{
    "properties": {
      "displayName": "Storage accounts should prevent shared key access",
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "description": "Audit requirement of Azure Active Directory (Azure AD) to authorize requests for your storage account. By default, requests can be authorized with either Azure Active Directory credentials, or by using the account access key for Shared Key authorization. Of these two types of authorization, Azure AD provides superior security and ease of use over Shared Key, and is recommended by Microsoft.",
      "metadata": {
        "version": "1.0.0",
        "category": "Storage"
      },
      "parameters": {
        "effect": {
          "type": "string",
          "defaultValue": "Audit",
          "allowedValues": [
            "Audit",
            "Deny",
            "Disabled"
          ],
          "metadata": {
            "displayName": "Effect",
            "description": "The effect determines what happens when the policy rule is evaluated to match"
          }
        }
      },
      "policyRule": {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Storage/storageAccounts"
            },
            {
              "field": "Microsoft.Storage/storageAccounts/allowSharedKeyAccess",
              "equals": "true"
            }
          ]
        },
        "then": {
          "effect": "[parameters('effect')]"
        }
      }
    },
    "id": "/providers/Microsoft.Authorization/policyDefinitions/8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54",
    "name": "8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54"
  }