Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
Validates the storage account network bypass setting. Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules, so the `AzureServices` bypass is expected.
Without this exception, platform services relying on the account (backup, monitoring, replication) can be blocked, causing failed backups, missing logs, and stalled workflows. Teams may over-broaden network access to compensate, increasing confidentiality risk.
What this control checks
Storage account has the Allow Azure services on the trusted services list setting enabled
Common pitfalls
Bypass set to Metrics fails the check
Setting bypass to Metrics fails the check.
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_ensure_azure_services_are_trusted_to_access_is_enabled (prowler azure --checks storage_ensure_azure_services_are_trusted_to_access_is_enabled); PowerPipe control azure_compliance.control.storage_account_trusted_microsoft_services_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Trusted Microsoft Services Not Enabled" (5400f379-a347-4bdd-a032-446465fdcc6f); Trivy check AZU-0010.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 7.2.1 (Access to system components and data is appropriately defined and assigned.), 7.2.2 (Access to system components and data is appropriately defined and assigned.), 7.2.5 (Access to system components and data is appropriately defined and assigned.) and 4 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.3 (Information Access Restriction).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;).
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.2.6: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
2 more clauses
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- A.8.3 Information access restriction
- 12 Asset management
- 10.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 9.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-16.01B Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.7 Ensure 'Trusted Microsoft Services' is enabled for Storage Account access
- 3.7 Ensure 'Trusted Microsoft Services' is enabled for Storage Account access
- 3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 4.8 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
Related controls
- Service Bus namespaces should use a virtual service endpoint
- PostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled
- Function apps should have virtual network integration enabled
- Azure Recovery Services vaults should use private link for backup
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_trusted_microsoft_services_enabled - Powerpipe Control:
azure_compliance.control.storage_account_trusted_microsoft_services_enabled - Prowler Check:
storage_ensure_azure_services_are_trusted_to_access_is_enabled - KICS Query:
5400f379-a347-4bdd-a032-446465fdcc6f - Trivy Check:
AZU-0010
Last reviewed: 2026-10-15