Azure Compliance ControlsAzure Storage
Storage accounts should have shared key access disabled
Examines the shared key access setting on storage accounts, which should be disabled. With shared key access turned off, the account requires identity-based access through Microsoft Entra ID and `RBAC` instead of account keys.
What this control checks
Prowler storage_account_key_access_disabled evaluates whether Shared Key (account key) authorization is disabled.
Framework mappings
The clauses this control is mapped to in each framework.
- 10.3.1.3 Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'
- 9.3.1.3 Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_shared_key_access_disabled - Checkov Check:
CKV2_AZURE_40 - Powerpipe Control:
azure_compliance.control.storage_account_shared_key_access_disabled - Prowler Check:
storage_account_key_access_disabled - Azure Policy Definition:
8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54 - KICS Query:
45f3e879-f8a7-4102-a3fa-46da5a849870
Last reviewed: 2026-10-15