Ensure that 'Enable Data Access Authentication Mode' is 'Checked'

Overview

Data Access Authentication Mode provides a method of uploading or exporting Virtual Machine Disks.

Rationale

Enabling data access authentication mode adds a layer of protection using an Entra ID role to further restrict users from creating and using Secure Access Signature (SAS) tokens for exporting a detached managed disk or virtual machine state. Users will need the Data operator for managed disk role within Entra ID to download a VHD or VM Guest state using a secure URL.

Impact

To apply this setting, the virtual machine to which the disk or disks are attached must be powered down and have their disk detached. Users without the Data operator for managed disk role within Entra ID cannot export VHD or VM Guest state using the secure download URL.

Remediation guidance

Remediate from Azure Portal

Part A. Select the Virtual Machine to Remediate

Using the search bar, search for and open the Virtual Machines service.
Click on the name of the Virtual Machine to be remediated.

Part B. Remediate each Virtual Machine Disk individually

From the selected Virtual Machine resource window, expand the Settings menu item and click Disks.
For each disk, click the name of the disk to open the disk resource window.
From the selected Disk resource window, expand the Settings menu item, and click Disk Export.

check the checkbox next to Enable Data Access Authentication Mode.

Repeat Part B for each Disk attached to a VM.

Repeat Parts A and B to remediate all Disks in all VMs.

Remediate from PowerShell

Ensure that each disk is detached from its associated Virtual Machine before proceeding. Once detached, run the following for each disk:

$disk = Get-AzDisk -ResourceGroupName '<resource_group_name>' -DiskName '<disk_name>'
$disk.DataAccessAuthMode = 'AzureActiveDirectory'
Update-AzDisk -ResourceGroup '<resource_group_name>' -DiskName $disk.Name -Disk $disk

Remediate from Azure CLI

Ensure that each disk is detached from its associated Virtual Machine before proceeding. Once detached, run the following for each disk:

az disk update --name <disk_name> --resource-group <resource_group_name> --data-access-auth-mode AzureActiveDirectory

Multiple Remediation Paths

Azure

SERVICE-WIDE (RECOMMENDED when many resources are affected): Assign Azure Policy initiatives at management group/subscription scope and trigger remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

ASSET-LEVEL: Apply the resource-specific remediation steps above to the listed non-compliant resources.

PREVENTIVE: Embed Azure Policy checks into landing zones and IaC workflows to block or auto-remediate drift.

References for Service-Wide Patterns

Azure Policy overview: https://learn.microsoft.com/en-us/azure/governance/policy/overview
Azure Policy remediation: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
Azure Policy initiative structure: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

Azure: assign policy initiatives at management group/subscription scope and run remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

2. Remediate Existing Affected Assets

Execute the control-specific Console/CLI steps documented above for each flagged resource.
Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

Re-scan after each remediation batch.
Track exceptions with owner and expiry date.
Add preventive checks in IaC/CI pipelines.

Query logic

These are the stored checks tied to this control.

Azure disks without data access authentication mode

Connectors

Microsoft Azure

Covered asset types

Disk

Expected check: eq []

{
  disks(where: { dataAccessAuthMode: "None" }) {
    ...AssetFragment
  }
}