Managed disks should have 'Enable Data Access Authentication Mode' set to 'Checked'
Checks that managed disks use Azure Active Directory for data access authentication. When an export/upload URL is used, the system checks if the user has an identity in Azure Active Directory and has necessary permissions to export/upload the data.
When export/upload URL is used, the system checks if the user has an identity in Azure Active Directory and has necessary permissions to export/upload the data.
What this control checks
Managed disks must have dataAccessAuthMode set to AzureActiveDirectory
Common pitfalls
Policy conflictEffect is set to audit
The policy sets conflictEffect to audit.
effect allows Modify and Disabled values
The effect parameter allows Modify and Disabled. Enable or disable the execution of the policy.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Protect your data with authentication requirements when exporting or uploading to a disk or snapshot." (c3921d55-b741-4d16-8d56-7f16e99e6892); PowerPipe control azure_compliance.control.compute_disk_data_access_auth_mode_enabled.
Framework-specific interpretation
CIS Azure Benchmark v3.0.0: Mapped to 8.6 (Ensure that 'Enable Data Access Authentication Mode' is 'Checked').
Framework mappings
The clauses this control is mapped to in each framework.
- 8.6 Ensure that 'Enable Data Access Authentication Mode' is 'Checked'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_disk_data_access_auth_mode_enabled - Powerpipe Control:
azure_compliance.control.compute_disk_data_access_auth_mode_enabled - Azure Policy Definition:
c3921d55-b741-4d16-8d56-7f16e99e6892
Last reviewed: 2026-10-11