Azure Compliance ControlsAzure Storage
Storage accounts should have 'Default to Microsoft Entra authorization' enabled
Azure Storage accounts with Default to Microsoft Entra authorization in the Azure portal use token-based Microsoft Entra ID (Azure RBAC) by default to access blobs, files, queues, and tables, rather than account keys.
What this control checks
Default to Microsoft Entra authorization in the Azure portal must be Enabled on the storage account
Framework mappings
The clauses this control is mapped to in each framework.
- 10.3.3.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'
- 9.3.3.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- 164.312(a)(2)(i) Unique user identification
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_default_to_oauth_authentication - Powerpipe Control:
azure_compliance.control.storage_account_default_to_oauth_authentication - Prowler Check:
storage_default_to_entra_authorization_enabled
Last reviewed: 2026-10-15