Azure Compliance ControlsAzure Storage
SMB file shares should have 'SMB channel encryption' set to 'AES-256-GCM' or higher
Azure Storage file shares (SMB) are evaluated for SMB channel encryption. The check looks at whether the allowed ciphers include the recommended AES-256-GCM. Missing or weak SMB channel encryption undermines confidentiality and integrity.
What this control checks
Checks the SMB channel encryption setting on Azure storage account file shares
Framework mappings
The clauses this control is mapped to in each framework.
- 10.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
- 9.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_file_share_smb_channel_encryption_aes_256_gcm - Powerpipe Control:
azure_compliance.control.storage_account_file_share_smb_channel_encryption_aes_256_gcm - Prowler Check:
storage_smb_channel_encryption_with_secure_algorithm - KICS Query:
233ab26d-8f17-4dce-9616-41479da9ffe3
Last reviewed: 2026-10-15