AZT703.1 - Replication: Storage Account Replication

Resource

Azure Storage Account

Actions

• Microsoft.Storage/storageAccounts/write

Examples

Az PowerShellAzure CLIAzure Portal

New-AzStorageObjectReplicationPolicyRule

az storage account or-policy rule add

Detections

Detection Details

A policy can be created to alert when replication is set up.

Logs

Data Source	Operation Name	Action	Log Provider
Resource	Put Object Replication Policy	Microsoft.Storage/storageAccounts/objectReplicationPolicies/write	AzureActivity

Queries

Platform	Query
Log Analytics	AzureActivity | where OperationNameValue=='Microsoft.Storage/storageAccounts/objectReplicationPolicies/write'

Azure Monitor Alert

Additional Resources

• https://docs.microsoft.com/en-us/azure/storage/blobs/object-replication-configure?tabs=portal
• https://docs.microsoft.com/en-us/azure/storage/blobs/object-replication-prevent-cross-tenant-policies?tabs=portal