Prevent object replication across Microsoft Entra tenants

Object replication asynchronously copies block blobs from a container in one storage account to a container in another storage account. When you configure an object replication policy, you specify the source account and container and the destination account and container. After the policy is configured, Azure Storage automatically copies the results of create, update, and delete operations on a source object to the destination object. For more information about object replication in Azure Storage, see Object replication for block blobs.

An authorized user can configure an object replication policy where the source account is in one Microsoft Entra tenant and the destination account is in a different tenant if cross tenant replication is allowed across Microsoft Entra tenants. If your security policies require that you restrict object replication to storage accounts that reside within the same tenant only, you can disallow the creation of policies where the source and destination accounts are in different tenants. By default, cross-tenant object replication is disabled for all new storage accounts created after Dec 15, 2023, unless you explicitly allow it.

This article describes how to remediate cross-tenant object replication for your storage accounts. It also describes how to create policies to enforce a prohibition on cross-tenant object replication for new and existing storage accounts.

For more information on how to configure object replication policies, including cross-tenant policies, see Configure object replication for block blobs.

Remediate cross-tenant object replication

To prevent object replication across Microsoft Entra tenants, set the AllowCrossTenantReplication property for the storage account to false. If a storage account does not currently participate in any cross-tenant object replication policies, then setting the AllowCrossTenantReplication property to false prevents future configuration of cross-tenant object replication policies with this storage account as the source or destination. However, if a storage account currently participates in one or more cross-tenant object replication policies, then setting the AllowCrossTenantReplication property to false is not permitted until you delete the existing cross-tenant policies.

Cross-tenant policies are not permitted by default for a storage account created after Dec 15, 2023. However, the AllowCrossTenantReplication property was not set by default for an existing storage account created before Dec 15, 2023, and does not return a value until you had explicitly set it. The storage account can participate in object replication policies across tenants when the property value is either null or true for accounts created prior to Dev 15, 2023. For accounts created after that time, the property needs to be set to true. Setting the AllowCrossTenantReplication property does not incur any downtime on the storage account.

Remediate cross-tenant replication for a new account

To disallow cross-tenant replication for a new storage account, use the Azure portal, PowerShell, or Azure CLI. The property defaults to false for new accounts created after Dec 15, 2023, even when not set explicitly.

$rgName = "<resource-group>"
$accountName = "<storage-account>"
$location = "<location>"

# Create a storage account and disallow cross-tenant replication.
New-AzStorageAccount -ResourceGroupName $rgName `
    -Name $accountName `
    -Location $location `
    -SkuName Standard_LRS `
    -AllowBlobPublicAccess $false `
    -AllowCrossTenantReplication $false

# Read the property for the new storage account
(Get-AzStorageAccount -ResourceGroupName $rgName -Name $accountName).AllowCrossTenantReplication

# Create a storage account with cross-tenant replication disallowed.
az storage account create \
    --name <storage-account> \
    --resource-group <resource-group> \
    --location <location> \
    --sku Standard_LRS \
    --allow-blob-public-access false \
    --allow-cross-tenant-replication false

# Read the property for the new storage account
az storage account show \
    --name <storage-account> \
    --resource-group <resource-group> \
    --query allowCrossTenantReplication \
    --output tsv

Remediate cross-tenant replication for an existing account

To disallow cross-tenant replication for an existing storage account, use the Azure portal, PowerShell, or Azure CLI.

$rgName = "<resource-group>"
$accountName = "<storage-account>"

Set-AzStorageAccount -ResourceGroupName $rgName `
    -AccountName $accountName `
    -AllowCrossTenantReplication $false

az storage account update \
    --name <storage-account> \
    --resource-group <resource-group> \
    --allow-cross-tenant-replication false

After you disallow cross-tenant replication, attempting to configure a cross-tenant policy with the storage account as the source or destination fails. Azure Storage returns an error indicating that cross-tenant object replication is not permitted for the storage account.

When cross-tenant object replication is disallowed for a storage account, then any new object replication policies that you create with that account must include the full Azure Resource Manager IDs for the source and destination account. Azure Storage requires the full resource ID to verify whether the source and destination accounts reside within the same tenant. For more information, see Specify full resource IDs for the source and destination accounts.

The AllowCrossTenantReplication property is supported for storage accounts that use the Azure Resource Manager deployment model only. Aby uzyskać informacje o tym, które konta magazynu korzystają z modelu wdrażania usługi Azure Resource Manager, zobacz Typy kont magazynu.

Permissions for allowing or disallowing cross-tenant replication

To set the AllowCrossTenantReplication property for a storage account, a user must have permissions to create and manage storage accounts. Role kontroli dostępu opartej na rolach (RBAC) platformy Azure, które zapewniają te uprawnienia, obejmują akcję Microsoft.Storage/storageAccounts/write lub Microsoft.Storage/storageAccounts/* . Built-in roles with this action include:

• Rola właściciela w usłudze Azure Resource Manager
• Rola kontrybutora w usłudze Azure Resource Manager
• The Storage Account Contributor role

These roles do not provide access to data in a storage account via Microsoft Entra ID. Obejmują one jednak usługę Microsoft.Storage/storageAccounts/listkeys/action, która udziela dostępu do kluczy dostępu do konta. Za pomocą tego uprawnienia użytkownik może użyć kluczy dostępu do konta, aby uzyskać dostęp do wszystkich danych w koncie magazynowym.

Role assignments must be scoped to the level of the storage account or higher to permit a user to allow or disallow cross-tenant object replication for the storage account. Aby uzyskać więcej informacji na temat zakresu ról, zobacz Zrozumienie zakresu dla Azure RBAC.

Be careful to restrict assignment of these roles only to those who require the ability to create a storage account or update its properties. Użyj zasady najniższych uprawnień, aby upewnić się, że użytkownicy mają najmniejsze uprawnienia, których potrzebują do wykonania swoich zadań. Aby uzyskać więcej informacji na temat zarządzania dostępem za pomocą kontroli dostępu opartej na rolach platformy Azure, zobacz Najlepsze rozwiązania dotyczące kontroli dostępu opartej na rolach platformy Azure.

Use Azure Policy to audit for compliance

If you have a large number of storage accounts, you may want to perform an audit to make sure that those accounts are configured to prevent cross-tenant object replication. To audit a set of storage accounts for their compliance, use Azure Policy. Azure Policy to usługa, której można użyć do tworzenia, przypisywania i zarządzania zasadami, które stosują reguły do zasobów platformy Azure. Usługa Azure Policy pomaga zachować zgodność tych zasobów ze standardami firmowymi i umowami dotyczącymi poziomu usług. Aby uzyskać więcej informacji, zobacz Omówienie usługi Azure Policy.

Create a policy with an Audit effect

Usługa Azure Policy obsługuje efekty, które określają, co się stanie, gdy reguła zasad jest oceniana względem zasobu. The Audit effect creates a warning when a resource is not in compliance, but does not stop the request. Aby uzyskać więcej informacji na temat efektów, zobacz Omówienie efektów usługi Azure Policy.

To create a policy with an Audit effect for the cross-tenant object replication setting for a storage account with the Azure portal, follow these steps:

1. W portalu Azure przejdź do usługi Azure Policy.

2. W sekcji Tworzenie wybierz pozycję Definicje.

3. Wybierz pozycję Dodaj definicję zasad, aby utworzyć nową definicję zasad.

4. W polu Lokalizacja definicji wybierz przycisk Więcej, aby określić, gdzie znajduje się zasób zasad inspekcji.

5. Określ nazwę zasad. Opcjonalnie możesz określić opis i kategorię.

6. Under Policy rule, add the following policy definition to the policyRule section.

   {
     "if": {
       "allOf": [
         {
           "field": "type",
           "equals": "Microsoft.Storage/storageAccounts"
         },
         {
           "not": {
             "field":"Microsoft.Storage/storageAccounts/allowCrossTenantReplication",
             "equals": "false"
           }
         }
       ]
     },
     "then": {
       "effect": "audit"
     }
   }
   

