Azure Compliance ControlsAzure Storage
Storage accounts should use Azure Resource Manager resources
Use new Azure Resource Manager for your storage accounts. The Azure Policy check audits storage accounts of type Microsoft.ClassicStorage/storageAccounts and asks that they be migrated to new Azure Resource Manager resources.
What this control checks
Storage accounts should use Azure Resource Manager resources
Framework mappings
The clauses this control is mapped to in each framework.
- Access Enforcement (AC-3)
FedRAMP Moderate Baseline Rev 4
- AC-3 Access Enforcement
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC-3 Access Enforcement
- 10.5.4 Logs for external-facing technologies (for example, wireless, firewalls, DNS, mail) are written onto a secure, centralized, internal log server or media
Related controls
- Storage accounts should have secure transfer enabled
- Storage accounts should have network access restrictions configured
- Storage accounts should have 'Default to Microsoft Entra authorization' enabled
- Storage account Blob services should have classic logging enabled
- Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_uses_azure_resource_manager - Powerpipe Control:
azure_compliance.control.storage_account_uses_azure_resource_manager - Azure Policy Definition:
37e0d2fe-28a5-43d6-a273-67d37d1f5606
Last reviewed: 2026-10-15