Policy: Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.03 - Identity and Access Management > 10.03.03.01 - Ensure 'Default to Microsoft Entra authorization' is 'Enabled'

Configures auditing against a CIS Benchmark item.

Level: 1

By default, the Azure portal uses Shared Key authorization to access blob and queue data. Enabling "Default to Microsoft Entra authorization" ensures that Azure AD is used by default for authorization instead of shared keys.

Using Azure AD authorization provides improved security through role-based access control (RBAC) and enables better audit logging of who accessed what data.

Primary Policy

This policy is used with the following primary policy:

Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.03 - Identity and Access Management

Controls

Setting this policy configures this control:

Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.03 - Identity and Access Management > 10.03.03.01 - Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'

Policy Specification

Schema Type	`string`
Default	`Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.03 - Identity and Access Management`
Valid Values [YAML]	`>- Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.03 - Identity and Access Management` `Skip` `Check: Benchmark`

Schema Type

string

Default

Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts > 10.03.03 - Identity and Access Management

Valid Values [YAML]

>-
  Per Azure > CIS v4.0 > 10 - Storage Services > 10.03 - Storage Accounts >
  10.03.03 - Identity and Access Management

Skip

Check: Benchmark

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v070503

Policy Type URI

tmod:@turbot/azure-cisv4-0#/policy/types/r10030301

GraphQL

query policyType(id: "tmod:@turbot/azure-cisv4-0#/policy/types/r10030301") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv4-0#/policy/types/r10030301'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv4-0#/policy/types/r10030301'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/azure-cisv4-0#/policy/types/r10030301"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv4-0#/policy/types/r10030301"