你当前正在访问 Microsoft Azure Global Edition 技术文档网站。 如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

Set-AzStorageAccount

模块:

Az.Storage

修改存储帐户。

语法

Set-AzStorageAccount
   [-ResourceGroupName] <String>
   [-Name] <String>
   [-Force]
   [-SkuName <String>]
   [-AccessTier <String>]
   [-CustomDomainName <String>]
   [-UseSubDomain <Boolean>]
   [-Tag <Hashtable>]
   [-EnableHttpsTrafficOnly <Boolean>]
   [-StorageEncryption]
   [-AssignIdentity]
   [-UserAssignedIdentityId <String>]
   [-KeyVaultUserAssignedIdentityId <String>]
   [-KeyVaultFederatedClientId <String>]
   [-IdentityType <String>]
   [-NetworkRuleSet <PSNetworkRuleSet>]
   [-UpgradeToStorageV2]
   [-EnableAzureActiveDirectoryDomainServicesForFile <Boolean>]
   [-EnableLargeFileShare]
   [-PublishMicrosoftEndpoint <Boolean>]
   [-PublishInternetEndpoint <Boolean>]
   [-AllowBlobPublicAccess <Boolean>]
   [-MinimumTlsVersion <String>]
   [-AllowSharedKeyAccess <Boolean>]
   [-SasExpirationPeriod <TimeSpan>]
   [-KeyExpirationPeriodInDay <Int32>]
   [-AllowCrossTenantReplication <Boolean>]
   [-DefaultSharePermission <String>]
   [-PublicNetworkAccess <String>]
   [-ImmutabilityPeriod <Int32>]
   [-ImmutabilityPolicyState <String>]
   [-EnableSftp <Boolean>]
   [-EnableLocalUser <Boolean>]
   [-AllowedCopyScope <String>]
   [-AsJob]
   [-DefaultProfile <IAzureContextContainer>]
   [-RoutingChoice <String>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Set-AzStorageAccount
   [-ResourceGroupName] <String>
   [-Name] <String>
   [-Force]
   [-SkuName <String>]
   [-AccessTier <String>]
   [-CustomDomainName <String>]
   [-UseSubDomain <Boolean>]
   [-Tag <Hashtable>]
   [-EnableHttpsTrafficOnly <Boolean>]
   [-KeyvaultEncryption]
   -KeyName <String>
   [-KeyVersion <String>]
   -KeyVaultUri <String>
   [-AssignIdentity]
   [-UserAssignedIdentityId <String>]
   [-KeyVaultUserAssignedIdentityId <String>]
   [-KeyVaultFederatedClientId <String>]
   [-IdentityType <String>]
   [-NetworkRuleSet <PSNetworkRuleSet>]
   [-UpgradeToStorageV2]
   [-EnableAzureActiveDirectoryDomainServicesForFile <Boolean>]
   [-EnableLargeFileShare]
   [-PublishMicrosoftEndpoint <Boolean>]
   [-PublishInternetEndpoint <Boolean>]
   [-AllowBlobPublicAccess <Boolean>]
   [-MinimumTlsVersion <String>]
   [-AllowSharedKeyAccess <Boolean>]
   [-SasExpirationPeriod <TimeSpan>]
   [-KeyExpirationPeriodInDay <Int32>]
   [-AllowCrossTenantReplication <Boolean>]
   [-DefaultSharePermission <String>]
   [-PublicNetworkAccess <String>]
   [-ImmutabilityPeriod <Int32>]
   [-ImmutabilityPolicyState <String>]
   [-EnableSftp <Boolean>]
   [-EnableLocalUser <Boolean>]
   [-AllowedCopyScope <String>]
   [-AsJob]
   [-DefaultProfile <IAzureContextContainer>]
   [-RoutingChoice <String>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Set-AzStorageAccount
   [-ResourceGroupName] <String>
   [-Name] <String>
