Storage accounts should each have 'Enable key rotation reminders' enabled
Azure Storage accounts must define a `key expiration period` for access-key rotation, set to a maximum of 90 days. The check flags any account that has no key expiration period configured or that sets a period longer than 90 days.
Long-lived storage access keys undermine confidentiality and integrity: a leaked or reused key grants full data access and can sign SAS tokens. Extended validity enables persistent unauthorized access, data exfiltration, and tampering, and complicates revocation and incident response.
What this control checks
Storage account key expiration period is 90 days or less
Common pitfalls
Set rotation reminder may be disabled
If Set rotation reminder is disabled, first regenerate both keys (Regenerate for key1, then key2), then repeat steps 3-5.
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_key_rotation_90_days (prowler azure --checks storage_key_rotation_90_days); PowerPipe control azure_compliance.control.storage_account_key_rotation_reminder_enabled.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 11.6.2.c (require the change of authentication credentials initially, at predefined intervals and upon suspicion that the...), 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 9.2.c.iii (distributing keys to intended entities, including how to activate keys when received;) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 9 Cryptography
- 11 Access control
- 12 Asset management
- 10.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 10.3.1.2 Ensure that Storage Account access keys are periodically regenerated
- 9.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 9.3.1.2 Ensure that Storage Account access keys are periodically regenerated
- CRY-03.01B The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
2 more clauses
- IAM-08.05B The cloud service provider documents, communicates and makes available to all users under its responsibility rules and recommendations for the management of credentials, including at least: - Non-reuse of credentials;- Trade-offs between entropy and ability to memorise;-...
- OPS-31.02B Remote attestation functionalities are based on cryptographic means rooted in trusted hard- and software.
- 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 4.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 4.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 164.308(a)(5)(ii)(D): Administrative Safeguards
Related controls
- Storage accounts should use Microsoft-managed key for encryption
- RBAC key vaults should have 'Expiration Date' configured for all secrets
- Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
- Storage accounts should have soft delete enabled
- Storage accounts should have soft delete enabled for both blobs and containers
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_key_rotation_reminder_enabled - Powerpipe Control:
azure_compliance.control.storage_account_key_rotation_reminder_enabled - Prowler Check:
storage_key_rotation_90_days
Last reviewed: 2026-10-15