# Cis Azure Foundations 9.3.3.1

> Ensure 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'

- Skill: `cyberstrikeus/cis-azure-foundations-9-3-3-1` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-foundations-9-3-3-1`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-foundations-9-3-3-1/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-foundations-9-3-3-1

---


# Ensure 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'

## Description

When this property is enabled, the Azure portal authorizes requests to blobs, files, queues, and tables with Microsoft Entra ID by default.

## Rationale

Microsoft Entra ID provides superior security and ease of use over Shared Key.

## Audit Procedure

### Audit from Azure Portal

1. Go to `Storage accounts`.
2. Click the name of a storage account.
3. Under `Settings`, click `Configuration`.
4. Ensure that `Default to Microsoft Entra authorization in the Azure portal` is set to `Enabled`.
5. Repeat steps 1-4 for each storage account.

### Audit from Azure CLI

Run the following command to get the `name` and `defaultToOAuthAuthentication` setting for each storage account:

```bash
az storage account list --query [*].[name,defaultToOAuthAuthentication]
```

Ensure that `true` is returned for each storage account.

## Expected Result

`defaultToOAuthAuthentication` should be `true` for all storage accounts.

## Remediation

### Remediate from Azure Portal

1. Go to `Storage accounts`.
2. Click the name of a storage account.
3. Under `Settings`, click `Configuration`.
4. Under `Default to Microsoft Entra authorization in the Azure portal`, click the radio button next to `Enabled`.
5. Click `Save`.
6. Repeat steps 1-5 for each storage account requiring remediation.

### Remediate from Azure CLI

For each storage account requiring remediation, run the following command to enable `defaultToOAuthAuthentication`:

```bash
az storage account update --resource-group <resource-group> --name <storage-account> --set defaultToOAuthAuthentication=true
```

## Default Value

By default, `defaultToOAuthAuthentication` is disabled.

## References

1. https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-portal#default-to-microsoft-entra-authorization-in-the-azure-portal
2. https://learn.microsoft.com/en-us/cli/azure/storage/account

## Profile

Level 1