Microsoft Storage

Best practices and references below are based on published guidance from the cloud service provider and may reference native capabilities the cloud service provider offers. If you are not using the native security capabilities, the same security requirement can be met using other security capabilities your organization utilizes
Asset Inventory
Design Guidance:
Tag resources, resource groups, and subscriptions for logical organization - Azure Resource Manager
docsmsft
Microsoft.Storage/storageAccounts
Tags
​Azure Resource Manager​
​Terraform​
Tags-Additional Properties
​Azure Resource Manager​
​Terraform​
Identification and Authentication
Design Guidance:
Choose how to authorize access to blob data in the Azure portal - Azure Storage
docsmsft
Microsoft.Storage/storageAccounts
Identity-Type
​Azure Resource Manager​
​Terraform​
Transparent Data Encryption
Design Guidance:
Azure Storage encryption for data at rest
docsmsft
Microsoft.Storage/storageAccounts
Blob-Enabled
​Azure Resource Manager​
​Terraform​
Blob-Key Type
​Azure Resource Manager​
​Terraform​
Protect Cryptographic Keys
Design Guidance:
Customer-managed keys for account encryption - Azure Storage
docsmsft
Microsoft.Storage/storageAccounts
Encryption-Key Source
​Azure Resource Manager​
​Terraform​
Encryption-Keyvaultproperties
​Azure Resource Manager​
​Terraform​
Keyvaultproperties-Keyname
​Azure Resource Manager​
​Terraform​
Keyvaultproperties-Keyversion
​Azure Resource Manager​
​Terraform​
Keyvaultproperties-Keyvaulturi
​Azure Resource Manager​
​Terraform​
Firewalls
Design Guidance:
Configure Azure Storage firewalls and virtual networks
docsmsft
Microsoft.Storage/storageAccounts
Network Acls-Bypass
​Azure Resource Manager​
​Terraform​
Virtual Network Rules-Id
​Azure Resource Manager​
​Terraform​
Virtual Network Rules-Action
​Azure Resource Manager​
​Terraform​
Virtual Network Rules-State
​Azure Resource Manager​
​Terraform​
IP Whitelisting
Microsoft.Storage/storageAccounts
Network Acls-Ip Rules
​Azure Resource Manager​
​Terraform​
Ip Rules-Value
​Azure Resource Manager​
​Terraform​
Ip Rules-Action
​Azure Resource Manager​
​Terraform​
Network Acls-Default Action
​Azure Resource Manager​
​Terraform​
Design for High Availability
Design Guidance:
Hot, Cool, and Archive access tiers for blob data - Azure Storage
docsmsft
Microsoft.Storage/storageAccounts
Access Tier
​Azure Resource Manager​
​Terraform​
TLS
Design Guidance:
Enforce a minimum required version of Transport Layer Security (TLS) for incoming requests - Azure Storage
docsmsft
Microsoft.Storage/storageAccounts
Supports HTTPS Traffic Only
​Azure Resource Manager​
​Terraform​
Information Flow Routing
Microsoft.Storage/storageAccounts
Routing Preference-Routing Choice
​Azure Resource Manager​
​Terraform​
Routing Preference-Publish Microsoft Endpoints
​Azure Resource Manager​
​Terraform​
Routing Preference-Publish Internet Endpoints
​Azure Resource Manager​
​Terraform​
Secure Response Headers
Microsoft.Storage/storageAccounts/blobServices
Cors
​Azure Resource Manager​
Cors Rules-Allowed Methods
​Azure Resource Manager​
Microsoft.Storage/storageAccounts/fileServices
Cors Rules-Allowed Methods
​Azure Resource Manager​
CORS Headers
Microsoft.Storage/storageAccounts/blobServices
Cors-Cors Rules
​Azure Resource Manager​
Cors Rules-Allowed Origins
​Azure Resource Manager​
Cors Rules-Max Age In Seconds
​Azure Resource Manager​
Cors Rules-Exposed Headers
​Azure Resource Manager​
Cors Rules-Allowed Headers
​Azure Resource Manager​
Microsoft.Storage/storageAccounts/fileServices
Cors
​Azure Resource Manager​
Cors-Cors Rules
​Azure Resource Manager​
Cors Rules-Allowed Origins
​Azure Resource Manager​
Cors Rules-Max Age In Seconds
​Azure Resource Manager​
Cors Rules-Exposed Headers
​Azure Resource Manager​
Cors Rules-Allowed Headers
​Azure Resource Manager​
Data Retention
Microsoft.Storage/storageAccounts/blobServices
Delete Retention Policy-Enabled
​Azure Resource Manager​
Delete Retention Policy-Days
​Azure Resource Manager​
Backups
Design Guidance:
Blob snapshots - Azure Storage
docsmsft
Microsoft.Storage/storageAccounts/blobServices
Automatic Snapshot Policy Enabled
​Azure Resource Manager​
Access Policy Enforcement
Microsoft.Storage/storageAccounts/blobServices/containers
Public Access
​Azure Resource Manager​
Use Enterprise Accounts and Disable Local Accounts
Microsoft.Storage/storageAccounts
Azure Files Identity Based Authentication-Active Directory Properties
​Azure Resource Manager​
​Terraform​
Active Directory Properties-Domain Name
​Azure Resource Manager​
​Terraform​
Active Directory Properties-Net Bios Domain Name
​Azure Resource Manager​
​Terraform​
Active Directory Properties-Forest Name
​Azure Resource Manager​
​Terraform​
Active Directory Properties-Domain Guid
​Azure Resource Manager​
​Terraform​
Active Directory Properties-Domain Sid
​Azure Resource Manager​
​Terraform​
Active Directory Properties-Azure Storage Sid
​Azure Resource Manager​
​Terraform​
Subnet Isolation
Design Guidance:
Configure Azure Storage firewalls and virtual networks
docsmsft
Microsoft.Storage/storageAccounts/privateEndpointConnections
Name
​Azure Resource Manager​
Private Link Service Connection State-Status
​Azure Resource Manager​
Private Link Service Connection State-Description
​Azure Resource Manager​
Private Link Service Connection State-Action Required
​Azure Resource Manager​
Microsoft.Storage/storageAccounts/privateEndpointConnections
Provisioning State
​Azure Resource Manager​

