# Ensure 'Allow Storage Account Key Access' for Azure Storage Accounts Is 'Disabled'

- Source: https://support.icompaas.com/support/solutions/articles/62000234874-ensure-allow-storage-account-key-access-for-azure-storage-accounts-is-disabled-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-    **Level 1**

Description:  
 The setting 'Allow Storage Account Key Access' controls whether applications and users can access Azure Storage resources using the storage account access keys. Disabling this setting enforces the use of more secure authentication methods such as Azure Active Directory (Azure AD), reducing reliance on long-lived keys.

Rationale:  
 Disabling storage account key access limits the risk associated with key compromise, which can lead to unauthorized access. Encouraging Azure AD authentication enhances security by leveraging role-based access control (RBAC) and enables better auditability and key management.

Impact:

Pros:  

-   Reduces risk of unauthorized access via compromised keys.  
    
-   Supports modern authentication best practices with Azure AD.  
    
-   Improves security posture and audit capabilities.  
    

Cons:  

-   Legacy applications dependent on access keys may fail unless updated.  
    
-   Requires planning and testing for migration to Azure AD authentication.  
    

Default Value:  
 By default, storage account key access is enabled to maintain backward compatibility.

Pre-requisites:

-   Azure subscription with permissions to modify storage account settings.  
    
-   Azure AD configured for authentication to storage resources.  
    

### Remediation

Test Plan:

**Using Azure Portal:**

1.  Log in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to Storage Accounts and select the target account.
    
3.  Under Settings, go to Configuration.  
    
4.  Verify that Allow storage account key access is set to Disabled.
    

**Using Azure CLI:**

1.  Check the current status:  
    
    az storage account show --name --resource-group --query allowSharedKeyAccess
    
2.  Confirm the output is false indicating key access is disabled.
    

### Implementation Plan

**Using Azure Portal**:

1.  In the Configuration settings of the storage account, toggle Allow storage account key access to Disabled.  
    
2.  Save changes and validate access using Azure AD authentication.  
    

**Using Azure CLI:**

1.  Disable storage account key access:  
    
    az storage account update --name --resource-group --set allowSharedKeyAccess=false
    
2.  Confirm the update by rechecking the property.  
    

### Backout Plan

**Using Azure Portal:**

1.  Re-enable storage account key access if required by toggling the setting back to Enabled.  
    
2.  Communicate changes to affected users.  
    

**Using Azure CLI:**

Enable storage account key access:  

az storage account update --name --resource-group --set allowSharedKeyAccess=true

References:

-   [Manage Storage Account Settings  
    ](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-configure)[Azure Storage Security Best Practices  
    ](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-security-guide)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.