| name | cis-azure-foundations-9.3.3.1 |
| description | Ensure 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage-accounts","entra-id","authorization","iam"] |
| cis_id | 9.3.3.1 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'
Description
When this property is enabled, the Azure portal authorizes requests to blobs, files, queues, and tables with Microsoft Entra ID by default.
Rationale
Microsoft Entra ID provides superior security and ease of use over Shared Key.
Audit Procedure
Audit from Azure Portal
- Go to
Storage accounts.
- Click the name of a storage account.
- Under
Settings, click Configuration.
- Ensure that
Default to Microsoft Entra authorization in the Azure portal is set to Enabled.
- Repeat steps 1-4 for each storage account.
Audit from Azure CLI
Run the following command to get the name and defaultToOAuthAuthentication setting for each storage account:
az storage account list --query [*].[name,defaultToOAuthAuthentication]
Ensure that true is returned for each storage account.
Expected Result
defaultToOAuthAuthentication should be true for all storage accounts.
Remediation
Remediate from Azure Portal
- Go to
Storage accounts.
- Click the name of a storage account.
- Under
Settings, click Configuration.
- Under
Default to Microsoft Entra authorization in the Azure portal, click the radio button next to Enabled.
- Click
Save.
- Repeat steps 1-5 for each storage account requiring remediation.
Remediate from Azure CLI
For each storage account requiring remediation, run the following command to enable defaultToOAuthAuthentication:
az storage account update --resource-group <resource-group> --name <storage-account> --set defaultToOAuthAuthentication=true
Default Value
By default, defaultToOAuthAuthentication is disabled.
References
- https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-portal#default-to-microsoft-entra-authorization-in-the-azure-portal
