# Ensure 'SMB Channel Encryption' Is Set to 'AES-256-GCM' or Higher for SMB File Shares

- Source: https://support.icompaas.com/support/solutions/articles/62000234834-ensure-smb-channel-encryption-is-set-to-aes-256-gcm-or-higher-for-smb-file-shares
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 1**

Description:  
 SMB channel encryption secures data transmitted between clients and Azure SMB file shares by encrypting the SMB session. Setting the encryption algorithm to AES-256-GCM or higher provides strong confidentiality and integrity protections for data in transit, leveraging modern cryptographic standards.

Rationale:  
 Using AES-256-GCM enhances protection against eavesdropping, man-in-the-middle attacks, and data tampering during SMB file transfers. It aligns with industry best practices for encryption strength, ensuring that sensitive data moving over the network is safeguarded.

Impact:

Pros:  

-   Provides robust encryption and data integrity for SMB traffic.  
    
-   Mitigates risks of interception and tampering.  
    
-   Supports compliance with strict data protection regulations.  
    

Cons:  

-   May introduce slight performance overhead due to stronger encryption.  
    
-   Requires client and server support for AES-256-GCM encryption.  
    

Default Value:  
 Azure SMB file shares use strong encryption by default, but the exact cipher should be verified and enforced.

Pre-requisites:

-   Azure Storage Account with SMB file shares enabled.  
    
-   Clients capable of supporting AES-256-GCM encryption.  
    

### Remediation

Test Plan:

**Using Azure Portal:**

1.  Sign in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to the Storage Account hosting the SMB file shares.  
    
3.  Under Configuration or Security, verify the SMB channel encryption settings.  
    
4.  Confirm that AES-256-GCM or a stronger cipher is enforced.  
    

**Using Azure CLI:**

Query SMB encryption settings:

az storage account show --name <storage-account-name> --resource-group <resource-group> --query "azureFilesIdentityBasedAuthentication.smbEncryption"

1.  Confirm the encryption algorithm is set to AES-256-GCM or higher.  
    

### **Implementation Plan**

**Using Azure Portal:**

1.  Navigate to the storage account’s SMB configuration.  
    
2.  Set SMB channel encryption to AES-256-GCM or stronger cipher.  
    
3.  Save changes and test SMB client connections.  
    

**Using Azure CLI:**

Update SMB encryption settings:

az storage account update --name <storage-account-name> --resource-group <resource-group> --set azureFilesIdentityBasedAuthentication.smbEncryption=AES256GCM

1.  Verify the change.  
    

### Backout Plan

**Using Azure Portal:**

1.  Revert SMB encryption to previous settings if necessary.  
    
2.  Communicate with users about any compatibility impacts.  
    

**Using Azure CLI:**

Reset SMB encryption to prior value:

az storage account update --name <storage-account-name> --resource-group <resource-group> --set azureFilesIdentityBasedAuthentication.smbEncryption=<previous-encryption>

References:

-   [Azure Files SMB Encryption  
    ](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-smb-encryption)
    
-   [SMB Encryption Overview](https://docs.microsoft.com/en-us/windows-server/storage/file-server/smb-encryption)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.