If the 'AllowSharedKeyAccess' property is disabled for a storage account, will that still require the access keys to be rotated periodically?

Question

So we have multiple storage accounts and we are currently switching our apps from access keys to managed identity for storage account authorization.

I need to understand if even after making this switch and setting the 'AllowSharedKeyAccess' property as disabled, do we still need to rotate the access keys on a periodic basis?

Answer 1

Hello Sarish Sayyed (INFOSYS LIMITED),

Greetings! Welcome to Microsoft Q&A Platform.

When you create a storage account, Azure generates two 512-bit storage account access keys for that account. These keys can be used to authorize access to data in your storage account via Shared Key authorization, or via SAS tokens that are signed with the shared key.

Microsoft recommends that you use Azure Key Vault to manage your access keys, and that you regularly rotate and regenerate your keys. Using Azure Key Vault makes it easy to rotate your keys without interruption to your applications.

Even with managed identity, it’s still a good idea to periodically rotate and regenerate your keys. This helps mitigate the risk of compromised keys.To prevent users from accessing data in your storage account with Shared Key, you can disallow Shared Key authorization for the storage account. Granular access to data with least privileges necessary is recommended as a security best practice.

To rotate keys using a user-managed identity, assign the “Storage Account Key Operator” role to the managed identity. This role allows the identity to list and regenerate keys on the selected storage account and follow the least privilege model when assigning roles.

In summary, while managed identity improves security, regular key rotation remains a best practice to enhance overall security and reduce risks associated with compromised keys.

refer - https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#next-steps for detailed guidance.

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.