Project: KICS (Provisioning / Security & Compliance)
File: e25b56cd-a4d6-498f-ab92-e6296a082097.md

title: Trusted Microsoft Services Not Enabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e25b56cd-a4d6-498f-ab92-e6296a082097 Query name: Trusted Microsoft Services Not Enabled Platform: AzureResourceManager Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Trusted Microsoft Services should be enabled for Storage Account access<br> ```json title="Positive test num. 1 - json file" hl_lines="21" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "bypass": "None", "virtualNetworkRules": [ { "id": "id", "action": "Allow" }, { "id": "id", "action": "Allow" } ], "defaultAction": "Deny" } }, "resources": [ ] } ], "outputs": {} } ``` ```json title="Positive test num. 2 - json file" hl_lines="21" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "bypass": "None", "defaultAction": "Deny" } }, "resources": [ ] } ], "outputs": {} } ``` ```json title="Positive test num. 3 - json file" hl_lines="23" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "bypass": "None", "virtualNetworkRules": [ { "id": "id", "action": "Allow" }, { "id": "id", "action": "Allow" } ], "defaultAction": "Deny" } }, "resources": [ ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="23" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type":

"apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "bypass": "None", "defaultAction": "Deny" } }, "resources": [ ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "virtualNetworkRules": [ { "id": "id", "action": "Allow" }, { "id": "id", "action": "Allow" } ], "defaultAction": "Allow" } }, "resources": [ ] } ], "outputs": {} } ``` ```json title="Negative test num. 2 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "bypass": "AzureServices", "virtualNetworkRules": [ { "id": "id", "action": "Allow" }, { "id": "id", "action": "Allow" } ], "defaultAction": "Deny" } }, "resources": [ ] } ], "outputs": {} } ``` ```json title="Negative test num. 3 - json file" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "virtualNetworkRules": [ { "id": "id", "action": "Allow" }, { "id": "id", "action": "Allow" } ], "defaultAction": "Allow" } }, "resources": [ ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "type": "Microsoft.Storage/storageAccounts", "apiVersion": "2019-06-01", "name": "storage", "location": "location1", "sku": { "name": "Standard_LRS", "tier": "Standard" }, "kind": "StorageV2", "properties": { "accessTier": "Hot", "networkAcls": { "bypass": "AzureServices", "virtualNetworkRules": [ { "id": "id", "action": "Allow" }, { "id": "id", "action": "Allow" } ], "defaultAction": "Deny" } }, "resources": [ ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details>