   [-Force]
   [-SkuName <String>]
   [-AccessTier <String>]
   [-CustomDomainName <String>]
   [-UseSubDomain <Boolean>]
   [-Tag <Hashtable>]
   [-EnableHttpsTrafficOnly <Boolean>]
   [-AssignIdentity]
   [-UserAssignedIdentityId <String>]
   [-KeyVaultUserAssignedIdentityId <String>]
   [-KeyVaultFederatedClientId <String>]
   [-IdentityType <String>]
   [-NetworkRuleSet <PSNetworkRuleSet>]
   [-UpgradeToStorageV2]
   [-EnableLargeFileShare]
   [-PublishMicrosoftEndpoint <Boolean>]
   [-PublishInternetEndpoint <Boolean>]
   [-EnableAzureActiveDirectoryKerberosForFile <Boolean>]
   [-ActiveDirectoryDomainName <String>]
   [-ActiveDirectoryDomainGuid <String>]
   [-AllowBlobPublicAccess <Boolean>]
   [-MinimumTlsVersion <String>]
   [-AllowSharedKeyAccess <Boolean>]
   [-SasExpirationPeriod <TimeSpan>]
   [-KeyExpirationPeriodInDay <Int32>]
   [-AllowCrossTenantReplication <Boolean>]
   [-DefaultSharePermission <String>]
   [-PublicNetworkAccess <String>]
   [-ImmutabilityPeriod <Int32>]
   [-ImmutabilityPolicyState <String>]
   [-EnableSftp <Boolean>]
   [-EnableLocalUser <Boolean>]
   [-AllowedCopyScope <String>]
   [-AsJob]
   [-DefaultProfile <IAzureContextContainer>]
   [-RoutingChoice <String>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Set-AzStorageAccount
   [-ResourceGroupName] <String>
   [-Name] <String>
   [-Force]
   [-SkuName <String>]
   [-AccessTier <String>]
   [-CustomDomainName <String>]
   [-UseSubDomain <Boolean>]
   [-Tag <Hashtable>]
   [-EnableHttpsTrafficOnly <Boolean>]
   [-AssignIdentity]
   [-UserAssignedIdentityId <String>]
   [-KeyVaultUserAssignedIdentityId <String>]
   [-KeyVaultFederatedClientId <String>]
   [-IdentityType <String>]
   [-NetworkRuleSet <PSNetworkRuleSet>]
   [-UpgradeToStorageV2]
   [-EnableLargeFileShare]
   [-PublishMicrosoftEndpoint <Boolean>]
   [-PublishInternetEndpoint <Boolean>]
   -EnableActiveDirectoryDomainServicesForFile <Boolean>
   [-ActiveDirectoryDomainName <String>]
   [-ActiveDirectoryNetBiosDomainName <String>]
   [-ActiveDirectoryForestName <String>]
   [-ActiveDirectoryDomainGuid <String>]
   [-ActiveDirectoryDomainSid <String>]
   [-ActiveDirectoryAzureStorageSid <String>]
   [-ActiveDirectorySamAccountName <String>]
   [-ActiveDirectoryAccountType <String>]
   [-AllowBlobPublicAccess <Boolean>]
   [-MinimumTlsVersion <String>]
   [-AllowSharedKeyAccess <Boolean>]
   [-SasExpirationPeriod <TimeSpan>]
   [-KeyExpirationPeriodInDay <Int32>]
   [-AllowCrossTenantReplication <Boolean>]
   [-DefaultSharePermission <String>]
   [-PublicNetworkAccess <String>]
   [-ImmutabilityPeriod <Int32>]
   [-ImmutabilityPolicyState <String>]
   [-EnableSftp <Boolean>]
   [-EnableLocalUser <Boolean>]
   [-AllowedCopyScope <String>]
   [-AsJob]
   [-DefaultProfile <IAzureContextContainer>]
   [-RoutingChoice <String>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

