Cis Azure Foundations 9.3.3.1

Ensure 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'

Description

When this property is enabled, the Azure portal authorizes requests to blobs, files, queues, and tables with Microsoft Entra ID by default.

Rationale

Microsoft Entra ID provides superior security and ease of use over Shared Key.

Audit Procedure

Audit from Azure Portal

1. Go to Storage accounts.
2. Click the name of a storage account.
3. Under Settings, click Configuration.
4. Ensure that Default to Microsoft Entra authorization in the Azure portal is set to Enabled.
5. Repeat steps 1-4 for each storage account.

Audit from Azure CLI

Run the following command to get the name and defaultToOAuthAuthentication setting for each storage account:

az storage account list --query [*].[name,defaultToOAuthAuthentication]

Ensure that true is returned for each storage account.

Expected Result

defaultToOAuthAuthentication should be true for all storage accounts.

Remediation

Remediate from Azure Portal

1. Go to Storage accounts.
2. Click the name of a storage account.
3. Under Settings, click Configuration.
4. Under Default to Microsoft Entra authorization in the Azure portal, click the radio button next to Enabled.
5. Click Save.
6. Repeat steps 1-5 for each storage account requiring remediation.

Remediate from Azure CLI

For each storage account requiring remediation, run the following command to enable defaultToOAuthAuthentication:

az storage account update --resource-group <resource-group> --name <storage-account> --set defaultToOAuthAuthentication=true

Default Value

By default, defaultToOAuthAuthentication is disabled.

References

1. https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-portal#default-to-microsoft-entra-authorization-in-the-azure-portal
2. https://learn.microsoft.com/en-us/cli/azure/storage/account

Profile

Level 1