Microsoft Sql Databases

Microsoft StreamAnalytics

Last modified 1yr ago

Tags	Azure Resource Manager	Terraform
Tags-Additional Properties	Azure Resource Manager	Terraform

Blob-Enabled	Azure Resource Manager	Terraform
Blob-Key Type	Azure Resource Manager	Terraform

Encryption-Key Source	Azure Resource Manager	Terraform
Encryption-Keyvaultproperties	Azure Resource Manager	Terraform
Keyvaultproperties-Keyname	Azure Resource Manager	Terraform
Keyvaultproperties-Keyversion	Azure Resource Manager	Terraform
Keyvaultproperties-Keyvaulturi	Azure Resource Manager	Terraform

Network Acls-Bypass	Azure Resource Manager	Terraform
Virtual Network Rules-Id	Azure Resource Manager	Terraform
Virtual Network Rules-Action	Azure Resource Manager	Terraform
Virtual Network Rules-State	Azure Resource Manager	Terraform

Network Acls-Ip Rules	Azure Resource Manager	Terraform
Ip Rules-Value	Azure Resource Manager	Terraform
Ip Rules-Action	Azure Resource Manager	Terraform
Network Acls-Default Action	Azure Resource Manager	Terraform

Routing Preference-Routing Choice	Azure Resource Manager	Terraform
Routing Preference-Publish Microsoft Endpoints	Azure Resource Manager	Terraform
Routing Preference-Publish Internet Endpoints	Azure Resource Manager	Terraform

Cors	Azure Resource Manager
Cors Rules-Allowed Methods	Azure Resource Manager

Cors-Cors Rules	Azure Resource Manager
Cors Rules-Allowed Origins	Azure Resource Manager
Cors Rules-Max Age In Seconds	Azure Resource Manager
Cors Rules-Exposed Headers	Azure Resource Manager
Cors Rules-Allowed Headers	Azure Resource Manager

Delete Retention Policy-Enabled	Azure Resource Manager
Delete Retention Policy-Days	Azure Resource Manager

Azure Files Identity Based Authentication-Active Directory Properties	Azure Resource Manager	Terraform
Active Directory Properties-Domain Name	Azure Resource Manager	Terraform
Active Directory Properties-Net Bios Domain Name	Azure Resource Manager	Terraform
Active Directory Properties-Forest Name	Azure Resource Manager	Terraform
Active Directory Properties-Domain Guid	Azure Resource Manager	Terraform
Active Directory Properties-Domain Sid	Azure Resource Manager	Terraform
Active Directory Properties-Azure Storage Sid	Azure Resource Manager	Terraform

Name	Azure Resource Manager
Private Link Service Connection State-Status	Azure Resource Manager
Private Link Service Connection State-Description	Azure Resource Manager
Private Link Service Connection State-Action Required	Azure Resource Manager