CIS Azure Benchmark v2.0.0

The CIS Microsoft Azure Foundations Benchmark is published by the Center for Internet Security (CIS). It provides prescriptive guidance for establishing a secure baseline configuration for Azure. It is for customers who plan to develop, deploy, assess, or secure solutions that incorporate Azure. CIS benchmarks are configuration baselines and best practices for securely configuring a system.

Controls by Category

1.1.1 Ensure Security Defaults is enabled on Azure Active Directory (1 control)

Microsoft Entra ID tenants should have 'security defaults' enabled

1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users (1 control)

Privileged Microsoft Entra ID users should have multifactor authentication enabled

1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users (1 control)

Non-privileged Microsoft Entra ID users should have multifactor authentication enabled

Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'

Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'

1.14 Ensure That 'Users Can Register Applications' Is Set to 'No' (1 control)

Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'

1.15 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (1 control)

Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'

1.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users' (1 control)

Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'

1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' (1 control)

Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'

1.2.1 Ensure Trusted Locations Are Defined (1 control)

Microsoft Entra ID conditional access policies should have trusted locations configured

1.2.6 Ensure Multi-factor Authentication is Required for Azure Management (1 control)

Azure Management should require multifactor authentication

1.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' (1 control)

Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'

1.23 Ensure That No Custom Subscription Administrator Roles Exist (2 controls)

Azure subscriptions should prohibit Custom Subscription Administrator roles Custom roles should not grant overly permissive subscription permissions

1.24 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks (2 controls)

Azure subscriptions should prohibit Custom Subscription Administrator roles Custom roles should not grant overly permissive subscription permissions

2.1.12 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' (1 control)

Azure subscriptions should have Azure Defender for Resource Manager enabled

2.1.13 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' (1 control)

Virtual machines should have system updates installed

2.1.14 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled' (2 controls)

Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default ASC Default policy settings should not have any setting set to 'Disabled'

2.1.15 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' (1 control)

Azure subscriptions should have auto provisioning of the Log Analytics agent enabled

2.1.16 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On' (1 control)

Virtual machines should have a vulnerability assessment solution enabled

2.1.18 Ensure That 'All users with the following roles' is set to 'Owner' (1 control)

Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

2.1.19 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1 control)

Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email

2.1.2 Ensure That Microsoft Defender for App Services Is Set To 'On' (2 controls)

Azure subscriptions should have Microsoft Defender for App Service enabled Azure subscriptions should have Microsoft Defender for Servers enabled

2.1.20 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1 control)

Azure subscriptions should have email notifications for high severity alerts enabled

2.1.21 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected (1 control)

Microsoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected

2.1.22 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected (1 control)

Security Center should have Windows Defender ATP (WDATP) integration selected

2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On' (5 controls)

Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled Azure subscriptions should have Microsoft Defender for Databases enabled Azure subscriptions should have Microsoft Defender for open-source relational databases enabled Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled

2.1.4 Ensure That Microsoft Defender for Azure SQL Databases Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled

2.1.5 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' (1 control)

Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled

2.1.6 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for open-source relational databases enabled

2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Storage enabled

2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On' (2 controls)

Azure subscriptions should have Microsoft Defender for container registries enabled Azure subscriptions should have Microsoft Defender for Containers enabled

2.1.9 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled

2.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for IoT Hub enabled

3.1 Ensure that 'Secure transfer required' is set to 'Enabled' (1 control)

Storage accounts should have secure transfer enabled

3.10 Ensure Private Endpoints are used to access Storage Accounts (1 control)

Storage accounts should use private link

3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage (2 controls)

Storage accounts should have soft delete enabled for both blobs and containers Azure Blob Storage accounts should have soft delete enabled for containers

3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (3 controls)

Storage accounts containing operational log containers should use customer-managed keys for encryption Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption Storage accounts should use customer-managed key for encryption

3.13 Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests (1 control)

Storage account Blob services should have Storage logging enabled for read, write, and delete requests

3.14 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests (1 control)

Storage account Table services should have Storage Logging enabled for 'Read', 'Write', and 'Delete' requests

3.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2' (1 control)

Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'

3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled' (1 control)

Storage accounts should have infrastructure encryption enabled

3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account (1 control)

Storage accounts should each have 'Enable key rotation reminders' enabled

3.4 Ensure that Storage Account Access Keys are Periodically Regenerated (1 control)

Storage accounts should each have 'Enable key rotation reminders' enabled

3.5 Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests (1 control)

Storage account Queue services should have Storage logging enabled for read, write, and delete requests

3.7 Ensure that 'Public access level' is disabled for storage accounts with blob containers (1 control)

Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'

