SMB file shares should have 'SMB protocol version' set to 'SMB 3.1.1' or higher
Checks that SMB file shares use the latest SMB protocol version. Azure Storage file shares (SMB) should allow only the latest SMB protocol version, such as `SMB 3.1.1`, blocking legacy SMB versions at the storage account level.
Allowing legacy SMB versions enables protocol downgrade and weak cipher negotiation, reducing confidentiality and integrity. Adversaries can intercept or alter traffic, bypass strong signing/encryption, and exploit known flaws for lateral movement or credential replay.
What this control checks
Checks the SMB protocol version setting on Azure storage account file shares
Common pitfalls
Missing share_properties allows all SMB protocols
# missing "share_properties" (allows all SMB protocols)
Outdated version allowed alongside SMB3.1.1
versions = ["SMB3.1.1", "SMB2.1"] # allows outdated version
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_smb_protocol_version_is_latest (prowler azure --checks storage_smb_protocol_version_is_latest); PowerPipe control azure_compliance.control.storage_account_file_share_smb_protocol_version_3_1_1.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - Storage Account Not Using Latest SMB Protocol Version" (621fc7c5-c342-4223-b3dd-d1530acb43ae).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.1.2 (Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares).
CIS Azure Benchmark v5.0.0: Mapped to 9.1.2 (Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares).
BSI C5:2025: Mapped to OPS-23.01B (The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and...).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.1.2 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares
- 9.1.2 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_file_share_smb_protocol_version_3_1_1 - Powerpipe Control:
azure_compliance.control.storage_account_file_share_smb_protocol_version_3_1_1 - Prowler Check:
storage_smb_protocol_version_is_latest - KICS Query:
621fc7c5-c342-4223-b3dd-d1530acb43ae
Last reviewed: 2026-10-15