Security Best Practices¶

Use these practices to reduce unnecessary exposure in Azure Storage and keep access decisions auditable.

This page's baseline at a glance — the recommended practices and the validation gate:

mermaid flowchart TD T["Security Best Practices"] P1["Make Microsoft Entra ID and RBAC the default"] T --> P1 P2["Treat SAS as a short-lived exception with narrow"] T --> P2 P3["Disable unnecessary public access paths and validate private"] T --> P3 P4["Turn on diagnostics before data is onboarded"] T --> P4 P5["Review encryption posture together with network and identity"] T --> P5 V["Validation Checklist"] P1 --> V P2 --> V P3 --> V P4 --> V P5 --> V

Why This Matters¶

Storage accounts concentrate valuable data, so weak defaults quickly become broad blast-radius problems.

• Shared Key and broad SAS links are hard to track and revoke.
• Public network exposure increases exfiltration risk.
• Missing telemetry turns simple incidents into lengthy investigations.

Recommended Practices¶

• Make Microsoft Entra ID and RBAC the default for people and automation.
• Treat SAS as a short-lived exception with narrow scope and expiry.
• Disable unnecessary public access paths and validate private connectivity.
• Turn on diagnostics before data is onboarded.
• Review encryption posture together with network and identity posture.

Example review commands¶

az storage account show \
    --resource-group $RG \
    --name $STORAGE_NAME \
    --query "{publicNetworkAccess:publicNetworkAccess,allowBlobPublicAccess:allowBlobPublicAccess,allowSharedKeyAccess:allowSharedKeyAccess,minimumTlsVersion:minimumTlsVersion}" \
    --output json

az monitor diagnostic-settings list \
    --resource $(az storage account show --resource-group $RG --name $STORAGE_NAME --query id --output tsv) \
    --output json

Common Mistakes / Anti-Patterns¶

• Shared Key kept as the default: Convenience today becomes invisible long-lived risk later.
• Security without evidence: Claims about secure posture are weak if logs and metrics are disabled.
• Encryption discussed alone: Key management choices should be reviewed with identity and network controls, not in isolation.

Validation Checklist¶

• [ ] Microsoft Entra ID and RBAC are preferred over Shared Key.
• [ ] Public access posture is reviewed and justified.
• [ ] Diagnostic settings are enabled or an exception is documented.
• [ ] SAS issuance rules are short-lived and least-privilege.
• [ ] Encryption posture is reviewed with the wider access model.

See Also¶

• Networking Best Practices
• Common Anti-Patterns
• Blob Best Practices

Sources¶

• Security recommendations for Blob Storage
• Security guide for Azure Storage