Storage accounts should have cross-tenant replication disabled
Checks that Azure storage accounts prevent object replication across tenants. The control passes when the `allowCrossTenantReplication` property is set to `false` on a storage account, which is the setting this check evaluates for each account.
What this control checks
Azure Policy 92a89a79-6c52-4a7e-a03f-61306fc49312 checks Microsoft.Storage/storageAccounts and flags accounts where allowCrossTenantReplication notEquals false. Prowler check storage_cross_tenant_replication_disabled assesses whether cross-tenant object replication is disallowed via AllowCrossTenantReplication=false. Powerpipe control storage_account_cross_tenant_replication_disabled is titled Cross tenant replication should be disabled for storage accounts.
Framework mappings
The clauses this control is mapped to in each framework.
- 10.3.8 Ensure 'Cross Tenant Replication' is not enabled
- 9.3.7 Ensure 'Cross Tenant Replication' is not enabled
- 4.16 Ensure 'Cross Tenant Replication' is not enabled
Related controls
- Azure Blob Storage accounts should have soft delete enabled for containers
- Key vaults should have public network access disabled
- Cosmos DB accounts should use a virtual network service endpoint
- Service Bus namespaces should use a virtual service endpoint
- MySQL servers should have public network access disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_cross_tenant_replication_disabled - Powerpipe Control:
azure_compliance.control.storage_account_cross_tenant_replication_disabled - Prowler Check:
storage_cross_tenant_replication_disabled - Azure Policy Definition:
92a89a79-6c52-4a7e-a03f-61306fc49312
Last reviewed: 2026-10-15