Storage Account Security

Access Keys

Every storage account has two 512-bit access keys (key1 and key2). These give full unrestricted access to everything in the storage account — all services, all containers, all data. Anyone with an access key can read, write, and delete everything.

Two keys exist so you can rotate one at a time without downtime — update your applications to use key2, then rotate key1, then switch back to key1, then rotate key2.

# List storage account keys
az storage account keys list \
  --account-name mystorageaccount2026 \
  --resource-group myResourceGroup

# Rotate key1
az storage account keys renew \
  --account-name mystorageaccount2026 \
  --resource-group myResourceGroup \
  --key key1

Azure AD Authentication

The recommended authentication method. Instead of using storage account keys, use Azure AD identities (users, service principals, managed identities) with RBAC roles:

Storage Firewall and Network Rules

By default, storage accounts accept connections from all networks. The storage firewall lets you restrict access to specific networks:

Firewall Options

• Allow all networks — Default, accessible from anywhere on internet
• Selected networks — Only specific VNets and IP ranges
• Disabled (private endpoint only) — No public internet access at all

# Deny all public access by default
az storage account update \
  --name mystorageaccount2026 \
  --resource-group myResourceGroup \
  --default-action Deny

# Allow a specific IP range
az storage account network-rule add \
  --account-name mystorageaccount2026 \
  --resource-group myResourceGroup \
  --ip-address 203.0.113.0/24

# Allow a specific VNet subnet
az storage account network-rule add \
  --account-name mystorageaccount2026 \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --subnet mySubnet

Private Endpoints

A Private Endpoint gives your storage account a private IP address within your VNet. Traffic between your VNet and the storage account travels over the Microsoft backbone — never over the public internet.

Encryption at Rest

All data in Azure Storage is encrypted at rest using AES-256 — automatically, by default, with no configuration required. You choose who manages the encryption keys:

Microsoft-Managed Keys (Default)

Azure manages the encryption keys automatically. No configuration needed. Suitable for most workloads.

Customer-Managed Keys (CMK)

You provide your own encryption keys stored in Azure Key Vault. You control key rotation and can revoke access by deleting the key. Required for some compliance frameworks (HIPAA, PCI-DSS).

Customer-Provided Keys

You provide the encryption key with every request — Azure never stores your key. Maximum control but complex to implement.

Secure Transfer (HTTPS Only)

Enable "Secure transfer required" to reject any HTTP connections — only HTTPS allowed. This should always be enabled for production accounts.

az storage account update \
  --name mystorageaccount2026 \
  --resource-group myResourceGroup \
  --https-only true

Microsoft Defender for Storage

Microsoft Defender for Storage provides threat detection for your storage accounts — it analyses access patterns and alerts you to suspicious activity:

• Access from unusual locations or Tor exit nodes
• Unusual data extraction (potential data exfiltration)
• Upload of malware or suspicious files
• Anonymous access to previously private data
• Brute-force attempts on access keys

Access Key Rotation

Access keys should be rotated regularly. Best practice:

• Rotate keys every 90 days (or per your security policy)
• Always rotate both keys over two cycles to avoid downtime
• Use Azure Key Vault to automate key rotation
• Store keys in Key Vault, not in application config files

Security Checklist