Check provider logo

Storage account allows only the latest SMB protocol version for file shares

storage_smb_protocol_version_is_latest

Severitymedium
Servicestorage
by Prowler
vulnerabilities

Azure Storage file shares (SMB) are configured to allow only the latest SMB protocol version, blocking legacy SMB versions at the storage account level

Risk

Allowing legacy SMB versions enables protocol downgrade and weak cipher negotiation, reducing confidentiality and integrity. Adversaries can intercept or alter traffic, bypass strong signing/encryption, and exploit known flaws for lateral movement or credential replay

Run this check with Prowler CLI

prowler azure --checks storage_smb_protocol_version_is_latest

Run in Prowler Cloud

Recommendation

Restrict SMB to the newest version (e.g., SMB 3.1.1) and disable older versions. Enforce encryption in transit and prefer Kerberos over NTLM. Validate client compatibility, apply least privilege on shares, and monitor access to maintain defense in depth

Remediation

CLI

az storage account file-service-properties update --resource-group <RESOURCE_GROUP> --account-name <STORAGE_ACCOUNT_NAME> --versions SMB3.1.1

Native IaC
Terraform
Other
  1. In the Azure portal, go to Storage accounts and open your storage account
  2. Navigate to Data storage > File shares
  3. Under File share settings, select Security
  4. Choose Profile: Custom, then under SMB protocol versions select only SMB 3.1.1
  5. Click Save

Source Code

Resource Type

microsoft.storage/storageaccounts

References