Azure Storage: Recovering a soft-deleted storage account fails due to a Deny policy requiring allowSharedKeyAccess = false

Hemil Modi 0 Reputation points Microsoft Employee
2026-08-11T15:47:25.01+00:00

Scenario: I'm implementing a feature that must be able to restore a soft-deleted storage account programmatically. In our subscription, an Azure Policy with a Deny effect requires all storage accounts to have allowSharedKeyAccess = false (shared key / account key access disabled). Accounts are created compliantly with that property set to false. I need a supported, repeatable, policy-compliant way to recover a soft-deleted storage account along with its data.

Result / error: When I recover a soft-deleted account via the Portal "Restore" (recover deleted account), the operation fails with:
`Failed to restore storage account '<name>'. Error: 'Resource '<name>' was disallowed by

policy. Reasons: 'storage account key access should be disabled'. See error details for

policy resource IDs.'`

Steps to reproduce:

  1. Create a StorageV2 account with allowSharedKeyAccess = false (compliant with the Deny policy).
  2. Delete the storage account (account soft-delete retention window active).
  3. Attempt to recover/restore the deleted account (Portal "Restore" or the account recover API).
  4. The operation is rejected by the Deny policy: storage account key access should be disabled.

Troubleshooting already done:

  • Confirmed the root cause appears to be that the recover/undelete operation re-provisions the account with default properties, where allowSharedKeyAccess defaults to true, and the recover call exposes no parameter to set it to false or preserve the original value — so it inherently violates the Deny policy.
  • Verified this is specific to the recover path: creating a new account with allowSharedKeyAccess = false passes the exact same policy. But recreating a new account is not a real restore — it comes back empty and the original data is lost.

Question: Is there a supported way to recover a soft-deleted storage account with allowSharedKeyAccess = false (by passing the property on recover, or preserving the account's pre-deletion value)? If not, what is the recommended supported approach to restore a soft-deleted storage account and its data in a subscription that enforces a Deny policy on shared key access, without temporarily weakening the policy?

Azure Storage
Azure Storage

Globally unique resources that provide access to data management services and serve as the parent namespace for the services.

0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Vinodh247-1375 44,716 Reputation points Volunteer Moderator
    2026-08-11T16:12:54.4033333+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    No, the storage-account recover/undelete operation does not accept or preserve allowSharedKeyAccess, and it defaults to true, which causes a Deny policy requiring allowSharedKeyAccess - false to block the recovery.

    Practical options now:

    Preferred: Don’t rely on account-level soft-delete as your primary recovery method. Use data-level protections (blob soft delete, versioning, point-in-time restore where available) or replicate critical data to a second, policy-compliant account so you can restore data without recovering the original account.

    Workaround: If full account recovery is mandatory and you can temporarily relax policy, create a narrowly scoped policy exemption for the recovery operation, restore the account, immediately set allowSharedKeyAccess = false, then remove the exemption. This is operationally supported but temporarily weakens the policy.

    If continuous Deny enforcement is required: There is currently no supported account-recovery path that meets that constraint; you must use an independent data-recovery strategy.

    Better open a support ticket or product feedback request asking that the recover API preserve or accept security properties (for example, allowSharedKeyAccess) during recovery. The current behavior creates a policy deadlock: an originally compliant account cannot be recovered without temporarily weakening the policy.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.