TMA-AZURE-STORAGE-7.1.2
Ensure encryption in transit is required for File Shares (Microsoft.FileShares)
Description
Note: This recommendation applies to NFS file shares created with the Microsoft.FileShares provider. Encryption in transit protects data moving between NFS clients and the file share from interception and tampering. On Microsoft.FileShares, NFS traffic is encrypted with TLS (via the AZNFS/stunnel mount helper) when encryption in transit is required on the share. NFS has no built-in user authentication; access is governed at the network layer, so unencrypted NFS traffic is exposed to eavesdropping and man-in-the-middle attacks on the path between client and share. Requiring encryption in transit ensures mount traffic is protected with TLS, preserving the confidentiality and integrity of data in motion.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Audit from Azure Portal 1. In the Azure portal, search for and select File shares. 2. Select the NFS file share to audit. 3. Under the share's Settings, select Configuration. 4. Confirm that Encryption in transit is Enabled. If it is Disabled, the file share is non-compliant. 5. Repeat for each Microsoft.FileShares NFS file share. Audit from Azure CLI If the file share extension is not installed, add it: az extension add --name fileshare For each file share, run the following command: az fileshare show --resource-group <resource-group> --name <file-share-name> --query encryptionInTransitRequired A compliant share returns Enabled. Any other value (for example, Disabled) is non- compliant. Audit from PowerShell If the Az.FileShare module is not installed, install it: Install-Module -Name Az.FileShare -Repository PSGallery For each file share, run the following command: Get-AzFileShare -ResourceGroupName <resource-group> -ResourceName <file- share-name> | Select-Object -ExpandProperty EncryptionInTransitRequired A compliant share returns Enabled. Any other value (for example, Disabled) is non- compliant.
How it is fixed
Fix method: Guidance or infrastructure patch
Remediate from Azure Portal 1. In the Azure portal, search for and select File shares. 2. Select the NFS file share to remediate. 3. Under the share's Settings, select Configuration. 4. Set Encryption in transit to Enabled. 5. Select Save. 6. Repeat for each file share requiring remediation. Remediate from Azure CLI If the file share extension is not installed, add it: az extension add --name fileshare For each file share requiring remediation, run: az fileshare update --resource-group <resource-group> --name <file-share- name> --encryption-in-transit-required Enabled Remediate from PowerShell If the Az.FileShare module is not installed, install it: Install-Module -Name Az.FileShare -Repository PSGallery For each file share requiring remediation, run: Update-AzFileShare -ResourceName <file-share-name> -ResourceGroupName <resource-group> -EncryptionInTransitRequired Enabled
Properties
- Operating systems
- Any
- Tags
- azurecloudencryptionstorage
- Reference
- CIS Microsoft Azure Storage Services Benchmark v2.0.0 - 7.1.2 Ensure encryption in transit is required for File Shares (Microsoft.FileShares)