Azure Shared Access Key / Web Hook Token
Detects Azure shared access key and webhook token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Engine
- universal
- Confidence
- medium
- Confidence justification
- Medium confidence: pattern matches common Azure key formats but may overlap with other Base64-encoded values. Corroborative keywords improve accuracy. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Partial
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
- Data categories
- credentials, security
- Scope
- specific
- Risk rating
- 10
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported
Pattern
(?i)(?:SharedAccessKey|webhook[._-]?token|hook[._-]?token|access[._-]?key)\s*[:=]\s*"?[A-Za-z0-9+/]{30,60}={0,2}"?Corroborative evidence keywords
shared access key, webhook, web hook, token, Azure, access key, SharedAccessKey, notification, api key, api_key, apikey, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential (+43 more)
Proximity: 300 characters
Should match
SharedAccessKey=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==— Azure shared access keywebhook_token="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij=="— Webhook token valueaccess_key="000000000000000000000000000000000000000000"— Access key with placeholder value
Should not match
SharedAccessKey=short— Too short to be a valid keySharedAccessKeyName=mypolicy— Key name, not key valuetemplate example placeholder record identifier— Template/sample context should be excluded even when anchor words are present
Known false positives
- Azure documentation with placeholder shared access keys and webhook tokens. Mitigation: Check for common placeholder patterns and documentation context.
- Non-Azure webhook tokens from other platforms. Mitigation: Require proximity to Azure-specific keywords for differentiation.