7. Save the policy.

Assign the policy

Następnie przypisz zasady do zasobu. Zakres polityki odpowiada temu zasobowi i wszelkim zasobom podlegającym mu. Aby uzyskać więcej informacji na temat przypisywania zasad, zobacz Azure Policy assignment structure (Struktura przypisywania zasad w usłudze Azure Policy).

To assign the policy with the Azure portal, follow these steps:

1. W portalu Azure przejdź do usługi Azure Policy.
2. W sekcji Redagowanie wybierz pozycję Zadania.
3. Select Assign policy to create a new policy assignment.
4. W polu Zakres wybierz zakres przypisania zasad.
5. W polu Definicja zasad wybierz przycisk Więcej, a następnie wybierz zasady zdefiniowane w poprzedniej sekcji z listy.
6. Provide a name for the policy assignment. Opis jest opcjonalny.
7. Leave Policy enforcement set to Enabled. To ustawienie nie ma wpływu na zasady inspekcji.
8. Wybierz Przejrzyj i utwórz, aby utworzyć zadanie.

Wyświetlanie raportu zgodności

After you've assigned the policy, you can view the compliance report. The compliance report for an audit policy provides information on which storage accounts are still permitting cross-tenant object replication policies. Aby uzyskać więcej informacji, zobacz Uzyskiwanie danych o zgodności z zasadami.

It may take several minutes for the compliance report to become available after the policy assignment is created.

Aby wyświetlić raport zgodności w witrynie Azure Portal, wykonaj następujące kroki:

1. W portalu Azure przejdź do usługi Azure Policy.

2. Wybierz pozycję Zgodność.

3. Przefiltruj wyniki pod kątem nazwy przypisania zasad utworzonego w poprzednim kroku. The report shows resources that are not in compliance with the policy.

4. You can drill down into the report for additional details, including a list of storage accounts that are not in compliance.

   

Use Azure Policy to enforce same-tenant replication policies

Usługa Azure Policy obsługuje ład w chmurze, zapewniając, że zasoby platformy Azure są zgodne z wymaganiami i standardami. To ensure that storage accounts in your organization disallow cross-tenant replication, you can create a policy that prevents the creation of a new storage account that allows cross-tenant object replication policies. The enforcement policy uses the Deny effect to prevent a request that would create or modify a storage account to allow cross-tenant object replication. The Deny policy will also prevent all configuration changes to an existing account if the cross-tenant object replication setting for that account is not compliant with the policy. For more information about the Deny effect, see Understand Azure Policy effects.

To create a policy with a Deny effect for cross-tenant object replication, follow the same steps described in Use Azure Policy to audit for compliance, but provide the following JSON in the policyRule section of the policy definition:

{
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Storage/storageAccounts"
      },
      {
        "not": {
          "field":"Microsoft.Storage/storageAccounts/allowCrossTenantReplication",
          "equals": "false"
        }
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}

After you create the policy with the Deny effect and assign it to a scope, a user cannot create a storage account that allows cross-tenant object replication. Nor can a user make any configuration changes to an existing storage account that currently allows cross-tenant object replication. Próba wykonania tej czynności powoduje wystąpienie błędu. The AllowCrossTenantReplication property for the storage account must be set to false to proceed with account creation or configuration updates, in compliance with the policy.

The following image shows the error that occurs if you try to create a storage account that allows cross-tenant object replication (the default for a new account) when a policy with a Deny effect requires that cross-tenant object replication is disallowed.

Zobacz też

• Object replication for block blobs
• Configure object replication for block blobs
• Zalecenia dotyczące zabezpieczeń usługi Blob Storage