Storage accounts should use Azure Resource Manager resources
Use new Azure Resource Manager for your storage accounts. The Azure Policy check audits storage accounts of type Microsoft.ClassicStorage/storageAccounts and asks that they be migrated to new Azure Resource Manager resources.
Use new Azure Resource Manager for your storage accounts to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management.
What this control checks
Storage accounts should use Azure Resource Manager resources
Common pitfalls
Effect defaults to Audit
The effect parameter has the defaultValue Audit. The allowedValues are Audit, Deny, and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should be migrated to new Azure Resource Manager resources" (37e0d2fe-28a5-43d6-a273-67d37d1f5606); PowerPipe control azure_compliance.control.storage_account_uses_azure_resource_manager.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-3 (Access Enforcement).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-3 (Access Enforcement).
Framework mappings
The clauses this control is mapped to in each framework.
- Access Enforcement (AC-3)
FedRAMP Moderate Baseline Rev 4
- AC-3 Access Enforcement
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC-3 Access Enforcement
- 10.5.4 Logs for external-facing technologies (for example, wireless, firewalls, DNS, mail) are written onto a secure, centralized, internal log server or media
Related controls
- Storage accounts should have secure transfer enabled
- Storage accounts should have network access restrictions configured
- Storage accounts should have 'Default to Microsoft Entra authorization' enabled
- Storage account Blob services should have classic logging enabled
- Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_uses_azure_resource_manager - Powerpipe Control:
azure_compliance.control.storage_account_uses_azure_resource_manager - Azure Policy Definition:
37e0d2fe-28a5-43d6-a273-67d37d1f5606
Last reviewed: 2026-10-15