---
title: Azure – You can now disable Storage Account Access Keys (preview) - cubesys
description: As you know, you can use access keys to access Azure Storage Account content (Blob, Table, File…).While this is helpful this also implies some security risk when using public endpoints.Well, good news, you can now disable account access keys on storage account to use Azure AD authentication instead.IMPORTANT if you…
---

[Latest News & Blogs - cubesys ](https://www.cubesys.com.au/blog)

# [Azure – You can now disable Storage Account Access Keys (preview) - cubesys](https://www.cubesys.com.au/blog/azure-you-can-now-disable-storage-account-access-keys-preview)

 Written by [cubesys](https://www.cubesys.com.au/blog/author/cubesys) | Jan 31, 2021 1:00:00 PM

As you know, you can use access keys to access Azure Storage Account content (Blob, Table, File…).

While this is helpful this also implies some security risk when using public endpoints.

Well, good news, you can now disable account access keys on storage account to use Azure AD authentication instead.

**IMPORTANT** if you disable account access keys, you will not be able to access Azure Files or Table storage as they do not support (yet?) Azure AD authentication.

It is highly recommended to review access type on the storage account before turning of the access keys.

You can review how your storage account is access using the **Transactions** metric with the **Sum** aggregation for the storage account.

<https://www.cubesys.com.au/hubfs/Imported_Blog_Media/image_thumb-383.png>  <https://www.cubesys.com.au/hubfs/Imported_Blog_Media/image_thumb1-294.png>

Then use the **Authentication** filter to identify if account keys are used using the values **Account key** and **SAS**

<https://www.cubesys.com.au/hubfs/Imported_Blog_Media/image_thumb2-228.png>

If you have data back, you can get more information to identify what is using SAS using the storage account **Diagnostic** and **Log Analytics**.

Enable the diagnostic settings to save logs in the Log Analytics workspace by accessing the **Diagnostics** blade for the storage account

<https://www.cubesys.com.au/hubfs/Imported_Blog_Media/image_thumb4-136.png>  <https://www.cubesys.com.au/hubfs/Imported_Blog_Media/image_thumb5-90.png>

Then you can query the log using KQL

> StorageBlobLogs  
>  | where AuthenticationType in (“AccountKey”, “SAS”) and TimeGenerated > ago(7d)  
>  | summarize count() by CallerIpAddress, UserAgentHeader, AccountName  
>  | top 10 by count_ desc

Once you have reviewed how your storage account is accessed, you can turn off the access keys (if possible) by accessing the storage account **Configuration** blade

<https://www.cubesys.com.au/hubfs/Imported_Blog_Media/image_thumb6-72.png>

[View full post](https://www.cubesys.com.au/blog/azure-you-can-now-disable-storage-account-access-keys-preview)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "cubesys"
  },
  "dateModified" : "2025-02-21T15:17:28.973Z",
  "datePublished" : "2021-01-31T13:00:00Z",
  "headline" : "Azure – You can now disable Storage Account Access Keys (preview)",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.cubesys.com.au/blog/azure-you-can-now-disable-storage-account-access-keys-preview",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Latest News"
  }
}
```