Set-SIStorageSharedKey
Show, or switch off, shared-key access on SecurityInsight's storage account
Purpose
Shows the storage account's shared-key state and what still uses a key; switches shared-key access OFF (Entra ID by default) only when nothing does (-Disable), or back ON (-Enable).
When to run it
To harden the storage account after moving every job to managed identity.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| azureRbac | Storage Account Contributor (or Contributor) | the storage account | to change allowSharedKeyAccess |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| Azure storage account | update | allowSharedKeyAccess = false, defaultToOAuthAuthentication = true (-Disable) / allowSharedKeyAccess = true (-Enable) | the SI storage account | remove key-based access once nothing needs it | Set-SIStorageSharedKey -Enable |
What it only reads
- the account's properties
- its transaction metrics by authentication type
- jobs and role assignments that could still use a key
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -StorageAccountName | no | ||
| -ResourceGroupName | no | ||
| -SubscriptionId | no | ||
| -TenantId | no | ||
| -ConfigPath | no | ||
| -Days | no | 7 | |
| -Disable | yes | ||
| -Enable | yes |
Preview with -WhatIf
The report, plus "would switch shared-key access OFF / ON"; nothing is changed.
Undo
Set-SIStorageSharedKey -Enable
Network
It connects to: *.blob.core.windows.net, *.queue.core.windows.net, *.table.core.windows.net, *.vault.azure.net, 169.254.169.254, api.loganalytics.io, graph.microsoft.com, invardia.com, login.microsoftonline.com, management.azure.com, monitor.azure.com, outlook.office.com, outlook.office365.com, storage.azure.com, vault.azure.net
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/si/Set-SIStorageSharedKey.ps1 -OutFile Set-SIStorageSharedKey.ps1
.\Set-SIStorageSharedKey.ps1 -Disable <Disable> -Enable <Enable>To check the download first, compare its SHA-256 with the published one:
SHA-256 5cab51a5b9c204f44b2f2be02eef50e3c4d578a7b4c90b39416ccdbd0f1f39cc
Checksums: SHA256SUMS.txt · Version 3.0.79
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Set-SIStorageSharedKey.ps1 -Full · Source: Set-SIStorageSharedKey.ps1
Every script, identity and permission for your security review: SecurityInsight