Skip to content

Commit 3af2592

Browse files
authored
Increase acrolinx scores
1 parent 61b6ea1 commit 3af2592

File tree

1 file changed

+10
-10
lines changed

1 file changed

+10
-10
lines changed

articles/storage/blobs/object-replication-prevent-cross-tenant-policies.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ For more information on how to configure object replication policies, including
2323

2424
## Remediate cross-tenant object replication
2525

26-
To prevent object replication across Microsoft Entra tenants, set the **AllowCrossTenantReplication** property for the storage account to **false**. If a storage account does not currently participate in any cross-tenant object replication policies, then setting the **AllowCrossTenantReplication** property to *false* prevents future configuration of cross-tenant object replication policies with this storage account as the source or destination. However, if a storage account currently participates in one or more cross-tenant object replication policies, then setting the **AllowCrossTenantReplication** property to *false* is not permitted until you delete the existing cross-tenant policies.
26+
To prevent object replication across Microsoft Entra tenants, set the **AllowCrossTenantReplication** property for the storage account to **false**. If a storage account doesn't currently participate in any cross-tenant object replication policies, then setting the **AllowCrossTenantReplication** property to *false* prevents future configuration of cross-tenant object replication policies with this storage account as the source or destination. However, if a storage account currently participates in one or more cross-tenant object replication policies, then setting the **AllowCrossTenantReplication** property to *false* isn't permitted until you delete the existing cross-tenant policies.
2727

28-
Cross-tenant policies are not permitted by default for a storage account created after Dec 15, 2023. However, the **AllowCrossTenantReplication** property was not set by default for an existing storage account created before Dec 15, 2023, and does not return a value until you had explicitly set it. The storage account can participate in object replication policies across tenants when the property value is either **null** or **true** for accounts created prior to Dev 15, 2023. For accounts created after that time, the property needs to be set to true. Setting the **AllowCrossTenantReplication** property does not incur any downtime on the storage account.
28+
Cross-tenant policies aren't permitted by default for a storage account created after Dec 15, 2023. However, the **AllowCrossTenantReplication** property wasn't set by default for an existing storage account created before Dec 15, 2023, and doesn't return a value until you had explicitly set it. The storage account can participate in object replication policies across tenants when the property value is either **null** or **true** for accounts created prior to Dev 15, 2023. For accounts created after that time, the property needs to be set to true. Setting the **AllowCrossTenantReplication** property doesn't incur any downtime on the storage account.
2929

3030
### Remediate cross-tenant replication for a new account
3131

@@ -94,7 +94,7 @@ To disallow cross-tenant replication for an existing storage account, use the Az
9494

9595
#### [Azure portal](#tab/portal)
9696

97-
To disallow cross-tenant object replication for an existing storage account that is not currently participating in any cross-tenant policies, follow these steps:
97+
To disallow cross-tenant object replication for an existing storage account that isn't currently participating in any cross-tenant policies, follow these steps:
9898

9999
1. Navigate to your storage account in the Azure portal.
100100
1. Under **Data management**, select **Object replication**.
@@ -111,7 +111,7 @@ If the storage account is currently participating in one or more cross-tenant re
111111

112112
#### [PowerShell](#tab/azure-powershell)
113113

114-
To disallow cross-tenant object replication for an existing storage account that is not currently participating in any cross-tenant policies, first install the [Az.Storage PowerShell module](https://www.powershellgallery.com/packages/Az.Storage)\, version 3.7.0 or later. Next, configure the **AllowCrossTenantReplication** property for the storage account.
114+
To disallow cross-tenant object replication for an existing storage account that isn't currently participating in any cross-tenant policies, first install the [Az.Storage PowerShell module](https://www.powershellgallery.com/packages/Az.Storage)\, version 3.7.0 or later. Next, configure the **AllowCrossTenantReplication** property for the storage account.
115115

116116
The following example shows how to disallow cross-tenant object replication for an existing storage account with PowerShell. Remember to replace the placeholder values in brackets with your own values:
117117

@@ -128,7 +128,7 @@ If the storage account is currently participating in one or more cross-tenant re
128128

129129
#### [Azure CLI](#tab/azure-cli)
130130

131-
To disallow cross-tenant object replication for an existing storage account that is not currently participating in any cross-tenant policies, first install Azure CLI version 2.24.0 or later. For more information, see [Install the Azure CLI](/cli/azure/install-azure-cli). Next, configure the **allowCrossTenantReplication** property for a new or existing storage account.
131+
To disallow cross-tenant object replication for an existing storage account that isn't currently participating in any cross-tenant policies, first install Azure CLI version 2.24.0 or later. For more information, see [Install the Azure CLI](/cli/azure/install-azure-cli). Next, configure the **allowCrossTenantReplication** property for a new or existing storage account.
132132

