Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Azure Storage accounts generate two shared symmetric keys at creation, known as access keys, which grant complete administrative control over the storage account data plane. Because these keys provide unrestricted access, rotating them regularly is a critical security practice to minimize exposure if a key is compromised. Organizations can establish a key expiration policy directly on the storage account to automatically trigger warnings when a key is due for rotation. Security teams can then use Azure Policy to monitor these expiration settings across the environment and audit resource compliance. Note that user delegation shared access signatures (SAS) rely on Microsoft Entra ID credentials and remain completely unaffected when you rotate these account keys.
Maintaining uninterrupted service connectivity during rotation requires a strict order of operations using both keys. Applications must first be updated to use the secondary key, key2, so that the primary key, key1, is idle and safe to regenerate. Administrators can perform this regeneration using the Azure portal, PowerShell, or the Azure CLI. Once the primary key is regenerated, applications are updated to use the new key1, and finally, the secondary key is regenerated to complete the cycle.
To perform these actions programmatically, administrators have two primary command-line options:
StudyCerts
StudyCertsNew-AzStorageAccountKey with the target resource group, storage account name, and key name specified.az storage account keys renew specifying the resource group, account name, and key designation as primary or secondary.Using this alternating pattern ensures that your applications always have an active, valid credential to authenticate requests, avoiding service downtime.
Regenerating storage keys is a control plane operation that requires specific administrative permissions to prevent unauthorized access. The security principal initiating the rotation must have the specific Azure role-based access control (RBAC) action Microsoft.Storage/storageAccounts/regeneratekey/action. Built-in roles that possess this permission include Owner, Contributor, and the highly scoped Storage Account Key Operator Service Role. Assigning the latter role aligns with the principle of least privilege, as it allows administrators to rotate keys without granting full administrative ownership over the entire storage resource.
Prepare and test your skills
Prepare and test your skills
Administrators can prevent downtime by updating applications to use the secondary key, key2, before regenerating the primary key, key1. After regenerating key1, applications are updated to use the new primary key, and the secondary key is then regenerated to complete the rotation cycle.
The Storage Account Key Operator Service Role provides the least privileged access for key rotation. It possesses the required Microsoft.Storage/storageAccounts/regeneratekey/action permission without granting full administrative ownership over the storage resource.
Rotating storage account access keys has no impact on user delegation shared access signatures (SAS). User delegation SAS tokens rely on Microsoft Entra ID credentials rather than the shared symmetric account keys.