Azure Compliance ControlsAzure Storage
Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled
Validates the storage account network bypass setting. Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules, so the `AzureServices` bypass is expected.
What this control checks
Storage account has the Allow Azure services on the trusted services list setting enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.2.6: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
2 more clauses
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- A.8.3 Information access restriction
- 12 Asset management
- 10.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 9.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-16.01B Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.7 Ensure 'Trusted Microsoft Services' is enabled for Storage Account access
- 3.7 Ensure 'Trusted Microsoft Services' is enabled for Storage Account access
- 3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
- 4.8 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access
Related controls
- Service Bus namespaces should use a virtual service endpoint
- PostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled
- Function apps should have virtual network integration enabled
- Azure Recovery Services vaults should use private link for backup
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_trusted_microsoft_services_enabled - Powerpipe Control:
azure_compliance.control.storage_account_trusted_microsoft_services_enabled - Prowler Check:
storage_ensure_azure_services_are_trusted_to_access_is_enabled - KICS Query:
5400f379-a347-4bdd-a032-446465fdcc6f - Trivy Check:
AZU-0010
Last reviewed: 2026-10-15