说明

Set-Az存储Account cmdlet 修改Azure 存储帐户。 可以使用此 cmdlet 修改帐户类型、更新客户域或设置存储帐户上的标记。

示例

示例 1：设置存储帐户类型

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -SkuName "Standard_RAGRS"

此命令将存储帐户类型设置为Standard_RAGRS。

示例 2：为存储帐户设置自定义域

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -CustomDomainName "www.contoso.com" -UseSubDomain $true

此命令为存储帐户设置自定义域。

示例 3：设置访问层值

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -AccessTier Cool

该命令将访问层值设置为冷。

示例 4：设置自定义域和标记

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -CustomDomainName "www.domainname.com" -UseSubDomain $true -Tag @{tag0="value0";tag1="value1";tag2="value2"}

该命令设置存储帐户的自定义域和标记。

示例 5：将加密密钥来源设置为 Keyvault

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -AssignIdentity
$account = Get-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount"

$keyVault = New-AzKeyVault -VaultName "MyKeyVault" -ResourceGroupName "MyResourceGroup" -Location "EastUS2"
$key = Add-AzKeyVaultKey -VaultName "MyKeyVault" -Name "MyKey" -Destination 'Software'
Set-AzKeyVaultAccessPolicy -VaultName "MyKeyVault" -ObjectId $account.Identity.PrincipalId -PermissionsToKeys wrapkey,unwrapkey,get

# In case to enable key auto rotation, don't set KeyVersion
Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -KeyvaultEncryption -KeyName $key.Name -KeyVersion $key.Version -KeyVaultUri $keyVault.VaultUri

# In case to enable key auto rotation after set keyvault proeprites with KeyVersion, can update account by set KeyVersion to empty
Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -KeyvaultEncryption -KeyName $key.Name -KeyVersion "" -KeyVaultUri $keyVault.VaultUri

此命令使用新创建的 Keyvault 设置 Encryption KeySource。 如果想要启用密钥自动轮换，请不要在首次设置 Keyvault 属性时设置 keyversion，或者通过将 keyvault 属性再次设置为空来清理它。

示例 6：将加密密钥来源设置为“Microsoft”。存储”

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -StorageEncryption

此命令将 Encryption KeySource 设置为“Microsoft”。存储”

示例 7：使用 JSON 设置存储帐户的 NetworkRuleSet 属性

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -NetworkRuleSet (@{bypass="Logging,Metrics";
    ipRules=(@{IPAddressOrRange="20.11.0.0/16";Action="allow"},
            @{IPAddressOrRange="10.0.0.0/7";Action="allow"});
    virtualNetworkRules=(@{VirtualNetworkResourceId="/subscriptions/s1/resourceGroups/g1/providers/Microsoft.Network/virtualNetworks/vnet1/subnets/subnet1";Action="allow"},
                        @{VirtualNetworkResourceId="/subscriptions/s1/resourceGroups/g1/providers/Microsoft.Network/virtualNetworks/vnet2/subnets/subnet2";Action="allow"});
    defaultAction="allow"})

此命令使用 JSON 设置存储帐户的 NetworkRuleSet 属性

示例 8：从存储帐户获取 NetworkRuleSet 属性，并将其设置为另一个存储帐户

$networkRuleSet = (Get-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount").NetworkRuleSet 
Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount2" -NetworkRuleSet $networkRuleSet

第一个命令从存储帐户获取 NetworkRuleSet 属性，第二个命令将其设置为另一个存储帐户

示例 9：将类型为“存储”或“Blob存储”的存储帐户升级到“存储V2”类型存储帐户

Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -UpgradeToStorageV2

该命令将类型为“存储”或“Blob存储”的存储帐户升级到“存储V2”类型存储帐户。

示例 10：通过启用 Azure 文件存储 Microsoft Entra 域服务身份验证并设置 DefaultSharePermission 来更新存储帐户。

$account = Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -EnableAzureActiveDirectoryDomainServicesForFile $true -DefaultSharePermission StorageFileDataSmbShareContributor

$account.AzureFilesIdentityBasedAuth

DirectoryServiceOptions ActiveDirectoryProperties                                                      DefaultSharePermission      
----------------------- -------------------------                                                      ----------------------      
AADDS                   Microsoft.Azure.Commands.Management.Storage.Models.PSActiveDirectoryProperties StorageFileDataSmbShareContributor

该命令通过启用Azure 文件存储 Microsoft Entra 域服务身份验证来更新存储帐户。

示例 11：通过启用文件Active Directory 域服务身份验证更新存储帐户，然后显示“基于文件标识的身份验证”设置

$account = Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -EnableActiveDirectoryDomainServicesForFile $true `
        -ActiveDirectoryDomainName "mydomain.com" `
        -ActiveDirectoryNetBiosDomainName "mydomain.com" `
        -ActiveDirectoryForestName "mydomain.com" `
        -ActiveDirectoryDomainGuid "12345678-1234-1234-1234-123456789012" `
        -ActiveDirectoryDomainSid "S-1-5-21-1234567890-1234567890-1234567890" `
        -ActiveDirectoryAzureStorageSid "S-1-5-21-1234567890-1234567890-1234567890-1234" `
        -ActiveDirectorySamAccountName "samaccountname" `
        -ActiveDirectoryAccountType Computer 
		
