📝 Azure Managed Disk Data Access Auth Mode is not set to Azure Active Directory 🟢

• Contextual name: 📝 Managed Disk Data Access Auth Mode is not set to Azure Active Directory 🟢
• ID: /ce/ca/azure/virtual-machine/managed-disk-data-access-auth-mode
• Located in: 📁 Azure Virtual Machines

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Managed Disk
  • 🔌 Azure Managed Disk - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Data Access Authentication Mode provides a method of uploading or exporting Virtual Machine Disks.

Rationale

Enabling data access authentication mode adds a layer of protection using an Entra ID role to further restrict users from creating and using Secure Access Signature (SAS) tokens for exporting a detached managed disk or virtual machine state. Users will need the Data operator for managed disk role within Entra ID in order to download a VHD or VM Guest state using a secure URL.

Impact

In order to apply this setting, the virtual machine to which the disk or disks are attached will need to be powered down and have their disk detached. Users without the Data operator for managed disk role within Entra ID will not be able to export VHD or VM Guest state using the secure download URL.

Audit

From Azure Portal

Part A. Select the Virtual Machine to Evaluate

1. Using the search bar, search for and open the Virtual Machines service.
2. Click on the name of the Virtual Machine to be audited.

... see more

Remediation

Open File

Remediation

From Azure Portal

Part A. Select the Virtual Machine to Remediate

1. Using the search bar, search for and open the Virtual Machines service.
2. Click on the name of the Virtual Machine to be remediated.

Part B. Remediate each Virtual Machine Disk individually

1. From the selected Virtual Machine resource window, expand the Settings menu item and click Disks.
2. For each disk, click the name of the disk to open the disk resource window.
3. From the selected Disk resource window, expand the Settings menu item, and click Disk Export.

Check the checkbox next to Enable Data Access Authentication Mode.

Repeat Part B for each Disk attached to a VM.

Repeat Parts A and B to remediate all Disks in all VMs.

From Azure CLI

Ensure that each disk is detached from its associated Virtual Machine before proceeding. Once detached, run the following for each disk:

az disk update --name <disk_name> --resource-group <resource_group_name> --data-access-auth-mode AzureActiveDirectory

From PowerShell

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v3.0.0 → 💼 8.6 Ensure that 'Enable Data Access Authentication Mode' is 'Checked' (Automated)			1
💼 Cloudaware Framework → 💼 Secure Access			43