---
title: >-
  Azure service principal can generate a SAS for a storage account containing a
  crown jewel
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure service principal can generate a
  SAS for a storage account containing a crown jewel
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure service principal can generate a SAS for a storage account containing a crown jewel

## Description{% #description %}

An Azure service principal can generate an account or service shared access signature for a storage account that contains a crown jewel blob container, and the storage account permits Shared Key authorization. If the principal is compromised, an attacker could mint a SAS token and use it to access business-critical data.

## Remediation{% #remediation %}

1. Remove role assignments that grant the service principal account or service SAS generation permissions. See [Remove Azure role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove).
1. Disallow Shared Key authorization on the storage account after verifying that clients will continue to work as intended. See [Prevent Shared Key authorization](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent).