Storage accounts should have 'Default to Microsoft Entra authorization' enabled
Azure Storage accounts with Default to Microsoft Entra authorization in the Azure portal use token-based Microsoft Entra ID (Azure RBAC) by default to access blobs, files, queues, and tables, rather than account keys.
Defaulting to access keys/Shared Key enables broad, non-scoped access and weak auditing. A stolen key grants full data access, risking confidentiality (exfiltration), integrity (unauthorized writes/deletes), and availability (destructive actions). It can also bypass least privilege and enable lateral movement via key reuse.
What this control checks
Default to Microsoft Entra authorization in the Azure portal must be Enabled on the storage account
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_default_to_entra_authorization_enabled (prowler azure --checks storage_default_to_entra_authorization_enabled); PowerPipe control azure_compliance.control.storage_account_default_to_oauth_authentication.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.3.3.1 (Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled').
CIS Azure Benchmark v5.0.0: Mapped to 9.3.3.1 (Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled').
BSI C5:2025: Mapped to IAM-03.01AC (The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the...).
HIPAA Security Rule 2003: Mapped to 164.312(a)(2)(i) (Unique user identification).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.3.3.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'
- 9.3.3.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- 164.312(a)(2)(i) Unique user identification
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_default_to_oauth_authentication - Powerpipe Control:
azure_compliance.control.storage_account_default_to_oauth_authentication - Prowler Check:
storage_default_to_entra_authorization_enabled
Last reviewed: 2026-10-15