow only SMB 3.1.1 (latest) to pass the check
      }
    }
  }
}

Other

1In the Azure portal, go to Storage accounts and open your storage account
2Navigate to Data storage > File shares
3Under File share settings, select Security
4Choose Profile: Custom, then under SMB protocol versions select only SMB 3.1.1
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.lib.constants import LATEST_SMB_VERSION
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_smb_protocol_version_is_latest(Check):
    """
    Ensure SMB protocol version for file shares is set to the latest version.

    This check evaluates whether SMB file shares are configured to use only the latest SMB protocol version.
    - PASS: Storage account allows only the latest SMB protocol version for file shares.
    - FAIL: Storage account allows other SMB protocol versions for file shares.
    """

    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for account in storage_accounts:
                if getattr(account, "file_service_properties", None) and getattr(
                    account.file_service_properties.smb_protocol_settings,
                    "supported_versions",
                    None,
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(),
                        resource=account.file_service_properties,
                    )
                    report.subscription = subscription
                    report.resource_name = account.name
                    report.location = account.location
                    if (
                        len(
                            account.file_service_properties.smb_protocol_settings.supported_versions
                        )
                        == 1
                        and account.file_service_properties.smb_protocol_settings.supported_versions[
                            0
                        ]
                        == LATEST_SMB_VERSION
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) allows only the latest SMB protocol version ({LATEST_SMB_VERSION}) for file shares."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"Storage account {account.name} from subscription {subscription_name} ({subscription}) allows SMB protocol versions: {', '.join(account.file_service_properties.smb_protocol_settings.supported_versions) if account.file_service_properties.smb_protocol_settings.supported_versions else 'None'}. Only the latest SMB protocol version ({LATEST_SMB_VERSION}) should be allowed."
                    findings.append(report)
        return findings

References