diff --git a/data/data/azure/bootstrap/main.tf b/data/data/azure/bootstrap/main.tf
index abc75f73db6..84a4456495e 100644
--- a/data/data/azure/bootstrap/main.tf
+++ b/data/data/azure/bootstrap/main.tf
@@ -18,8 +18,9 @@ provider "azurerm" {
 }
 
 data "azurerm_storage_account" "storage_account" {
-  name                = var.storage_account_name
-  resource_group_name = var.resource_group_name
+  name                             = var.storage_account_name
+  resource_group_name              = var.resource_group_name
+  cross_tenant_replication_enabled = false
 }
 
 data "azurerm_storage_account_sas" "ignition" {
diff --git a/data/data/azure/vnet/main.tf b/data/data/azure/vnet/main.tf
index b71f994b7ec..099c52c8c0a 100644
--- a/data/data/azure/vnet/main.tf
+++ b/data/data/azure/vnet/main.tf
@@ -66,14 +66,15 @@ data "azurerm_user_assigned_identity" "keyvault_identity" {
 }
 
 resource "azurerm_storage_account" "cluster" {
-  name                            = "cluster${var.random_storage_account_suffix}"
-  resource_group_name             = data.azurerm_resource_group.main.name
-  location                        = var.azure_region
-  account_tier                    = var.azure_keyvault_name != "" ? "Premium" : "Standard"
-  account_replication_type        = "LRS"
-  min_tls_version                 = contains(local.environments_with_min_tls_version, var.azure_environment) ? "TLS1_2" : null
-  allow_nested_items_to_be_public = var.azure_keyvault_name != "" ? true : false
-  tags                            = var.azure_extra_tags
+  name                             = "cluster${var.random_storage_account_suffix}"
+  resource_group_name              = data.azurerm_resource_group.main.name
+  location                         = var.azure_region
+  account_tier                     = var.azure_keyvault_name != "" ? "Premium" : "Standard"
+  account_replication_type         = "LRS"
+  min_tls_version                  = contains(local.environments_with_min_tls_version, var.azure_environment) ? "TLS1_2" : null
+  allow_nested_items_to_be_public  = var.azure_keyvault_name != "" ? true : false
+  tags                             = var.azure_extra_tags
+  cross_tenant_replication_enabled = false
 
   dynamic "customer_managed_key" {
     for_each = var.azure_keyvault_name != "" ? [1] : []