Skip to main content

🛡️ Azure Storage Account Cross Tenant Replication is enabled🟢

Stats​

not available

Logic​

Similar Policies​

  • Internal: dec-x-397dd59e

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-397dd59e1

Description​

Open File

Description​

Cross Tenant Replication in Azure allows data to be replicated across multiple Azure tenants. While this feature can be beneficial for data sharing and availability, it also poses a significant security risk if not properly managed. Unauthorized data access, data leakage, and compliance violations are potential risks. Disabling Cross Tenant Replication ensures that data is not inadvertently replicated across different tenant boundaries without explicit authorization.

Rationale​

Disabling Cross Tenant Replication minimizes the risk of unauthorized data access and ensures that data governance policies are strictly adhered to. This control is especially critical for organizations with stringent data security and privacy requirements, as it prevents the accidental sharing of sensitive information.

Impact​

Disabling Cross Tenant Replication may affect data availability and sharing across different Azure tenants. Ensure that this change aligns with your organizational data sharing and availability requirements.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Go to Storage Accounts.
  2. For each storage account, under Data management, click Object replication.
  3. Click Advanced settings.
  4. Uncheck Allow cross-tenant replication.
  5. Click OK.

From Azure CLI​

Replace the information within {{}} with appropriate values:

az storage account update \
    --name {{storage-account-name}} \
    --resource-group {{resource-group-name}} \
    --allow-cross-tenant-replication false

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v2.1.0 → 💼 3.16 Ensure 'Cross Tenant Replication' is not enabled - Level 1 (Automated)11no data
💼 CIS Azure v3.0.0 → 💼 4.16 Ensure 'Cross Tenant Replication' is not enabled (Automated)1no data
💼 CIS Azure v4.0.0 → 💼 10.3.8 Ensure 'Cross Tenant Replication' is not enabled (Automated)1no data
💼 CIS Azure v5.0.0 → 💼 9.3.7 Ensure 'Cross Tenant Replication' is not enabled (Automated)1no data
💼 CIS Azure v6.0.0 → 💼 9.3.7 Ensure 'Cross Tenant Replication' is Not Enabled (Automated)1no data
💼 Cloudaware Framework → 💼 Data Protection and Recovery26no data
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)49103no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)18141no data
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)103no data
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)103no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)141no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties199no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage165no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-3 Access Enforcement15866no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows83141no data
💼 UK Cyber Essentials → 💼 2.1.5 Ensure users are authenticated before allowing them access to organizational data or services44no data