---
title: >-
  Azure service principal can list keys for a storage account containing a crown
  jewel
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure service principal can list keys
  for a storage account containing a crown jewel
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure service principal can list keys for a storage account containing a crown jewel

## Description{% #description %}

An Azure service principal can list the access keys for a storage account that contains a crown jewel blob container, and the storage account permits Shared Key authorization. If the principal is compromised, an attacker could use an account key to access or alter business-critical data in the storage account.

## Remediation{% #remediation %}

1. Remove role assignments that grant the service principal permission to list storage account keys. See [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove).
1. Disallow Shared Key authorization and rotate the account keys after verifying that clients will continue to work as intended. See [Prevent Shared Key authorization](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent) and [Manage storage account access keys](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage).