# Ensure Cross Tenant Replication is Disabled for Azure Storage Accounts

- Source: https://support.icompaas.com/support/solutions/articles/62000234856-ensure-cross-tenant-replication-is-disabled-for-azure-storage-accounts
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-    **Level 1**

Description:  
 Cross Tenant Replication allows Azure Storage Accounts to replicate data across different Azure Active Directory tenants. Disabling this feature ensures that data replication is restricted within the same tenant, reducing the risk of unauthorized data exposure across organizational boundaries.

Rationale:  
 Preventing cross-tenant replication enhances data governance and compliance by limiting data movement to trusted tenant boundaries. It minimizes risks related to data leakage and unauthorized access from external tenants.

Impact:

Pros:  

-   Strengthens data isolation and security within a single tenant.  
    
-   Supports compliance with organizational data residency policies.  
    

Cons:  

-   May limit some multi-tenant disaster recovery or collaboration scenarios.  
    
-   Requires alternative approaches for cross-tenant data sharing.  
    

Default Value:  
 Cross Tenant Replication is disabled by default unless explicitly enabled.

Pre-requisites:

-   Permissions to view and modify replication settings.  
    
-   Understanding of tenant boundaries and data governance policies.  
    

### Remediation

Test Plan:

**Using Azure Portal:**

1.  Sign in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to the Storage Account.  
    
3.  Check the Replication or Geo-replication settings.
    
4.  Verify that Cross Tenant Replication is not enabled.
    

**Using Azure CLI:**

1.  Retrieve replication settings:  
    
    \# az storage account show --name <storage-account-name> --resource-group <resource-group> --query geoReplication
    
2.  Confirm cross-tenant replication is not active.  
    

### Implementation Plan

**Using Azure Portal:**

1.  Disable cross-tenant replication if found enabled.  
    
2.  Save changes and verify.  
    

**Using Azure CLI:**

1.  Disable cross-tenant replication by updating the replication settings as per organizational policy.  
    (Note: Specific CLI commands depend on replication configuration and may require contacting Azure support if cross-tenant replication was enabled via special setup.)  
    

### **Backout Plan:**

Using Azure Portal:

1.  Re-enable cross-tenant replication if necessary.  
    
2.  Communicate impact to stakeholders.  
    

**Using Azure CLI:**

1.  Revert changes by updating replication settings accordingly.  
    

References:

-   [Azure Storage Geo-Replication](https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy)
-   [](https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy)[Data Governance in Azure  
    ](https://learn.microsoft.com/en-us/azure/governance/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.