Check for SMB Channel Encryption Type

Risk Level: Medium (should be achieved)

Ensure that your Microsoft Azure File Shares are configured with the "AES-256-GCM" SMB channel encryption algorithm to provide strong protection against eavesdropping and Man-In-The-Middle (MITM) attacks, safeguarding sensitive information.

Security

Microsoft Azure File Shares should be configured with the "AES-256-GCM" SMB channel encryption algorithm to provide robust data protection in transit. This algorithm offers stronger security through a larger key size, effectively doubling resistance against brute-force attacks compared to AES-128. Additionally, its widespread adoption in modern security protocols like TLS 1.3, IPsec, and SSH ensures compatibility and adheres to industry best practices, safeguarding against unauthorized interception and tampering.

Audit

To determine if your Azure File Shares are configured with the "AES-256-GCM" SMB channel encryption algorithm only, perform the following operations:

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

04 From the Type equals all filter box, choose Equals, select Storage account, and choose Apply to list only the Storage accounts available in the selected Azure subscription.

05 Click on the name (link) of the Azure Storage account that you want to examine.

06 In the resource navigation panel, under Data storage, choose File shares to access the configuration settings available for Azure File Shares in the selected Storage account.

07 In the File share settings section, click on the Security attribute value (link) and check the SMB channel encryption list to determine the SMB channel encryption algorithms enabled for your Azure File Shares. If AES-256-GCM is not the only encryption algorithm enabled, the File Shares within the selected Azure Storage account are using weak and potentially vulnerable SMB channel encryption algorithms.

08 Repeat steps no. 5 – 7 for each Azure Storage account available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run storage account list command (Windows/macOS/Linux) with custom output filters to describe the identifier (name) of each storage account provisioned in the selected subscription:

az storage account list
	--query '[*].name'

05 The command output should return the requested storage account names:

[
	"project5storageaccount",
	"cloudaistorageaccount"
]

06 Run storage account file-service-properties show command (Windows/macOS/Linux) with the name of the Azure Storage account that you want to examine as the identifier parameter and custom output filters to describe the SMB channel encryption algorithm enabled for the Azure File Shares within the selected Storage account:

az storage account file-service-properties show
	--account-name project5storageaccount
	--query 'protocolSettings.smb.channelEncryption'

07 The command output should return the encryption algorithm enabled for your File Shares:

"AES-128-CCM;AES-128-GCM;AES-256-GCM;"

If the storage account file-service-properties show command output does not return only AES-256-GCM for the encryption algorithm, "AES-256-GCM" is not the only SMB channel encryption algorithm enabled for your File Shares. Therefore, the File Shares in the selected Azure Storage account are using weak and potentially vulnerable SMB channel encryption algorithms.

08 Repeat steps no. 6 and 7 for each Azure Storage account provisioned in the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription available in your Microsoft Azure cloud account.

Remediation / Resolution

To ensure that your Azure File Shares are configured with the "AES-256-GCM" SMB channel encryption algorithm only, perform the following operations:

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

04 From the Type equals all filter box, choose Equals, select Storage account, and choose Apply to list only the Storage accounts available in the selected Azure subscription.

05 Click on the name (link) of the Azure Storage account that you want to examine.

06 In the resource navigation panel, under Data storage, choose File shares to access the configuration settings available for Azure File Shares in the selected Storage account.

07 In the File share settings section, click on the Security attribute value (link), and perform the following actions:

If Profile is set to Maximum compatibility, set the Profile to Maximum security or Custom. If you selected Custom, ensure that AES-256-GCM is the only encryption algorithm selected from the SMB channel encryption list.
If Profile is set to Custom, ensure that AES-256-GCM is the only encryption algorithm selected from the SMB channel encryption list.
Choose Save to apply the configuration changes. This will enable the "AES-256-GCM" SMB channel encryption algorithm only for the File Shares within the selected Azure Storage account.

08 Repeat steps no. 5 – 7 for each Azure Storage account available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run storage account file-service-properties update command (Windows/macOS/Linux) with the name of the Azure Storage account that you want to configure as the identifier parameter, to enable the "AES-256-GCM" SMB channel encryption algorithm only for the File Shares in the selected Storage account:t Azure Storage account that you want to configure as the identifier parameter, to disable public (anonymous) access to all the blobs containers available in the selected storage account:

az storage account file-service-properties update
	--account-name project5storageaccount
	--channel-encryption AES-256-GCM

05 The command output should return the configuration information available for the modified resource:

{
	"cors": null,
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/project5storageaccount/fileServices/default",
	"name": "default",
	"protocolSettings": {
		"smb": {
			"authenticationMethods": "NTLMv2;Kerberos;",
			"channelEncryption": "AES-256-GCM",
			"kerberosTicketEncryption": "RC4-HMAC;AES-256;",
			"multichannel": null,
			"versions": "SMB3.1.1;"
		}
	},
	"resourceGroup": "cloud-shell-storage-westeurope",
	"shareDeleteRetentionPolicy": {
		"allowPermanentDelete": null,
		"days": null,
		"enabled": false
	},
	"sku": null,
	"type": "Microsoft.Storage/storageAccounts/fileServices"
}

06 Repeat steps no. 4 and 5 for each Azure Storage account provisioned in the selected subscription.

07 Repeat steps no. 3 – 6 for each subscription created in your Microsoft Azure cloud account.

References

Azure Official Documentation
What is Azure Files?
Architecture best practices for Azure Files
SMB Azure file shares

Azure Command Line Interface (CLI) Documentation
az account list
az account set
az storage account list
az storage account file-service-properties show
az storage account file-service-properties update

Publication date May 7, 2025

Audit

Using Azure Console

Using Azure CLI

Remediation / Resolution

Using Azure Console

Using Azure CLI

References

Related StorageAccounts rules