#storageaccount — Public Fediverse posts

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

TIL disabling public access to a storage account does not disable all public access in certain scenarios:
"By design, access to a storage account from trusted services takes the highest precedence over other network access restrictions. If you set **Public network access** to **Disabled** after previously setting it to **Enabled from selected virtual networks and IP addresses**, any resource instances and exceptions that you previously configured, including Allow Azure services on the trusted services list to access this storage account, will remain in effect. As a result, those resources and services might still have access to the storage account."

Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#restrictions-and-considerations

The settings for 'resource instances' and 'exceptions' can be seen in attached screenshot.

Unfortunately, these settings are not visible any more once Public network access is set to disabled, which is why it is easy to miss this configuration. This azure resource graph query can help finding storage accounts that have public network access disabled but still allow Azure services and/or resource types:
```
resources
| where type =~ 'Microsoft.Storage/storageAccounts'
| where properties.publicNetworkAccess =~ 'Disabled'
| where (array_length(properties.networkAcls.resourceAccessRules) > 0
or properties.networkAcls.bypass =~ 'AzureServices')
```
#azure #storageaccount #resourcegraph

𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐢𝐧𝐠 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐟𝐨𝐫 𝐂𝐥𝐨𝐮𝐝 𝐋𝐚𝐛𝐬

Our labs project help you get ramped up with Microsoft Defender for Cloud and provide hands-on practical experience for product features, capabilities, and scenarios. The labs are divided into 3 main tracks, a beginner (level 100/200) and an advanced (level 300+) track. The labs contain several modules cover different pillars such as Cloud Security Posture Management (CSPM) to Cloud Workload Protection (CWP). To start using our labs, you will need to create Azure Trial Subscription which provides you all capabilities for 30 days – so you have to finish this lab at this point to take advantage of the free trial.

https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Labs

#defender #defenderforcloud #cnapp #cspm #cwp #cwpp #cloudsecurity #multicloud #azure #aws #gcp #microsoft #microsoftsecurity #soc #server #container #storage #dns #api #devops #database #api #github #arc #agentless #storageaccount #mde #vulnerability #mdvm #siem

𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐢𝐧𝐠 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐟𝐨𝐫 𝐂𝐥𝐨𝐮𝐝 𝐋𝐚𝐛𝐬

Our labs project help you get ramped up with Microsoft Defender for Cloud and provide hands-on practical experience for product features, capabilities, and scenarios. The labs are divided into 3 main tracks, a beginner (level 100/200) and an advanced (level 300+) track. The labs contain several modules cover different pillars such as Cloud Security Posture Management (CSPM) to Cloud Workload Protection (CWP). To start using our labs, you will need to create Azure Trial Subscription which provides you all capabilities for 30 days – so you have to finish this lab at this point to take advantage of the free trial.

https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Labs

#defender #defenderforcloud #cnapp #cspm #cwp #cwpp #cloudsecurity #multicloud #azure #aws #gcp #microsoft #microsoftsecurity #soc #server #container #storage #dns #api #devops #database #api #github #arc #agentless #storageaccount #mde #vulnerability #mdvm #siem

𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐢𝐧𝐠 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐟𝐨𝐫 𝐂𝐥𝐨𝐮𝐝 𝐋𝐚𝐛𝐬

Our labs project help you get ramped up with Microsoft Defender for Cloud and provide hands-on practical experience for product features, capabilities, and scenarios. The labs are divided into 3 main tracks, a beginner (level 100/200) and an advanced (level 300+) track. The labs contain several modules cover different pillars such as Cloud Security Posture Management (CSPM) to Cloud Workload Protection (CWP). To start using our labs, you will need to create Azure Trial Subscription which provides you all capabilities for 30 days – so you have to finish this lab at this point to take advantage of the free trial.

https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Labs

#defender #defenderforcloud #cnapp #cspm #cwp #cwpp #cloudsecurity #multicloud #azure #aws #gcp #microsoft #microsoftsecurity #soc #server #container #storage #dns #api #devops #database #api #github #arc #agentless #storageaccount #mde #vulnerability #mdvm #siem

𝗛𝗼𝘄 𝘁𝗼 𝘀𝗲𝗰𝘂𝗿𝗲 𝗮 𝗙𝘂𝗻𝗰𝘁𝗶𝗼𝗻 𝗔𝗽𝗽?

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚘̲𝚙̲𝚎̲𝚛̲𝚊̲𝚝̲𝚒̲𝚘̲𝚗̲

➡️Defender for Cloud for assessment of potential configuration-related security vulnerabilities

➡️Log and monitor: diagnostic settings to configure streaming export of platform logs and metrics

➡️Require HTTPS

➡️Securing keys with Azure key Vault

➡️Enable App Service Authentication/Authorization

➡️Use Azure API Management (APIM) to authenticate requests

➡️Run your function app with the lowest possible permissions

➡️Store data encrypted

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚍̲𝚎̲𝚙̲𝚕̲𝚘̲𝚢̲𝚖̲𝚎̲𝚗̲𝚝̲

➡️Disable FTP

➡️Secure the scm endpoint

𝙽̲𝚎̲𝚝̲𝚠̲𝚘̲𝚛̲𝚔̲ ̲𝚜̲𝚎̲𝚌̲𝚞̲𝚛̲𝚒̲𝚝̲𝚢̲

➡️Set access restrictions

➡️Secure the storage account

➡️Private site access with Azure Private Endpoint

➡️Deploy your function app in isolation configuring a Web Application Firewall (WAF) for App Service Environment.

More details: https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4

#security #azure #cloud #data #management #streaming #functionapp #serverless #waf #appservice #privateendpoint #networksecurity #securedeployment #apim #ftp #keyvault #key #vulnerability #assessment #misconfiguration #encryption #storage #storageaccount #defender #defenderforcloud #cnapp #cspm #cwpp #microsoft #microsoftsecurity #cloudsecurity #cloudnative #siem #monitoring #soc

𝗛𝗼𝘄 𝘁𝗼 𝘀𝗲𝗰𝘂𝗿𝗲 𝗮 𝗙𝘂𝗻𝗰𝘁𝗶𝗼𝗻 𝗔𝗽𝗽?

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚘̲𝚙̲𝚎̲𝚛̲𝚊̲𝚝̲𝚒̲𝚘̲𝚗̲

➡️Defender for Cloud for assessment of potential configuration-related security vulnerabilities

➡️Log and monitor: diagnostic settings to configure streaming export of platform logs and metrics

➡️Require HTTPS

➡️Securing keys with Azure key Vault

➡️Enable App Service Authentication/Authorization

➡️Use Azure API Management (APIM) to authenticate requests

➡️Run your function app with the lowest possible permissions

➡️Store data encrypted

𝚂̲𝚎̲𝚌̲𝚞̲𝚛̲𝚎̲ ̲𝚍̲𝚎̲𝚙̲𝚕̲𝚘̲𝚢̲𝚖̲𝚎̲𝚗̲𝚝̲

➡️Disable FTP

➡️Secure the scm endpoint

𝙽̲𝚎̲𝚝̲𝚠̲𝚘̲𝚛̲𝚔̲ ̲𝚜̲𝚎̲𝚌̲𝚞̲𝚛̲𝚒̲𝚝̲𝚢̲

➡️Set access restrictions

➡️Secure the storage account

➡️Private site access with Azure Private Endpoint

➡️Deploy your function app in isolation configuring a Web Application Firewall (WAF) for App Service Environment.

More details: https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4

#security #azure #cloud #data #management #streaming #functionapp #serverless #waf #appservice #privateendpoint #networksecurity #securedeployment #apim #ftp #keyvault #key #vulnerability #assessment #misconfiguration #encryption #storage #storageaccount #defender #defenderforcloud #cnapp #cspm #cwpp #microsoft #microsoftsecurity #cloudsecurity #cloudnative #siem #monitoring #soc

So, here is a #PowerShell #ResourceGraph query to list all storage accounts and their #allowSharedKeyAccess settings:

Search-AzGraph -Query "resources | where type =~ 'Microsoft.Storage/storageAccounts' | extend allowSharedKeyAccess = parse_json(properties).allowSharedKeyAccess | project subscriptionId, resourceGroup, name, allowSharedKeyAccess"

#Azure #StorageAccount #SharedKeyAccess

Ref: https://learn.microsoft.com/en-gb/azure/storage/common/shared-key-authorization-prevent

So, here is a #PowerShell #ResourceGraph query to list all storage accounts and their #allowSharedKeyAccess settings:

Search-AzGraph -Query "resources | where type =~ 'Microsoft.Storage/storageAccounts' | extend allowSharedKeyAccess = parse_json(properties).allowSharedKeyAccess | project subscriptionId, resourceGroup, name, allowSharedKeyAccess"

#Azure #StorageAccount #SharedKeyAccess

Ref: https://learn.microsoft.com/en-gb/azure/storage/common/shared-key-authorization-prevent

So, here is a #PowerShell #ResourceGraph query to list all storage accounts and their #allowSharedKeyAccess settings:

Search-AzGraph -Query "resources | where type =~ 'Microsoft.Storage/storageAccounts' | extend allowSharedKeyAccess = parse_json(properties).allowSharedKeyAccess | project subscriptionId, resourceGroup, name, allowSharedKeyAccess"

#Azure #StorageAccount #SharedKeyAccess

Ref: https://learn.microsoft.com/en-gb/azure/storage/common/shared-key-authorization-prevent

[Share] Change how a #Azure #storageaccount is replicated! How to change the replication setting(s) for an existing storage account. Change LRS to ZRS etc., without opening a Microsoft Support case!
https://learn.microsoft.com/azure/storage/common/redundancy-migration?tabs=portal&WT.mc_id=AZ-MVP-5004796#replication-change-table

[Share] Change how a #Azure #storageaccount is replicated! How to change the replication setting(s) for an existing storage account. Change LRS to ZRS etc., without opening a Microsoft Support case!
https://learn.microsoft.com/azure/storage/common/redundancy-migration?tabs=portal&WT.mc_id=AZ-MVP-5004796#replication-change-table

A Look at Different Options for Storing and Searching Sentinel Archived Logs.

Options available for storing and searching Sentinel logs beyond the retention period:

1. Azure Data Explorer (ADX) - recommended for users who need to frequently query the data

2. Retention and Archive Policies in Log Analytics Workspaces - recommended for users that want to query the data on occasion

3. Exporting Data to an Azure Storage Account - recommended for users who rarely need to perform queries on the data or have specific querying needs

4. Storage account export via Logic Apps - recommended for users who rarely need to perform queries on the data and have their storage account set in a different region than their log analytics workspace

Learn more here:

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/a-look-at-different-options-for-storing-and-searching-sentinel/ba-p/3713698

#azure #analytics #data #export #microsoft #microsoftsentinel #sentinel #siem #soar #loganalytics #logicapp #adx #AzureDataExplorer #storage #storageaccount #kql #archive #analytics #basic #log #restore #retention #cloud #multicloud #soc #compliance #hunting