{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/",
        "slug": "dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/"
        },
        "title": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match",
        "summary": "Portal-created accounts and scripted accounts do not start with the same explicit SMB and NFS encryption selections.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:23:30+00:00",
        "modified_at": "2026-10-18T22:22:11+00:00",
        "reviewed_on": "2026-10-18",
        "reading_minutes": 2,
        "word_count": 257,
        "potentially_affected": "Azure Files storage accounts reviewed for SMB, NFS and FileREST encryption in transit.",
        "dse_recommendation": "Record each protocol's effective encryption requirement and the legacy setting before approving a deployment template.",
        "primary_source": {
            "name": "Microsoft Learn: Require secure transfer to ensure secure connections",
            "url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>For new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.</p>\n<p>FileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. Microsoft Learn: <a href=\"https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer\" target=\"_blank\" rel=\"noopener noreferrer\">secure transfer</a>, <a href=\"https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol\" target=\"_blank\" rel=\"noopener noreferrer\">SMB</a> and <a href=\"https://learn.microsoft.com/en-us/azure/storage/files/encryption-in-transit-for-nfs-shares\" target=\"_blank\" rel=\"noopener noreferrer\">NFS</a>.</p>\n<h2>Applicability</h2>\n<p>Identify the account&#8217;s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.</p>\n<h2>Verification</h2>\n<p>Inspect a representative deployment&#8217;s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol&#8217;s requirement undocumented.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Require secure transfer to ensure secure connections</a>. <a href=\"https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: SMB file shares in Azure Files</a>. <a href=\"https://learn.microsoft.com/en-us/azure/storage/files/encryption-in-transit-for-nfs-shares\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Encrypt data in transit for NFS shares</a>. Sources reviewed October 18, 2026.</p>",
        "content_text": "Source facts\nFor new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.\nFileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. Microsoft Learn: secure transfer, SMB and NFS.\nApplicability\nIdentify the account’s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.\nDSE recommendation\nDSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.\nVerification\nInspect a representative deployment’s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol’s requirement undocumented.\nOfficial references\nMicrosoft Learn: Require secure transfer to ensure secure connections. Microsoft Learn: SMB file shares in Azure Files. Microsoft Learn: Encrypt data in transit for NFS shares. Sources reviewed October 18, 2026.",
        "content_markdown": "## Source facts\n\nFor new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.\n\nFileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. Microsoft Learn: [secure transfer](https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer), [SMB](https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol) and [NFS](https://learn.microsoft.com/en-us/azure/storage/files/encryption-in-transit-for-nfs-shares).\n\n## Applicability\n\nIdentify the account’s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.\n\n## DSE recommendation\n\nDSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.\n\n## Verification\n\nInspect a representative deployment’s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol’s requirement undocumented.\n\n## Official references\n\n[Microsoft Learn: Require secure transfer to ensure secure connections](https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer). [Microsoft Learn: SMB file shares in Azure Files](https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol). [Microsoft Learn: Encrypt data in transit for NFS shares](https://learn.microsoft.com/en-us/azure/storage/files/encryption-in-transit-for-nfs-shares). Sources reviewed October 18, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-18"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/",
                "headline": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match",
                "description": "Portal-created accounts and scripted accounts do not start with the same explicit SMB and NFS encryption selections.",
                "abstract": "Portal-created accounts and scripted accounts do not start with the same explicit SMB and NFS encryption selections.",
                "articleBody": "Source facts\nFor new storage accounts created in the Azure portal, the SMB and NFS encryption-in-transit requirements default to enabled. PowerShell, CLI and FileREST API creation leave these per-protocol choices Not selected for compatibility. On existing accounts, Secure transfer required continues governing SMB or NFS until its corresponding per-protocol setting is explicitly configured.\nFileREST uses Secure transfer required: when enabled, FileREST access must use HTTPS. A Not selected protocol choice should therefore be investigated with the existing account setting, not simply reported as encryption disabled. Microsoft Learn: secure transfer, SMB and NFS.\nApplicability\nIdentify the account’s creation path, actual settings and protocols used by its clients. Keep the review focused on effective requirements rather than a screenshot from a differently created account.\nDSE recommendation\nDSE recommends making intended encryption requirements explicit in the approved deployment design. Compare portal and automated provisioning results before standardizing a template. Investigate client compatibility through an approved test rather than disabling a requirement to reproduce an older default. Preserve the legacy setting when documenting why an unset protocol choice behaves as observed.\nVerification\nInspect a representative deployment’s SMB, NFS and FileREST settings as applicable, then test the permitted encrypted path and an appropriate noncompliant test case. Record configuration and negotiated behavior separately. Confirm that a change to one protocol has the intended scope and does not leave another protocol’s requirement undocumented.\nOfficial references\nMicrosoft Learn: Require secure transfer to ensure secure connections. Microsoft Learn: SMB file shares in Azure Files. Microsoft Learn: Encrypt data in transit for NFS shares. Sources reviewed October 18, 2026.",
                "datePublished": "2026-09-10T00:23:30+00:00",
                "dateModified": "2026-10-18T22:22:11+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-506-check-azure-files-per-protocol-encryption-settings-instead-of-assuming-creation/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check Azure Files per-protocol encryption settings instead of assuming creation defaults match"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 257,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Microsoft Learn: Require secure transfer to ensure secure connections",
                    "url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer"
                }
            }
        ]
    }
}