3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny (3 controls)

Storage accounts should have the default network access rule set to deny Storage accounts should have network access restrictions configured Storage accounts should use virtual network rules to restrict network access

3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access (1 control)

Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled

4.1.1 Ensure that 'Auditing' is set to 'On' (1 control)

SQL servers should have auditing enabled

4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) (1 control)

SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)

4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key (1 control)

SQL servers should use customer-managed keys to encrypt data at rest

4.1.4 Ensure that Azure Active Directory Admin is Configured for SQL Servers (2 controls)

SQL servers should have a Microsoft Entra ID admin configured SQL servers should have an Azure Active Directory administrator configured

4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database (2 controls)

SQL databases should have transparent data encryption enabled SQL databases should have Transparent Data Encryption enabled

4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days' (3 controls)

SQL servers should have auditing enabled SQL servers should have 'Auditing' retention set to greater than 90 days SQL servers auditing to storage accounts should have retention set to 90 days or more

4.2.1 Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers (2 controls)

Critical SQL servers should have Microsoft Defender for SQL set to 'On'Unprotected Azure SQL servers should have Azure Defender for SQL enabled

4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account (1 control)

SQL servers should have vulnerability assessment enabled

4.2.3 Ensure that Vulnerability Assessment (VA) setting 'Periodic recurring scans' is set to 'on' for each SQL server (1 control)

SQL servers should have VA 'Periodic Recurring Scans' enabled

4.2.4 Ensure that Vulnerability Assessment (VA) setting 'Send scan reports to' is configured for a SQL server (1 control)

SQL servers should have VA 'Send scan reports to' configured

4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL Server (1 control)

SQL servers should each have VA 'Also send email notifications to admins and subscription owners' configured

4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server (2 controls)

PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'PostgreSQL servers should have 'Enforce SSL connection' enabled

4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'

4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL flexible servers should have log_connections enabled PostgreSQL servers should have 'log_connections' set to 'ON'

4.3.4 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL flexible servers should have log_disconnections enabled PostgreSQL servers should have 'log_disconnections' set to 'ON'

4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL servers should have 'connection_throttling' set to 'ON'PostgreSQL flexible servers should have 'connection_throttle.enable' set to 'ON'

4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server (2 controls)

PostgreSQL servers should have 'log_retention_days' set to greater than 3 days PostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days

4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled (2 controls)

PostgreSQL servers should have 'Allow access to Azure services' disabled PostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled

4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled' (1 control)

PostgreSQL servers should have infrastructure encryption enabled

4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server (2 controls)

MySQL flexible servers should have 'require_secure_transport' set to 'ON'MySQL servers should have 'Enforce SSL connection' enabled

4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server (2 controls)

MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher MySQL servers should have 'TLS Version' set to 'TLSV1.2' or higher

4.4.3 Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server (2 controls)

MySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL servers should have 'audit_log_enabled' set to 'ON'

4.4.4 Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server (2 controls)

MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'MySQL servers should have 'audit_log_events' configured to include 'CONNECTION'

4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks (1 control)

Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks

4.5.1 Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server (1 control)

Azure Cosmos DB accounts should have firewall rules

4.5.2 Ensure That Private Endpoints Are Used Where Possible (1 control)

Cosmos DB accounts should use private link

4.5.3 Use Azure Active Directory (AAD) Client Authentication and Azure RBAC where possible. (1 control)

Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)

5.1.1 Ensure that a 'Diagnostic Setting' exists (1 control)

Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs

5.1.2 Ensure Diagnostic Setting captures appropriate categories (2 controls)

Azure Monitor diagnostic settings should have appropriate log categories configured Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs

5.1.3 Ensure the Storage Container Storing the Activity Logs is not Publicly Accessible (1 control)

Storage containers storing activity logs should prohibit public access

5.1.4 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (1 control)

Storage accounts containing activity log containers should use customer-managed keys for encryption

5.1.5 Ensure that logging for Azure Key Vault is 'Enabled' (1 control)

Key vaults should have resource logs enabled

5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics (2 controls)

Flow log resources should have flow logging enabled Network security groups should have flow logs captured and sent to Log Analytics

5.1.7 Ensure that logging for Azure AppService 'HTTP logs' is enabled (1 control)

App Service apps should have 'HTTP logs' enabled

5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create Policy Assignment

5.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Public IP Address rule

5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment

5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group

5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group

5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution

5.2.6 Ensure that Activity Log Alert exists for Delete Security Solution (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Security Solution

5.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update SQL Server Firewall Rule

5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete SQL Server Firewall Rule

5.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule

5.3.1 Ensure Application Insights are Configured (1 control)

Azure subscriptions should have at least one Application Insights resource configured

5.5 Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads) (4 controls)

Network load balancers should use standard SKUs as a minimum Network public IPs should use standard SKUs as a minimum Virtual network gateways should use standard SKUs as a minimum Azure Cache for Redis should use standard SKUs as a minimum

6.1 Ensure that RDP access from the Internet is evaluated and restricted (1 control)

Network security groups should have RDP access restrictions configured

6.2 Ensure that SSH access from the Internet is evaluated and restricted (1 control)

Network security groups should have SSH access from the internet restricted

6.3 Ensure that UDP access from the Internet is evaluated and restricted (1 control)

Network security groups should have UDP services restricted from the internet

6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted (2 controls)

Network security groups should prohibit inbound HTTP (port 80) access from the internet Network security groups should have HTTP(S) access from the internet evaluated and restricted

6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (2 controls)

Network security group flow logs should have retention set to greater than 90 days Flow log resources should have flow logging enabled

6.6 Ensure that Network Watcher is 'Enabled' (2 controls)

Virtual networks should have Azure DDoS Protection Standard enabled Azure subscriptions should have Network Watcher enabled

7.1 Ensure an Azure Bastion Host Exists (1 control)

Azure subscriptions should have at least one Azure Bastion host

7.2 Ensure Virtual Machines are utilizing Managed Disks (2 controls)

Virtual machines should use managed disks for OS and data disks Virtual machines should use managed disks

7.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK) (1 control)

OS and data disks should use customer-managed keys for encryption

7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) (2 controls)

Unattached managed disks should be encrypted with ADE or customer-managed keys Unattached managed disks should use customer-managed keys (CMK) for encryption

7.6 Ensure that Endpoint Protection for all Virtual Machines is installed (1 control)

Virtual machines should have endpoint protection installed

8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults (1 control)

RBAC key vaults should have 'Expiration Date' configured for all keys

8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults. (1 control)

Non-RBAC key vaults should have 'Expiration Date' configured for all keys

8.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults (1 control)

RBAC key vaults should have 'Expiration Date' configured for all secrets

8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults (1 control)

Non-RBAC key vaults should have 'Expiration Date' configured for all secrets

8.5 Ensure the Key Vault is Recoverable (3 controls)

Key vaults should have deletion protection enabled Key vaults should have soft delete enabled Key vaults should have recoverability configured

8.6 Enable Role Based Access Control for Azure Key Vault (1 control)

Key vaults should have Role-Based Access Control (RBAC) enabled

8.7 Ensure that Private Endpoints are Used for Azure Key Vault (1 control)

Azure Key Vaults should use private link

8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services (1 control)

Key vault keys should have automatic rotation enabled

9.1 Ensure App Service Authentication is set up for apps in Azure App Service (1 control)

App Service apps should have App Service authentication configured

9.10 Ensure FTP deployments are Disabled (3 controls)

App Service API apps should require FTPS only App Service apps should have FTP deployments disabled App Service web apps should require FTPS

9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service (2 controls)

App Service API apps should require HTTPS for all access App Service web apps should require HTTPS for all access

9.3 Ensure Web App is using the latest version of TLS encryption (2 controls)

App Service apps should use the latest TLS version App Service web apps should use the latest TLS version

9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On' (3 controls)

App Service apps should have Client Certificates (Incoming client certificates) enabled App Service apps should have 'Client Certificates (Incoming client certificates)' enabled App Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'

9.5 Ensure that Register with Azure Active Directory is enabled on App Service (2 controls)

App Service apps should have 'Register with Azure Active Directory' enabled App Service apps should use managed identity

9.6 Ensure That 'PHP version' is the Latest, If Used to Run the Web App (1 control)

App Service web apps should use the latest 'PHP version' when PHP is part of the app

9.7 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App (1 control)

App Service web apps should use the latest 'Python version' when Python is part of the app

9.8 Ensure that 'Java version' is the latest, if used to run the Web App (1 control)

App Service web apps should use the latest 'Java version' when Java is part of the app

9.9 Ensure that 'HTTP Version' is the Latest, if Used to Run the Web App (1 control)

App Service web apps should use the latest 'HTTP Version' when used to run the app

CIS Azure Benchmark v2.1.0 — 🟢 High overlap (92%)

CIS Azure Benchmark v3.0.0 — 🟢 High overlap (86%)

NIS2 Directive (EU 2022/2555) — 🟢 High overlap (70%)