Azure SignalR Access Key
Detects Azure SignalR Service access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: service.signalr.net domain combined with AccessKey parameter is structurally unique to Azure SignalR Service. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
- Data categories
- credentials, security
- Scope
- specific
- Risk rating
- 10
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported
Pattern
(?i)Endpoint=https?://[^;]*\.service\.signalr\.net[^;]*;\s*AccessKey\s*=\s*[A-Za-z0-9+/]{30,60}={0,2}Corroborative evidence keywords
SignalR, signalr, service.signalr.net, AccessKey, real-time, connection string, access key, hub, api key, api_key, apikey, access token, auth token, authorization, bearer, conn str, connectionstring, cookie, credential, database (+43 more)
Proximity: 300 characters
Should match
Endpoint=https://myapp.service.signalr.net;AccessKey=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==— SignalR Service connection stringEndpoint=https://test.service.signalr.net;AccessKey=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh==— SignalR connection with mixed charactersEndpoint=https://prod-hub.service.signalr.net;AccessKey=00000000000000000000000000000000000000==— SignalR connection with placeholder key
Should not match
Endpoint=https://myapp.service.signalr.net— SignalR endpoint without access keyEndpoint=https://myapp.azurewebsites.net;AccessKey=test— Non-SignalR endpoint with AccessKeytemplate example placeholder record identifier— Template/sample context should be excluded even when anchor words are present
Known false positives
- Azure SignalR documentation with placeholder connection strings. Mitigation: Check for common placeholder values and documentation context.
- Development SignalR instances with non-production credentials. Mitigation: Flag for review regardless since connection strings reveal infrastructure details.