Storage accounts should have cross-tenant replication disabled
Checks that Azure storage accounts prevent object replication across tenants. The control passes when the `allowCrossTenantReplication` property is set to `false` on a storage account, which is the setting this check evaluates for each account.
Permitting cross-tenant replication can copy sensitive blobs into external tenants, undermining confidentiality. A compromised or mismanaged destination enables data exfiltration.
What this control checks
Storage accounts must have allowCrossTenantReplication set to false.
Common pitfalls
Cross-tenant replication allowed by default
By default, users can configure object replication with a source storage account in one Azure AD tenant and a destination account in a different tenant.
Delete existing policies if the option is unavailable
If the option is unavailable, delete any existing cross-tenant object replication policies first, then retry.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should prevent cross tenant object replication" (92a89a79-6c52-4a7e-a03f-61306fc49312); Prowler check storage_cross_tenant_replication_disabled (prowler azure --checks storage_cross_tenant_replication_disabled); PowerPipe control azure_compliance.control.storage_account_cross_tenant_replication_disabled.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.3.8 (Ensure 'Cross Tenant Replication' is not enabled).
CIS Azure Benchmark v5.0.0: Mapped to 9.3.7 (Ensure 'Cross Tenant Replication' is not enabled).
CIS Azure Benchmark v3.0.0: Mapped to 4.16 (Ensure 'Cross Tenant Replication' is not enabled).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.3.8 Ensure 'Cross Tenant Replication' is not enabled
- 9.3.7 Ensure 'Cross Tenant Replication' is not enabled
- 4.16 Ensure 'Cross Tenant Replication' is not enabled
Related controls
- Azure Blob Storage accounts should have soft delete enabled for containers
- Key vaults should have public network access disabled
- Cosmos DB accounts should use a virtual network service endpoint
- Service Bus namespaces should use a virtual service endpoint
- MySQL servers should have public network access disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_cross_tenant_replication_disabled - Powerpipe Control:
azure_compliance.control.storage_account_cross_tenant_replication_disabled - Prowler Check:
storage_cross_tenant_replication_disabled - Azure Policy Definition:
92a89a79-6c52-4a7e-a03f-61306fc49312
Last reviewed: 2026-10-15