$account.AzureFilesIdentityBasedAuth.DirectoryServiceOptions
AD

$account.AzureFilesIdentityBasedAuth.ActiveDirectoryProperties

DomainName        : mydomain.com
NetBiosDomainName : mydomain.com
ForestName        : mydomain.com
DomainGuid        : 12345678-1234-1234-1234-123456789012
DomainSid         : S-1-5-21-1234567890-1234567890-1234567890
AzureStorageSid   : S-1-5-21-1234567890-1234567890-1234567890-1234
SamAccountName    : samaccountname
AccountType       : Computer

该命令通过启用Azure 文件存储 Active Directory 域服务身份验证来更新存储帐户，然后显示“基于文件标识的身份验证”设置

示例 12：设置 MinimumTlsVersion、AllowBlobPublicAccess 和 AllowSharedKeyAccess

$account = Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -MinimumTlsVersion TLS1_1 -AllowBlobPublicAccess $false -AllowSharedKeyAccess $true

$account.MinimumTlsVersion
TLS1_1

$account.AllowBlobPublicAccess
False

$a.AllowSharedKeyAccess
True

该命令设置 MinimumTlsVersion、AllowBlobPublicAccess 和 AllowSharedKeyAccess，然后显示帐户的 3 个属性

示例 13：使用 RoutingPreference 设置更新存储帐户

$account = Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -PublishMicrosoftEndpoint $false -PublishInternetEndpoint $true -RoutingChoice InternetRouting

$account.RoutingPreference

RoutingChoice   PublishMicrosoftEndpoints PublishInternetEndpoints
-------------   ------------------------- ------------------------
InternetRouting                     False                     True

$account.PrimaryEndpoints

Blob               : https://mystorageaccount.blob.core.windows.net/
Queue              : https://mystorageaccount.queue.core.windows.net/
Table              : https://mystorageaccount.table.core.windows.net/
File               : https://mystorageaccount.file.core.windows.net/
Web                : https://mystorageaccount.z2.web.core.windows.net/
Dfs                : https://mystorageaccount.dfs.core.windows.net/
MicrosoftEndpoints : 
InternetEndpoints  : {"Blob":"https://mystorageaccount-internetrouting.blob.core.windows.net/","File":"https://mystorageaccount-internetrouting.file.core.windows.net/","Web":"https://mystorageaccount-internetrouting.z2.web.core.windows.net/","Dfs":"https://w
                     eirp3-internetrouting.dfs.core.windows.net/"}

此命令使用 RoutingPreference 设置更新存储帐户：PublishMicrosoftEndpoint 为 false、PublishInternetEndpoint 为 true 和 RoutingChoice 作为 MicrosoftRouting。

示例 14：使用 KeyExpirationPeriod 和 SasExpirationPeriod 更新存储帐户

$account = Set-AzStorageAccount -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -KeyExpirationPeriodInDay 5 -SasExpirationPeriod "1.12:05:06" -EnableHttpsTrafficOnly $true

$account.KeyPolicy.KeyExpirationPeriodInDays
5

$account.SasPolicy.SasExpirationPeriod
1.12:05:06

此命令使用 KeyExpirationPeriod 和 SasExpirationPeriod 更新存储帐户，然后显示更新后的帐户相关属性。

示例 15：将存储帐户更新为 Keyvault 加密，并使用用户分配的标识访问 Keyvault

# Create KeyVault (no need if using exist keyvault)
$keyVault = New-AzKeyVault -VaultName $keyvaultName -ResourceGroupName $resourceGroupName -Location eastus2euap -EnablePurgeProtection
$key = Add-AzKeyVaultKey -VaultName $keyvaultName -Name $keyname -Destination 'Software'

