compliance.tf
Azure Compliance FrameworksSpecialized Frameworks

CIS Azure Benchmark v2.1.0

Controls by Category

1.1.1 Ensure Security Defaults is enabled on Microsoft Entra ID (1 control)

Microsoft Entra ID tenants should have 'security defaults' enabled

1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users (1 control)

Privileged Microsoft Entra ID users should have multifactor authentication enabled

1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users (1 control)

Non-privileged Microsoft Entra ID users should have multifactor authentication enabled

1.10 Ensure `User consent for applications` is set to `Do not allow user consent` (1 control)

Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'

1.11 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers' (1 control)

Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'

1.13 Ensure That 'Users Can Register Applications' Is Set to 'No' (1 control)

Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'

1.14 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (1 control)

Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'

1.15 Ensure that 'Guest invite restrictions' is set to Only users assigned to specific admin roles can invite guest users (1 control)

Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'

1.18 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' (1 control)

Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'

1.2.1 Ensure Trusted Locations Are Defined (1 control)

Microsoft Entra ID conditional access policies should have trusted locations configured

1.2.6 Ensure Multifactor Authentication is Required for Windows Azure Service Management API (2 controls)

Azure Service Management API should require multifactor authenticationAzure Management should require multifactor authentication

1.20 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' (1 control)

Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'

1.22 Ensure That No Custom Subscription Administrator Roles Exist (2 controls)

Azure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissions

1.23 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks (1 control)

Azure subscriptions should have a custom role for administering resource locks

1.25 Ensure fewer than 5 users have global administrator assignment (1 control)

Microsoft Entra ID tenants should limit Global Administrators to fewer than 5

1.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes' (1 control)

Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'

1.4 Ensure Guest Users Are Reviewed on a Regular Basis (1 control)

Guest users should have access reviews configured monthly

2.1.1 Ensure That Microsoft Defender for Servers Is Set to 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Servers enabled

2.1.10 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On' (1 control)

Azure subscriptions should have Azure Defender for DNS enabled

2.1.11 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' (1 control)

Azure subscriptions should have Azure Defender for Resource Manager enabled

2.1.12 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' (1 control)

Virtual machines should have system updates installed

2.1.13 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' (1 control)

Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default

2.1.14 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' (1 control)

Azure subscriptions should have auto provisioning of the Log Analytics agent enabled

2.1.15 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On' (1 control)

Virtual machines should have a vulnerability assessment solution enabled

2.1.16 Ensure that Auto provisioning of 'Microsoft Defender for Containers components' is Set to 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Containers enabled

2.1.17 Ensure That 'All users with the following roles' is set to 'Owner' (1 control)

Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled

2.1.18 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1 control)

Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email

2.1.19 Ensure That 'Notify about alerts with the following severity' is Set to 'High' (1 control)

Azure subscriptions should have email notifications for high severity alerts enabled

2.1.2 Ensure That Microsoft Defender for App Services Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for App Service enabled

2.1.20 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected (1 control)

Microsoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected

2.1.21 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected (1 control)

Security Center should have Windows Defender ATP (WDATP) integration selected

2.1.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled

2.1.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' (1 control)

Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled

2.1.5 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for open-source relational databases enabled

2.1.6 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled

2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Storage enabled

2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On' (2 controls)

Azure subscriptions should have Microsoft Defender for container registries enabledAzure subscriptions should have Microsoft Defender for Containers enabled

2.1.9 Ensure That Microsoft Defender for Key Vault Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for Key Vault enabled

2.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On' (1 control)

Azure subscriptions should have Microsoft Defender for IoT Hub enabled

3.1 Ensure that 'Secure transfer required' is set to 'Enabled' (1 control)

Storage accounts should have secure transfer enabled

3.10 Ensure Private Endpoints are used to access Storage Accounts (1 control)

Storage accounts should use private link

3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage (2 controls)

Storage accounts should have soft delete enabled for both blobs and containersAzure Blob Storage accounts should have soft delete enabled for containers

3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (CMK) (3 controls)

Storage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryption

3.13 Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests (1 control)

Storage account Blob services should have Storage logging enabled for read, write, and delete requests

3.14 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests (1 control)

Storage account Table services should have Storage Logging enabled for 'Read', 'Write', and 'Delete' requests

3.15 Ensure the Minimum TLS version for storage accounts is set to Version 1.2 (1 control)

Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'

3.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled` (1 control)

Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'

3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled' (1 control)

Storage accounts should have infrastructure encryption enabled

3.4 Ensure that Storage Account Access Keys are Periodically Regenerated (1 control)

Storage accounts should each have 'Enable key rotation reminders' enabled

3.5 Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests (1 control)

Storage account Queue services should have Storage logging enabled for read, write, and delete requests

3.7 Ensure that 'Public Network Access' is `Disabled' for storage accounts (1 control)

Storage accounts should prohibit public access

3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny (3 controls)

Storage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network access

3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access (1 control)

Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled

4.1.1 Ensure that 'Auditing' is set to 'On' (1 control)

SQL servers should have auditing enabled

4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) (1 control)

SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)

4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key (1 control)

SQL servers should use customer-managed keys to encrypt data at rest

4.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers (2 controls)

SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured

4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database (2 controls)

SQL databases should have transparent data encryption enabledSQL databases should have Transparent Data Encryption enabled

4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days' (3 controls)

SQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or more

4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server (2 controls)

PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'PostgreSQL servers should have 'Enforce SSL connection' enabled

4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL servers should have 'log_checkpoints' set to 'ON'PostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'

4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL flexible servers should have log_connections enabledPostgreSQL servers should have 'log_connections' set to 'ON'

4.3.4 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL flexible servers should have log_disconnections enabledPostgreSQL servers should have 'log_disconnections' set to 'ON'

4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server (2 controls)

PostgreSQL servers should have 'connection_throttling' set to 'ON'PostgreSQL flexible servers should have 'connection_throttle.enable' set to 'ON'

4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server (2 controls)

PostgreSQL servers should have 'log_retention_days' set to greater than 3 daysPostgreSQL flexible servers should have 'logfiles.retention_days' set to greater than 3 days

4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled (2 controls)

PostgreSQL servers should have 'Allow access to Azure services' disabledPostgreSQL flexible servers should have 'Allow public access from any Azure service within Azure to this server' disabled

4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled' (1 control)

PostgreSQL servers should have infrastructure encryption enabled

4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server (2 controls)

MySQL flexible servers should have 'require_secure_transport' set to 'ON'MySQL servers should have 'Enforce SSL connection' enabled

4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' (or higher) for MySQL flexible Database Server (1 control)

MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher

4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server (1 control)

MySQL servers should have 'TLS Version' set to 'TLSV1.2' or higher

4.4.3 Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server (2 controls)

MySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL servers should have 'audit_log_enabled' set to 'ON'

4.4.4 Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server (2 controls)

MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'MySQL servers should have 'audit_log_events' configured to include 'CONNECTION'

4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks (2 controls)

Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networksAzure Cosmos DB accounts should have firewall rules

4.5.2 Ensure That Private Endpoints Are Used Where Possible (1 control)

Cosmos DB accounts should use private link

4.5.3 Use Entra ID Client Authentication and Azure RBAC where possible. (1 control)

Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)

5.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs (1 control)

Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs

5.1.2 Ensure Diagnostic Setting captures appropriate categories (2 controls)

Azure Monitor diagnostic settings should have appropriate log categories configuredAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs

5.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (1 control)

Storage accounts containing activity log containers should use customer-managed keys for encryption

5.1.4 Ensure that logging for Azure Key Vault is 'Enabled' (1 control)

Key vaults should have resource logs enabled

5.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics (2 controls)

Flow log resources should have flow logging enabledNetwork security groups should have flow logs captured and sent to Log Analytics

5.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled (1 control)

App Service apps should have 'HTTP logs' enabled

5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create Policy Assignment

5.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Public IP Address rule

5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment

5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group

5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group

5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution

5.2.6 Ensure that Activity Log Alert exists for Delete Security Solution (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete Security Solution

5.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update SQL Server Firewall Rule

5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Delete SQL Server Firewall Rule

5.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule (1 control)

Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule

5.3.1 Ensure Application Insights are Configured (1 control)

Azure subscriptions should have at least one Application Insights resource configured

5.5 Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads) (4 controls)

Network load balancers should use standard SKUs as a minimumNetwork public IPs should use standard SKUs as a minimumVirtual network gateways should use standard SKUs as a minimumAzure Cache for Redis should use standard SKUs as a minimum

6.1 Ensure that RDP access from the Internet is evaluated and restricted (1 control)

Network security groups should have RDP access restrictions configured

6.2 Ensure that SSH access from the Internet is evaluated and restricted (1 control)

Network security groups should have SSH access from the internet restricted

6.3 Ensure that UDP access from the Internet is evaluated and restricted (1 control)

Network security groups should have UDP services restricted from the internet

6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted (2 controls)

Network security groups should prohibit inbound HTTP (port 80) access from the internetNetwork security groups should have HTTP(S) access on ports 80 and 443 from the internet evaluated and restricted

6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (2 controls)

Network security group flow logs should have retention set to greater than 90 daysFlow log resources should have flow logging enabled

6.6 Ensure that Network Watcher is 'Enabled' (1 control)

Azure subscriptions should have Network Watcher enabled

7.1 Ensure an Azure Bastion Host Exists (1 control)

Azure subscriptions should have at least one Azure Bastion host

7.2 Ensure Virtual Machines are utilizing Managed Disks (2 controls)

Virtual machines should use managed disks for OS and data disksVirtual machines should use managed disks

7.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK) (1 control)

OS and data disks should use customer-managed keys for encryption

7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) (2 controls)

Unattached managed disks should be encrypted with ADE or customer-managed keysUnattached managed disks should use customer-managed keys (CMK) for encryption

7.6 Ensure that Endpoint Protection for all Virtual Machines is installed (1 control)

Virtual machines should have endpoint protection installed

7.8 Ensure only MFA enabled identities can access privileged Virtual Machine (1 control)

Microsoft Entra ID users with VM access should have multifactor authentication enabled

7.9 Ensure Trusted Launch is enabled on Virtual Machines (1 control)

Virtual machines should have Trusted Launch enabled

8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults (1 control)

RBAC key vaults should have 'Expiration Date' configured for all keys

8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults. (1 control)

Non-RBAC key vaults should have 'Expiration Date' configured for all keys

8.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults (1 control)

RBAC key vaults should have 'Expiration Date' configured for all secrets

8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults (1 control)

Non-RBAC key vaults should have 'Expiration Date' configured for all secrets

8.5 Ensure the Key Vault is Recoverable (3 controls)

Key vaults should have deletion protection enabledKey vaults should have soft delete enabledKey vaults should have recoverability configured

8.6 Enable Role Based Access Control for Azure Key Vault (1 control)

Key vaults should have Role-Based Access Control (RBAC) enabled

8.7 Ensure that Private Endpoints are Used for Azure Key Vault (1 control)

Azure Key Vaults should use private link

8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services (1 control)

Key vault keys should have automatic rotation enabled

9.1 Ensure App Service Authentication is set up for apps in Azure App Service (1 control)

App Service apps should have App Service authentication configured

9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service (2 controls)

App Service API apps should require HTTPS for all accessApp Service web apps should require HTTPS for all access

9.3 Ensure Web App is using the latest version of TLS encryption (2 controls)

App Service apps should use the latest TLS versionApp Service web apps should use the latest TLS version

9.4 Ensure that Register with Entra ID is enabled on App Service (2 controls)

App Service apps should have 'Register with Azure Active Directory' enabledApp Service apps should use managed identity

9.5 Ensure That 'PHP version' is the Latest, If Used to Run the Web App (1 control)

App Service web apps should use the latest 'PHP version' when PHP is part of the app

9.6 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App (1 control)

App Service web apps should use the latest 'Python version' when Python is part of the app

9.7 Ensure that 'Java version' is the latest, if used to run the Web App (1 control)

App Service web apps should use the latest 'Java version' when Java is part of the app

9.8 Ensure that 'HTTP Version' is the Latest, if Used to Run the Web App (1 control)

App Service web apps should use the latest 'HTTP Version' when used to run the app

9.9 Ensure FTP deployments are Disabled (3 controls)

App Service API apps should require FTPS onlyApp Service apps should have FTP deployments disabledApp Service web apps should require FTPS

Related Frameworks

CIS Azure Benchmark v2.0.0 — 🟢 High overlap (96%)

CIS Azure Benchmark v3.0.0 — 🟢 High overlap (94%)

NIS2 Directive (EU 2022/2555) — 🟢 High overlap (70%)

CIS Azure Benchmark v2.0.0

Previous Page

CIS Azure Benchmark v3.0.0

Next Page

On this page

Controls by Category1.1.1 Ensure Security Defaults is enabled on Microsoft Entra ID (1)1.1.2 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users (1)1.1.3 Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users (1)1.10 Ensure `User consent for applications` is set to `Do not allow user consent` (1)1.11 Ensure 'User consent for applications' Is Set To 'Allow for Verified Publishers' (1)1.13 Ensure That 'Users Can Register Applications' Is Set to 'No' (1)1.14 Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects' (1)1.15 Ensure that 'Guest invite restrictions' is set to Only users assigned to specific admin roles can invite guest users (1)1.18 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' (1)1.2.1 Ensure Trusted Locations Are Defined (1)1.2.6 Ensure Multifactor Authentication is Required for Windows Azure Service Management API (2)1.20 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' (1)1.22 Ensure That No Custom Subscription Administrator Roles Exist (2)1.23 Ensure a Custom Role is Assigned Permissions for Administering Resource Locks (1)1.25 Ensure fewer than 5 users have global administrator assignment (1)1.3 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes' (1)1.4 Ensure Guest Users Are Reviewed on a Regular Basis (1)2.1.1 Ensure That Microsoft Defender for Servers Is Set to 'On' (1)2.1.10 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On' (1)2.1.11 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' (1)2.1.12 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' (1)2.1.13 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' (1)2.1.14 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' (1)2.1.15 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On' (1)2.1.16 Ensure that Auto provisioning of 'Microsoft Defender for Containers components' is Set to 'On' (1)2.1.17 Ensure That 'All users with the following roles' is set to 'Owner' (1)2.1.18 Ensure 'Additional email addresses' is Configured with a Security Contact Email (1)2.1.19 Ensure That 'Notify about alerts with the following severity' is Set to 'High' (1)2.1.2 Ensure That Microsoft Defender for App Services Is Set To 'On' (1)2.1.20 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected (1)2.1.21 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected (1)2.1.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On' (1)2.1.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' (1)2.1.5 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (1)2.1.6 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' (1)2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On' (1)2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On' (2)2.1.9 Ensure That Microsoft Defender for Key Vault Is Set To 'On' (1)2.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On' (1)3.1 Ensure that 'Secure transfer required' is set to 'Enabled' (1)3.10 Ensure Private Endpoints are used to access Storage Accounts (1)3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage (2)3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (CMK) (3)3.13 Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests (1)3.14 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests (1)3.15 Ensure the Minimum TLS version for storage accounts is set to Version 1.2 (1)3.17 Ensure that `Allow Blob Anonymous Access` is set to `Disabled` (1)3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled' (1)3.4 Ensure that Storage Account Access Keys are Periodically Regenerated (1)3.5 Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests (1)3.7 Ensure that 'Public Network Access' is `Disabled' for storage accounts (1)3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny (3)3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access (1)4.1.1 Ensure that 'Auditing' is set to 'On' (1)4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) (1)4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key (1)4.1.4 Ensure that Microsoft Entra authentication is Configured for SQL Servers (2)4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database (2)4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days' (3)4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server (2)4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server (2)4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server (2)4.3.4 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server (2)4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server (2)4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server (2)4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled (2)4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled' (1)4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server (2)4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' (or higher) for MySQL flexible Database Server (1)4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server (1)4.4.3 Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server (2)4.4.4 Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server (2)4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks (2)4.5.2 Ensure That Private Endpoints Are Used Where Possible (1)4.5.3 Use Entra ID Client Authentication and Azure RBAC where possible. (1)5.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs (1)5.1.2 Ensure Diagnostic Setting captures appropriate categories (2)5.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (1)5.1.4 Ensure that logging for Azure Key Vault is 'Enabled' (1)5.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics (2)5.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled (1)5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment (1)5.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule (1)5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (1)5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group (1)5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group (1)5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution (1)5.2.6 Ensure that Activity Log Alert exists for Delete Security Solution (1)5.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule (1)5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule (1)5.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule (1)5.3.1 Ensure Application Insights are Configured (1)5.5 Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads) (4)6.1 Ensure that RDP access from the Internet is evaluated and restricted (1)6.2 Ensure that SSH access from the Internet is evaluated and restricted (1)6.3 Ensure that UDP access from the Internet is evaluated and restricted (1)6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted (2)6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' (2)6.6 Ensure that Network Watcher is 'Enabled' (1)7.1 Ensure an Azure Bastion Host Exists (1)7.2 Ensure Virtual Machines are utilizing Managed Disks (2)7.3 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK) (1)7.4 Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) (2)7.6 Ensure that Endpoint Protection for all Virtual Machines is installed (1)7.8 Ensure only MFA enabled identities can access privileged Virtual Machine (1)7.9 Ensure Trusted Launch is enabled on Virtual Machines (1)8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults (1)8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults. (1)8.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults (1)8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults (1)8.5 Ensure the Key Vault is Recoverable (3)8.6 Enable Role Based Access Control for Azure Key Vault (1)8.7 Ensure that Private Endpoints are Used for Azure Key Vault (1)8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services (1)9.1 Ensure App Service Authentication is set up for apps in Azure App Service (1)9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service (2)9.3 Ensure Web App is using the latest version of TLS encryption (2)9.4 Ensure that Register with Entra ID is enabled on App Service (2)9.5 Ensure That 'PHP version' is the Latest, If Used to Run the Web App (1)9.6 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App (1)9.7 Ensure that 'Java version' is the latest, if used to run the Web App (1)9.8 Ensure that 'HTTP Version' is the Latest, if Used to Run the Web App (1)9.9 Ensure FTP deployments are Disabled (3)Related Frameworks

Ask AI about this

Help improve this page