{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/", "slug": "dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation", "url": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/" }, "title": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match", "summary": "Portal-created accounts and scripted accounts do not start with the same explicit SMB and NFS encryption selections.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:30+00:00", "modified_at": "2026-09-10T02:11:17+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 233, "potentially_affected": "Azure Files storage accounts reviewed for SMB, NFS and FileREST encryption in transit.", "dse_recommendation": "Record each protocol's effective encryption requirement and the legacy setting before approving a deployment template.", "primary_source": { "name": "Networking Considerations for Azure Files | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-overview", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.

\n

FileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. Microsoft Learn.

\n

Applicability

\n

Identify the account’s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.

\n

DSE recommendation

\n

DSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.

\n

Verification

\n

Inspect a representative deployment’s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol’s requirement undocumented.

\n

Official references

\n

Microsoft Learn: Networking Considerations for Azure Files. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.\nFileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. Microsoft Learn.\nApplicability\nIdentify the account’s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.\nDSE recommendation\nDSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.\nVerification\nInspect a representative deployment’s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol’s requirement undocumented.\nOfficial references\nMicrosoft Learn: Networking Considerations for Azure Files. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.\n\nFileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-overview).\n\n## Applicability\n\nIdentify the account’s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.\n\n## DSE recommendation\n\nDSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.\n\n## Verification\n\nInspect a representative deployment’s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol’s requirement undocumented.\n\n## Official references\n\n[Microsoft Learn: Networking Considerations for Azure Files](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-overview). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match", "item": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/", "headline": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match", "description": "Portal-created accounts and scripted accounts do not start with the same explicit SMB and NFS encryption selections.", "abstract": "Portal-created accounts and scripted accounts do not start with the same explicit SMB and NFS encryption selections.", "articleBody": "Source facts\nFor new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.\nFileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. Microsoft Learn.\nApplicability\nIdentify the account’s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.\nDSE recommendation\nDSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.\nVerification\nInspect a representative deployment’s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol’s requirement undocumented.\nOfficial references\nMicrosoft Learn: Networking Considerations for Azure Files. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:23:30+00:00", "dateModified": "2026-09-10T02:11:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Networking Considerations for Azure Files | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-overview" } } ] } }