# create user assigned identity and grant access to keyvault (no need if using exist user assigned identity)
$userId = New-AzUserAssignedIdentity -ResourceGroupName $resourceGroupName -Name $userIdName
Set-AzKeyVaultAccessPolicy -VaultName $keyvaultName -ResourceGroupName $resourceGroupName -ObjectId $userId.PrincipalId -PermissionsToKeys get,wrapkey,unwrapkey -BypassObjectIdValidation
$useridentityId= $userId.Id

# Update Storage account with Keyvault encryption and access Keyvault with user assigned identity, then show properties
$account = Set-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName `
                -IdentityType UserAssigned  -UserAssignedIdentityId $useridentityId  `
                -KeyVaultUri $keyVault.VaultUri -KeyName $keyname -KeyVaultUserAssignedIdentityId $useridentityId

$account.Encryption.EncryptionIdentity.EncryptionUserAssignedIdentity
/subscriptions/{subscription-id}/resourceGroups/myresourcegroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myuserid

$account.Encryption.KeyVaultProperties

KeyName                       : wrappingKey
KeyVersion                    : 
KeyVaultUri                   : https://mykeyvault.vault.azure.net:443
CurrentVersionedKeyIdentifier : https://mykeyvault.vault.azure.net/keys/wrappingKey/8e74036e0d534e58b3bd84b319e31d8f
LastKeyRotationTimestamp      : 4/12/2021 8:17:57 AM

此命令首先创建 keyvault 和用户分配的标识，然后使用 keyvault 加密更新存储帐户、具有用户分配标识的存储访问密钥保管库。

示例 16：从使用用户分配的标识访问 Keyvault 更新加密的 Keyvault 加密存储帐户，以使用系统分配的标识访问 Keyvault

# Assign System identity to the account, and give the system assigned identity acces to the keyvault
$account = Set-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName  -IdentityType SystemAssignedUserAssigned
Set-AzKeyVaultAccessPolicy -VaultName $keyvaultName -ResourceGroupName $resourceGroupName -ObjectId $account.Identity.PrincipalId -PermissionsToKeys get,wrapkey,unwrapkey -BypassObjectIdValidation

# Update account from access Keyvault with user assigned identity to access Keyvault with system assigned identity
$account = Set-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName -IdentityType SystemAssignedUserAssigned -KeyName $keyname -KeyVaultUri $keyvaultUri -KeyVaultUserAssignedIdentityId ""

# EncryptionUserAssignedIdentity is empty, so the account access keyvault with system assigned identity
$account.Encryption.EncryptionIdentity

EncryptionUserAssignedIdentity                                                                                                                 
------------------------------ 

$account.Encryption.KeyVaultProperties

KeyName                       : wrappingKey
KeyVersion                    : 
KeyVaultUri                   : https://mykeyvault.vault.azure.net:443
CurrentVersionedKeyIdentifier : https://mykeyvault.vault.azure.net/keys/wrappingKey/8e74036e0d534e58b3bd84b319e31d8f
LastKeyRotationTimestamp      : 4/12/2021 8:17:57 AM

此命令首先将系统标识分配给帐户，并为系统分配的标识授予对 keyvault 的访问权限;然后更新存储帐户，以使用系统分配的标识访问 Keyvault。

示例 17：更新 Keyvault 和用户分配的标识以访问 keyvault

# Update to another user assigned identity
$account = Set-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName -IdentityType SystemAssignedUserAssigned -UserAssignedIdentityId $useridentity2 -KeyVaultUserAssignedIdentityId $useridentity2

# Update to encrypt with another keyvault
$account = Set-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName -KeyVaultUri $keyvaultUri2 -KeyName $keyname2 -KeyVersion $keyversion2

此命令首先更新用户分配的标识以访问 keyvault，然后更新 keyvault 进行加密。 若要同时更新 Keyvault 和用户分配的标识，我们需要使用上述 2 个步骤进行更新。

示例 18：使用 AllowCrossTenantReplication 更新存储帐户

$account = Set-AzStorageAccount -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -AllowCrossTenantReplication $false -EnableHttpsTrafficOnly $true

$account.AllowCrossTenantReplication

False

此命令通过将 AllowCrossTenantReplication 设置为 false 来更新存储帐户，然后显示更新后的帐户相关属性。

示例 18：通过启用 PublicNetworkAccess 更新存储帐户

$account = Set-AzStorageAccount -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -PublicNetworkAccess Enabled

$account.PublicNetworkAccess

Enabled

此命令通过将 PublicNetworkAccess 设置为已启用来更新存储帐户。

示例 19：更新帐户级别不可变性策略

$account = Set-AzStorageAccount -ResourceGroupName "MyResourceGroup" -Name "mystorageaccount" -ImmutabilityPeriod 2 -ImmutabilityPolicyState Unlocked

$account.ImmutableStorageWithVersioning.Enabled
True

$account.ImmutableStorageWithVersioning.ImmutabilityPolicy

ImmutabilityPeriodSinceCreationInDays State    
------------------------------------- -----    
                                    2 Unlocked

该命令更新现有存储帐户上的帐户级不可变性策略属性，并显示结果。 必须使用版本控制启用帐户级别不可变性来创建存储帐户。 帐户级不可变性策略将继承并应用于对象级别不具有显式不可变性策略的对象。

示例 20：通过启用 Sftp 和 localuser 更新存储帐户

$account = Set-AzStorageAccount -ResourceGroupName "myresourcegroup" -AccountName "mystorageaccount" -EnableSftp $true -EnableLocalUser $true 

$account.EnableSftp
True

$account.EnableLocalUser
True

此命令通过启用 Sftp 和 localuser 更新存储帐户。 若要成功运行命令，存储帐户应已启用分层命名空间。

示例 21：使用另一个租户的 Keyvault 更新存储帐户（使用 FederatedClientId 访问 Keyvault）

# create Storage account with Keyvault encryption (access Keyvault with FederatedClientId), then show properties
$account = Set-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $storageAccountName  `
                -KeyVaultUri $keyVault.VaultUri -KeyName $keyname -KeyVaultUserAssignedIdentityId $useridentityId -KeyVaultFederatedClientId $federatedClientId

$account.Encryption.EncryptionIdentity

EncryptionUserAssignedIdentity                                                                                                      EncryptionFederatedIdentityClientId                                                                                                                 
------------------------------                                                                                                      ----------------------------------- 
/subscriptions/{subscription-id}/resourceGroups/myresourcegroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myuserid ********-****-****-****-************

$account.Encryption.KeyVaultProperties

KeyName                       : wrappingKey
KeyVersion                    : 
KeyVaultUri                   : https://mykeyvault.vault.azure.net:443
CurrentVersionedKeyIdentifier : https://mykeyvault.vault.azure.net/keys/wrappingKey/8e74036e0d534e58b3bd84b319e31d8f
LastKeyRotationTimestamp      : 3/3/2022 2:07:34 AM

此命令从另一个租户使用 Keyvault 更新存储帐户（使用 FederatedClientId 访问 Keyvault）。

参数

-AccessTier

指定此 cmdlet 修改的 存储 帐户的访问层。 此参数的可接受值为：热值和冷值。 如果更改访问层，则可能会导致额外费用。 有关详细信息，请参阅Azure Blob 存储：热存储层和冷存储层。 如果存储帐户的 Kind 为 存储V2 或 Blob存储，则可以指定 AccessTier 参数。 如果 存储 帐户具有 Kind 作为存储，请不要指定 AccessTier 参数。

Type:	String
Accepted values:	Hot, Cool
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectoryAccountType

指定Azure 存储的 Active Directory 帐户类型。 可能的值包括：“User”、“Computer”。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectoryAzureStorageSid

指定Azure 存储的安全标识符（SID）。 当 -EnableActiveDirectoryDomainServicesForFile 设置为 true 时，必须设置此参数。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectoryDomainGuid

指定域 GUID。 当 -EnableActiveDirectoryDomainServicesForFile 设置为 true 时，必须设置此参数。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectoryDomainName

指定 AD DNS 服务器权威的主域。 当 -EnableActiveDirectoryDomainServicesForFile 设置为 true 时，必须设置此参数。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectoryDomainSid

指定安全标识符（SID）。 当 -EnableActiveDirectoryDomainServicesForFile 设置为 true 时，必须设置此参数。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectoryForestName

指定要获取的 Active Directory 林。 当 -EnableActiveDirectoryDomainServicesForFile 设置为 true 时，必须设置此参数。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectoryNetBiosDomainName

