SMB file shares should have 'SMB channel encryption' set to 'AES-256-GCM' or higher
Azure Storage file shares (SMB) are evaluated for SMB channel encryption. The check looks at whether the allowed ciphers include the recommended AES-256-GCM. Missing or weak SMB channel encryption undermines confidentiality and integrity.
Missing or weak SMB channel encryption undermines confidentiality and integrity. On-path attackers could read sensitive files, capture hashes, or modify data in transit. Allowing legacy ciphers increases downgrade risks and can facilitate lateral movement, eroding trust boundaries across networks.
What this control checks
Checks the SMB channel encryption setting on Azure storage account file shares
Common pitfalls
Missing share_properties allows all standards
A missing share_properties allows all encryption standards. A missing smb block allows all encryption standards.
Missing channel_encryption_type allows all
A missing channel_encryption_type allows all encryption standards.
AES-256-GCM with weaker cipher still fails
A channel_encryption_type of ["AES-256-GCM", "AES-128-CCM"] allows weaker encryption.
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_smb_channel_encryption_with_secure_algorithm (prowler azure --checks storage_smb_channel_encryption_with_secure_algorithm); PowerPipe control azure_compliance.control.storage_account_file_share_smb_channel_encryption_aes_256_gcm.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - Storage Account Using Unsafe SMB Channel Encryption" (233ab26d-8f17-4dce-9616-41479da9ffe3).
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.1.3 (Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares).
CIS Azure Benchmark v5.0.0: Mapped to 9.1.3 (Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares).
Framework mappings
The clauses this control is mapped to in each framework.
- 10.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
- 9.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_file_share_smb_channel_encryption_aes_256_gcm - Powerpipe Control:
azure_compliance.control.storage_account_file_share_smb_channel_encryption_aes_256_gcm - Prowler Check:
storage_smb_channel_encryption_with_secure_algorithm - KICS Query:
233ab26d-8f17-4dce-9616-41479da9ffe3
Last reviewed: 2026-10-15