> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor Storage Blob Encryption setting is not enabled

### More Info:

Enable Storage Blob Encryption recommendations for virtual machines.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* HIPAA
* ISO 27001
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Monitor Storage Blob Encryption setting is not enabled" misconfiguration in Azure using the Azure console, follow the below steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the "Storage accounts" service.
        3. Select the storage account that you want to remediate.
        4. In the left-hand menu, click on "Encryption" under the "Security + networking" section.
        5. In the "Encryption" blade, ensure that the "Storage Service Encryption" toggle is set to "On".
        6. Scroll down to the "Advanced" section and ensure that the "Monitor Storage Blob Encryption setting" toggle is also set to "On".
        7. Click "Save" to apply the changes.

        By following the above steps, you have successfully remediated the "Monitor Storage Blob Encryption setting is not enabled" misconfiguration in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Monitor Storage Blob Encryption setting is not enabled" misconfiguration in AZURE using AZURE CLI, follow these steps:

        1. Open the AZURE CLI on your local machine or in the AZURE portal.

        2. Log in to AZURE using the command "az login".

        3. Check if you have the necessary permissions to remediate this misconfiguration by running the command "az role assignment list --assignee `<your email address or object ID>`". If you don't have the necessary permissions, contact your administrator.

        4. Enable the "Monitor Storage Blob Encryption" setting using the command "az monitor diagnostic-settings create". Here is an example command:

        ```
        az monitor diagnostic-settings create --resource /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName} --name BlobEncryptionDiagnosticSetting --logs '[{"category": "StorageRead"}]' --metrics '[{"category": "Capacity"}]' --workspace /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName} --storage-account {storageAccountName} --encryption-scope {encryptionScopeName} --enabled true
        ```

        Note: Replace the placeholders `<subscriptionId>`, `<resourceGroupName>`, `<storageAccountName>`, `<workspaceName>`, and `<encryptionScopeName>` with the correct values for your environment.

        5. Verify that the "Monitor Storage Blob Encryption" setting is enabled by running the command "az monitor diagnostic-settings show". Here is an example command:

        ```
        az monitor diagnostic-settings show --resource /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName} --name BlobEncryptionDiagnosticSetting
        ```

        If the output shows that the setting is enabled, then the misconfiguration has been remediated successfully.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Monitor Storage Blob Encryption setting is not enabled" misconfiguration in Azure using Python, you can follow the below steps:

        1. Import the required libraries:

        ```python theme={null}
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.monitor import MonitorManagementClient
        from azure.mgmt.storage import StorageManagementClient
        from azure.mgmt.storage.models import StorageAccountUpdateParameters
        ```

        2. Authenticate and create the clients:

        ```python theme={null}
        credential = DefaultAzureCredential()
        monitor_client = MonitorManagementClient(credential, subscription_id)
        storage_client = StorageManagementClient(credential, subscription_id)
        ```

        3. Get the list of storage accounts:

        ```python theme={null}
        storage_accounts = storage_client.storage_accounts.list()
        ```

        4. Loop through the storage accounts and check if the "Monitor Storage Blob Encryption" setting is enabled:

        ```python theme={null}
        for account in storage_accounts:
            account_name = account.name
            resource_group_name = account.id.split('/')[4]
            account_properties = storage_client.storage_accounts.get_properties(resource_group_name, account_name)
            encryption_enabled = account_properties.encryption.services.blob.enabled
            if not encryption_enabled:
                # enable the encryption
        ```

        5. If the "Monitor Storage Blob Encryption" setting is not enabled, update the storage account to enable it:

        ```python theme={null}
                account_properties.encryption.services.blob.enabled = True
                update_parameters = StorageAccountUpdateParameters(encryption=account_properties.encryption)
                storage_client.storage_accounts.update(resource_group_name, account_name, update_parameters)
        ```

        6. Once the setting is enabled, you can also create an alert to monitor it:

        ```python theme={null}
                monitor_client.alert_rules.create_or_update(
                    resource_group_name,
                    f"{account_name}-blob-encryption-alert",
                    {
                        "location": account.location,
                        "enabled": True,
                        "condition": {
                            "allOf": [
                                {
                                    "field": "type",
                                    "equals": "Microsoft.Storage/storageAccounts/blobServices"
                                },
                                {
                                    "field": "Microsoft.Storage/storageAccounts/blobServices/encryption.services.blob.enabled",
                                    "equals": False
                                }
                            ]
                        },
                        "actions": {
                            "severity": "2",
                            "sendToServiceOwners": True
                        }
                    }
                )
        ```

        By following these steps, you can remediate the "Monitor Storage Blob Encryption setting is not enabled" misconfiguration in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_subscription_policy_assignment" "monitor_storage_blob_encryption" {
          name                 = "monitor-storage-blob-encryption"
          subscription_id      = AZURE_SUBSCRIPTION_ID          # replace with the target subscription ID
          policy_definition_id = STORAGE_BLOB_ENCRYPTION_POLICY_DEFINITION_ID
          # Example (for reference only – confirm the exact built‑in ID in your tenant/portal):
          # policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/XXXXXXXXXXXXXXXXXXXX"

          display_name = "Monitor Storage Blob Encryption"
          description  = "Enable Azure Security Center recommendation to monitor Storage Blob Encryption."

          # Many Security Center / Defender for Cloud built‑in policies expose an 'effect' parameter.
          # If the specific policy definition you use has such a parameter, pass it here.
          # If not, remove or adjust this block to match the policy's schema.
          parameters = jsonencode({
            effect = {
              value = "AuditIfNotExists"
            }
          })

          # Optionally, scope this to specific resource groups instead of the whole subscription:
          # not_scopes = [
          #   "/subscriptions/AZURE_SUBSCRIPTION_ID/resourceGroups/EXCLUDED_RESOURCE_GROUP_NAME"
          # ]
        }
        ```

        This creates a policy assignment at subscription scope so Azure Security Center (Defender for Cloud) evaluates Storage accounts for the “Monitor Storage Blob Encryption” recommendation. No existing compute or storage resources are replaced; this only adds a policy assignment.

        To verify, `terraform plan` should show a single `+ create` for `azurerm_subscription_policy_assignment.monitor_storage_blob_encryption` with the expected `policy_definition_id` and `parameters` (if applicable to that policy).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>