指定 NetBIOS 域名。 当 -EnableActiveDirectoryDomainServicesForFile 设置为 true 时，必须设置此参数。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ActiveDirectorySamAccountName

为 Azure 存储 指定 Active Directory SAMAccountName。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-AllowBlobPublicAccess

允许或禁止匿名访问存储帐户中的所有 Blob 或容器。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-AllowCrossTenantReplication

获取或设置允许或禁止跨 Microsoft Entra 租户对象副本 (replica)。 此属性的默认解释为 true。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-AllowedCopyScope

设置对 Microsoft Entra 租户中存储帐户或专用链接到同一 VNet 的复制和从中复制。 可能的值包括：“PrivateLink”、“AAD”

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-AllowSharedKeyAccess

指示存储帐户是否允许通过共享密钥通过帐户访问密钥授权请求。 如果为 false，则必须使用 Microsoft Entra ID 授权所有请求（包括共享访问签名）。 默认值为 null，等效于 true。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-AsJob

在后台运行 cmdlet

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-AssignIdentity

为此存储帐户生成并分配新的存储帐户标识，以用于 Azure KeyVault 等密钥管理服务。

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Confirm

提示你在运行 cmdlet 之前进行确认。

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	False
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-CustomDomainName

指定自定义域的名称。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultProfile

用于与 Azure 通信的凭据、帐户、租户和订阅。

Type:	IAzureContextContainer
Aliases:	AzContext, AzureRmContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultSharePermission

如果未分配 RBAC 角色，则使用 Kerberos 身份验证的用户的默认共享权限。

Type:	String
Accepted values:	None, StorageFileDataSmbShareContributor, StorageFileDataSmbShareReader, StorageFileDataSmbShareElevatedContributor
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EnableActiveDirectoryDomainServicesForFile

为存储帐户启用Azure 文件存储 Active Directory 域服务身份验证。

Type:	Boolean
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-EnableAzureActiveDirectoryDomainServicesForFile

为存储帐户启用Azure 文件存储 Active Directory 域服务身份验证。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EnableAzureActiveDirectoryKerberosForFile

为存储帐户启用Azure 文件存储 Active Directory 域服务 Kerberos 身份验证。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EnableHttpsTrafficOnly

指示存储帐户是否仅启用 HTTPS 流量。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EnableLargeFileShare

指示存储帐户是否可以支持容量超过 5 TiB 的大型文件共享。 启用帐户后，无法禁用该功能。 目前仅支持 LRS 和 ZRS 副本 (replica) 类型，因此无法将帐户转换为异地冗余帐户。 若要了解详细信息，请访问 https://go.microsoft.com/fwlink/?linkid=2086047

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EnableLocalUser

为存储帐户启用本地用户功能。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EnableSftp

为存储帐户启用安全文件传输协议。

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Force

强制将更改写入存储帐户。

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IdentityType

设置新的存储帐户标识类型，idenetity 用于 Azure KeyVault 等密钥管理服务。

Type:	String
Accepted values:	SystemAssigned, UserAssigned, SystemAssignedUserAssigned, None
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ImmutabilityPeriod

自创建策略以来容器中 Blob 的不可变性时间段。 仅当使用“-EnableAccountLevelImmutability”创建帐户时，才能更改此属性。

Type:	Int32
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ImmutabilityPolicyState

策略的模式。 可能的值包括：“Unlocked”、“Locked”、“Disabled”。 禁用状态会禁用策略。 解锁状态允许增加和减少不可变保留时间，还允许切换 allowProtectedAppendWrites 属性。 锁定状态仅允许增加不可变保留时间。 策略只能在“已禁用”或“已解锁”状态下创建，并且可以在两种状态之间切换。 只有处于解锁状态的策略才能转换为无法还原锁定状态。 仅当使用“-EnableAccountLevelImmutability”创建帐户时，才能更改此属性。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-KeyExpirationPeriodInDay

此帐户的密钥到期期限，准确到天数。

Type:	Int32
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-KeyName

如果使用 -KeyvaultEncryption 启用密钥库加密，请使用此选项指定 Keyname 属性。

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-KeyvaultEncryption

指示在使用存储服务加密时是否对加密密钥使用 Microsoft KeyVault。 如果已设置 KeyName、KeyVersion 和 KeyVaultUri，则无论是否设置此参数，KeySource 都将设置为 Microsoft.Keyvault。