133133
The following example shows how to disallow cross-tenant object replication for an existing storage account with Azure CLI. Remember to replace the placeholder values in brackets with your own values:
134134

@@ -143,7 +143,7 @@ If the storage account is currently participating in one or more cross-tenant re
143143

144144
---
145145

146-
After you disallow cross-tenant replication, attempting to configure a cross-tenant policy with the storage account as the source or destination fails. Azure Storage returns an error indicating that cross-tenant object replication is not permitted for the storage account.
146+
After you disallow cross-tenant replication, attempting to configure a cross-tenant policy with the storage account as the source or destination fails. Azure Storage returns an error indicating that cross-tenant object replication isn't permitted for the storage account.
147147

148148
When cross-tenant object replication is disallowed for a storage account, then any new object replication policies that you create with that account must include the full Azure Resource Manager IDs for the source and destination account. Azure Storage requires the full resource ID to verify whether the source and destination accounts reside within the same tenant. For more information, see [Specify full resource IDs for the source and destination accounts](object-replication-overview.md#specify-full-resource-ids-for-the-source-and-destination-accounts).
149149

@@ -172,7 +172,7 @@ If you have a large number of storage accounts, you may want to perform an audit
172172

173173
### Create a policy with an Audit effect
174174

175-
Azure Policy supports effects that determine what happens when a policy rule is evaluated against a resource. The Audit effect creates a warning when a resource is not in compliance, but does not stop the request. For more information about effects, see [Understand Azure Policy effects](../../governance/policy/concepts/effects.md).
175+
Azure Policy supports effects that determine what happens when a policy rule is evaluated against a resource. The Audit effect creates a warning when a resource isn't in compliance, but doesn't stop the request. For more information about effects, see [Understand Azure Policy effects](../../governance/policy/concepts/effects.md).
176176

177177
To create a policy with an Audit effect for the cross-tenant object replication setting for a storage account with the Azure portal, follow these steps:
178178

@@ -232,14 +232,14 @@ To view the compliance report in the Azure portal, follow these steps:
232232

233233
1. In the Azure portal, navigate to the Azure Policy service.
234234
1. Select **Compliance**.
235-
1. Filter the results for the name of the policy assignment that you created in the previous step. The report shows resources that are not in compliance with the policy.
236-
1. You can drill down into the report for additional details, including a list of storage accounts that are not in compliance.
235+
1. Filter the results for the name of the policy assignment that you created in the previous step. The report shows resources that aren't in compliance with the policy.
236+
1. You can drill down into the report for additional details, including a list of storage accounts that aren't in compliance.
237237

238238
:::image type="content" source="media/object-replication-prevent-cross-tenant-policies/compliance-report-cross-tenant-audit-effect-policy.png" alt-text="Screenshot showing compliance report for audit policy for blob cross-tenant object replication":::
239239

240240
## Use Azure Policy to enforce same-tenant replication policies
241241

242-
Azure Policy supports cloud governance by ensuring that Azure resources adhere to requirements and standards. To ensure that storage accounts in your organization disallow cross-tenant replication, you can create a policy that prevents the creation of a new storage account that allows cross-tenant object replication policies. The enforcement policy uses the Deny effect to prevent a request that would create or modify a storage account to allow cross-tenant object replication. The Deny policy will also prevent all configuration changes to an existing account if the cross-tenant object replication setting for that account is not compliant with the policy. For more information about the Deny effect, see [Understand Azure Policy effects](../../governance/policy/concepts/effects.md).
242+
Azure Policy supports cloud governance by ensuring that Azure resources adhere to requirements and standards. To ensure that storage accounts in your organization disallow cross-tenant replication, you can create a policy that prevents the creation of a new storage account that allows cross-tenant object replication policies. The enforcement policy uses the Deny effect to prevent a request that would create or modify a storage account to allow cross-tenant object replication. The Deny policy will also prevent all configuration changes to an existing account if the cross-tenant object replication setting for that account isn't compliant with the policy. For more information about the Deny effect, see [Understand Azure Policy effects](../../governance/policy/concepts/effects.md).
243243

244244
To create a policy with a Deny effect for cross-tenant object replication, follow the same steps described in [Use Azure Policy to audit for compliance](#use-azure-policy-to-audit-for-compliance), but provide the following JSON in the **policyRule** section of the policy definition:
245245

0 commit comments

Comments
 (0)