Check for SMB Protocol Version

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

04 From the Type equals all filter box, choose Equals, select Storage account, and choose Apply to list only the Storage accounts available in the selected Azure subscription.

05 Click on the name (link) of the Azure Storage account that you want to examine.

06 In the resource navigation panel, under Data storage, choose File shares to access the configuration settings available for Azure File Shares in the selected Storage account.

07 In the File share settings section, click on the Security attribute value (link) and check the SMB protocol versions list to determine the SMB versions enabled for your Azure File Shares. If SMB 3.1.1 is not the only SMB protocol version enabled, the File Shares within the selected Azure Storage account are using outdated and potentially vulnerable SMB protocol versions.

08 Repeat steps no. 5 – 7 for each Azure Storage account available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run storage account list command (Windows/macOS/Linux) with custom output filters to describe the identifier (name) of each storage account provisioned in the selected subscription:

az storage account list
	--query '[*].name'

05 The command output should return the requested storage account names:

[
	"project5storageaccount",
	"cloudaistorageaccount"
]

06 Run storage account file-service-properties show command (Windows/macOS/Linux) with the name of the Azure Storage account that you want to examine as the identifier parameter and custom output filters to describe the SMB protocol version(s) enabled for the Azure File Shares within the selected Storage account:

az storage account file-service-properties show
	--account-name project5storageaccount
	--query 'protocolSettings.smb.versions'

07 The command output should return the SMB protocol version(s) enabled for your File Shares:

"SMB2.1;SMB3.0;SMB3.1.1;"

08 Repeat steps no. 6 and 7 for each Azure Storage account provisioned in the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equals all filter box and choose Apply.

04 From the Type equals all filter box, choose Equals, select Storage account, and choose Apply to list only the Storage accounts available in the selected Azure subscription.

05 Click on the name (link) of the Azure Storage account that you want to examine.

06 In the resource navigation panel, under Data storage, choose File shares to access the configuration settings available for Azure File Shares in the selected Storage account.

07 In the File share settings section, click on the Security attribute value (link), and perform the following actions:

1. If Profile is set to Maximum compatibility, set the Profile to Maximum security or Custom. If you selected Custom, ensure that SMB 3.1.1 is the only SMB version selected from the SMB protocol versions list.
2. If Profile is set to Custom, ensure that SMB 3.1.1 is the only SMB version selected from the SMB protocol versions list.
3. Choose Save to apply the configuration changes. This will enable the latest SMB protocol version only (i.e., SMB 3.1.1) for the File Shares in the selected Azure Storage account.

08 Repeat steps no. 5 – 7 for each Azure Storage account available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run storage account file-service-properties update command (Windows/macOS/Linux) with the name of the Azure Storage account that you want to configure as the identifier parameter, to enable the latest SMB protocol version only (i.e., SMB 3.1.1) for the File Shares in the selected Storage account:

az storage account file-service-properties update
	--account-name project5storageaccount
	--versions SMB3.1.1

05 The command output should return the configuration information available for the modified resource:

{
	"cors": null,
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/project5storageaccount/fileServices/default",
	"name": "default",
	"protocolSettings": {
		"smb": {
			"authenticationMethods": "NTLMv2;Kerberos;",
			"channelEncryption": "AES-128-CCM;AES-128-GCM;AES-256-GCM;",
			"kerberosTicketEncryption": "RC4-HMAC;AES-256;",
			"multichannel": null,
			"versions": "SMB3.1.1"
		}
	},
	"resourceGroup": "cloud-shell-storage-westeurope",
	"shareDeleteRetentionPolicy": {
		"allowPermanentDelete": null,
		"days": null,
		"enabled": false
	},
	"sku": null,
	"type": "Microsoft.Storage/storageAccounts/fileServices"
}

06 Repeat steps no. 4 and 5 for each Azure Storage account provisioned in the selected subscription.

07 Repeat steps no. 3 – 6 for each subscription created in your Microsoft Azure cloud account.