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-KeyVaultFederatedClientId

将多租户应用程序的 ClientId 与用户分配的标识一起使用，以便在存储帐户上进行跨租户客户管理的密钥服务器端加密。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-KeyVaultUri

通过指定 -KeyvaultEncryption 参数使用密钥库加密时，使用此选项指定密钥库的 URI。

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-KeyVaultUserAssignedIdentityId

为用于访问 存储 帐户加密的 Azure KeyVault 的用户分配标识设置资源 ID，该 ID 必须位于存储帐户的 UserAssignIdentityId 中。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-KeyVersion

通过指定 -KeyvaultEncryption 参数使用 密钥库 加密时，使用此选项指定密钥版本的 URI。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-MinimumTlsVersion

请求存储时允许的最低 TLS 版本。

Type:	String
Accepted values:	TLS1_0, TLS1_1, TLS1_2
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Name

指定要修改的存储帐户的名称。

Type:	String
Aliases:	StorageAccountName, AccountName
Position:	1
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-NetworkRuleSet

NetworkRuleSet 用于为防火墙和虚拟网络定义一组配置规则，以及为允许绕过规则的服务等网络属性设置值，以及如何处理与任何已定义规则不匹配的请求。

Type:	PSNetworkRuleSet
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-PublicNetworkAccess

允许或禁止公共网络访问 存储 Account.Possible 值包括：“Enabled”、“Disabled”。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-PublishInternetEndpoint

指示是否发布 Internet 路由存储终结点

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-PublishMicrosoftEndpoint

指示是否发布 Microsoft 路由存储终结点

Type:	Boolean
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ResourceGroupName

指定要在其中修改存储帐户的资源组的名称。

Type:	String
Position:	0
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-RoutingChoice

路由选择定义用户选择的网络路由类型。 可能的值包括：“MicrosoftRouting”、“InternetRouting”

Type:	String
Accepted values:	MicrosoftRouting, InternetRouting
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SasExpirationPeriod

此帐户的 SAS 到期期限，是时间跨度和精确到秒。

Type:	TimeSpan
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SkuName

指定存储帐户的 SKU 名称。 此参数的可接受值为：

• Standard_LRS - 本地冗余存储。
• Standard_ZRS - 区域冗余存储。
• Standard_GRS - 异地冗余存储。
• Standard_RAGRS - 读取访问权限异地冗余存储。
• 高级版_LRS - 高级版本地冗余存储。
• Standard_GZRS - 异地冗余区域冗余存储。
• Standard_RAGZRS - 读取访问异地冗余区域冗余存储。 不能将Standard_ZRS和高级版_LRS类型更改为其他帐户类型。 不能将其他帐户类型更改为Standard_ZRS或高级版_LRS。

Type:	String
Aliases:	StorageAccountType, AccountType, Type
Accepted values:	Standard_LRS, Standard_ZRS, Standard_GRS, Standard_RAGRS, Premium_LRS, Standard_GZRS, Standard_RAGZRS
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-StorageEncryption

指示是否将存储帐户加密设置为使用 Microsoft 管理的密钥。

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Tag

以哈希表的形式设置为服务器上的标记的键值对。 例如：@{key0=“value0”;key1=$null;key2=“value2”}

Type:	Hashtable
Aliases:	Tags
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-UpgradeToStorageV2

将 存储 帐户类型从 存储 或存储 Blob 升级到 存储V2。

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-UserAssignedIdentityId

为新的存储帐户用户分配的标识设置资源 ID，该标识将用于 Azure KeyVault 等密钥管理服务。

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-UseSubDomain

指示是否启用间接 CName 验证。

Type:	Nullable<T>[Boolean]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-WhatIf

显示运行该 cmdlet 时会发生什么情况。 cmdlet 未运行。

Type:	SwitchParameter
Aliases:	wi
Position:	Named
Default value:	False
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

输入

String

Hashtable

输出

PSStorageAccount

相关链接

• Get-AzStorageAccount
• New-AzStorageAccount
• Remove-Az存储Account