List of storage accounts with SAS authentication enabled

Question

List of storage accounts with SAS authentication enabled

Maheswaran Ramu 0

What is the KQL or Az command or Powershell script to list the all SAS authentication enabled Storage accounts from all the subscriptions in my account? or any other way to get the same..

Sumarigo-MSFT 47,466 Reputation points Microsoft Employee Moderator

2023-05-19T09:23:43.48+00:00

@Maheswaran Ramu Just checking in to see if the above answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Sumarigo-MSFT 47,466 Reputation points Microsoft Employee Moderator

2023-05-22T09:01:48.43+00:00

@Maheswaran Ramu Just checking in to see if the above answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Your answer

Sumarigo-MSFT 47,466 Reputation points Microsoft Employee Moderator

2023-05-19T09:23:43.48+00:00

@Maheswaran Ramu Just checking in to see if the above answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Sumarigo-MSFT 47,466 Reputation points Microsoft Employee Moderator

2023-05-22T09:01:48.43+00:00

@Maheswaran Ramu Just checking in to see if the above answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

AirGordon 7,150

It's not possible to audit the generation of SAS tokens. Any user that has privileges to generate a SAS token, either by using the account key, or via an Azure role assignment, can do so without the knowledge of the owner of the storage account. Be careful to restrict permissions that allow users to generate SAS tokens. To prevent users from generating a SAS that is signed with the account key for blob and queue workloads, you can disallow Shared Key access to the storage account. For more information, see Prevent authorization with Shared Key.

ref: https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview#how-a-shared-access-signature-works

If you're concerned about a compromised SAS or have other concerns - check the Best Practice guidance : https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview#best-practices-when-using-sas

Maheswaran Ramu 0 Reputation points

2023-05-18T23:48:00.6266667+00:00
@AirGordon Aplogise if my question was not clear. Let me rephrase the question. I actually want to find all the SAS enabled storage accounts(1000 of them across different subscriptions) and disable them and give managed identity or service principal based access to the same storage accounts.
AirGordon 7,150 Reputation points

2023-05-19T14:13:45.5166667+00:00

Thanks for explaining, it should be easy to find them using Resource Graph and filtering on the storage account property for "Allow storage account key access". I'll try and find time to put a sample together.
Maheswaran, Ramu 0 Reputation points

2023-05-24T12:49:47.9133333+00:00

Any update @AirGordon ?

Share via

List of storage accounts with SAS authentication enabled

1 answer

Your answer