Azure subscriptions should have at least one Application Insights resource configured

Azure subscription contains at least one Application Insights resource collecting application telemetry (metrics, traces, logs) for monitored workloads. The check determines whether telemetry collection exists at the subscription level.

If Application Insights is missing, applications run with reduced observability, limiting detection of anomalies and attacks. This undermines integrity and accountability (fewer traces), degrades availability by slowing troubleshooting, and increases exposure to undetected data exfiltration or injection at the app layer.

What this control checks

Subscription has at least one Application Insights resource collecting application telemetry.

Audit evidence

Evidence that deployed resources meet this control: Prowler check appinsights_ensure_is_configured (prowler azure --checks appinsights_ensure_is_configured).

Framework-specific interpretation

PCI DSS v4.0: Mapped to 10.2.1 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...), 10.2.1.1 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...), 10.2.1.2 (Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of...) and 16 more clauses.

NIS2 Directive (EU 2022/2555): Mapped to 3.2.3.h (use of system resources, as well as their performance;) and 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;).

Framework mappings

The clauses this control is mapped to in each framework.

PCI DSS v4.0

5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

14 more clauses

10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
A3.5.1: Suspicious events are identified and responded to.

NIS2 Directive (EU 2022/2555)