Check library
Microsoft Azure security checks
339 checks. 2 have an explained page so far (linked below); the rest follow.
CIS Microsoft Azure Foundations v6.0.0
127 controls
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 2.1.1 | Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet) | Analytics Services | Level 1 |
| 2.1.2 | Ensure that Network Security Groups are Configured for Databricks Subnets | Analytics Services | Level 1 |
| 2.1.3 | Ensure that Traffic is Encrypted Between Cluster Worker Nodes | Analytics Services | Level 2 |
| 2.1.4 | Ensure that Users and Groups are Synced from Microsoft Entra ID to Azure Databricks | Analytics Services | Level 1 |
| 2.1.5 | Ensure that Unity Catalog is Configured for Azure Databricks | Analytics Services | Level 1 |
| 2.1.6 | Ensure that Usage is Restricted and Expiry is Enforced for Databricks Personal Access Tokens | Analytics Services | Level 1 |
| 2.1.7 | Ensure that Diagnostic Log Delivery is Configured for Azure Databricks | Analytics Services | Level 1 |
| 2.1.8 | Ensure Critical Data in Azure Databricks is Encrypted with Customer-managed Keys (CMK) | Analytics Services | Level 2 |
| 2.1.9 | Ensure 'No Public IP' is Set to 'Enabled' | Analytics Services | Level 1 |
| 2.1.10 | Ensure 'Allow Public Network Access' is set to 'Disabled' | Analytics Services | Level 1 |
| 2.1.11 | Ensure Private Endpoints are used to access Azure Databricks workspaces | Analytics Services | Level 2 |
| 2.1.12 | Ensure Azure Databricks groups are reviewed periodically | Analytics Services | Level 1 |
| 3.1.1 | Ensure only MFA Enabled Identities can Access Privileged Virtual Machine | Compute Services | Level 2 |
| 5.4 | Ensure that No Custom Subscription Administrator Roles Exist | Identity Services | Level 1 |
| 5.5 | Ensure that a Custom Role is Assigned Permissions for Administering Resource Locks | Identity Services | Level 2 |
| 5.6 | Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one' | Identity Services | Level 2 |
| 5.7 | Ensure there are between 2 and 3 Subscription Owners | Identity Services | Level 1 |
| 5.1.1 | Ensure that 'security defaults' is Enabled in Microsoft Entra ID | Identity Services | Level 1 |
| 5.1.2 | Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes' | Identity Services | Level 1 |
| 5.1.3 | Ensure that 'multifactor authentication' is 'enabled' For All Users | Identity Services | Level 1 |
| 5.1.4 | Ensure that 'Allow users to remember multifactor authentication on devices they trust' is Disabled | Identity Services | Level 1 |
| 5.3.1 | Ensure that Azure Admin Accounts Are Not Used for Daily Operations | Identity Services | Level 1 |
| 5.3.2 | Ensure that Guest Users are Reviewed on a Regular Basis | Identity Services | Level 1 |
| 5.3.3 | Ensure That Use of the 'User Access Administrator' Role is Restricted | Identity Services | Level 1 |
| 5.3.4 | Ensure that All 'Privileged' Role Assignments are Periodically Reviewed | Identity Services | Level 1 |
| 5.3.5 | Ensure Disabled User Accounts do not Have Read, Write, or Owner Permissions | Identity Services | Level 1 |
| 5.3.6 | Ensure 'Tenant Creator' Role Assignments are Periodically Reviewed | Identity Services | Level 1 |
| 5.3.7 | Ensure All Non-privileged Role Assignments are Periodically Reviewed | Identity Services | Level 1 |
| 6.2 | Ensure that Resource Locks are set for Mission-Critical Azure Resources | Management and Governance Services | Level 2 |
| 6.1.4 | Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it | Management and Governance Services | Level 1 |
| 6.1.5 | Ensure Basic, Free, and Consumption SKUs are not used on Production artifacts requiring monitoring and SLA | Management and Governance Services | Level 2 |
| 6.1.1.1 | Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs | Management and Governance Services | Level 1 |
| 6.1.1.2 | Ensure Diagnostic Setting Captures Appropriate Categories | Management and Governance Services | Level 1 |
| 6.1.1.3 | Ensure the Storage Account Containing the Container with Activity Logs is Encrypted with Customer-managed Key (CMK) | Management and Governance Services | Level 2 |
| 6.1.1.4 | Ensure that Logging for Azure Key Vault is 'Enabled' | Management and Governance Services | Level 1 |
| 6.1.1.5 | Ensure that Network Security Group Flow Logs are Captured and Sent to Log Analytics | Management and Governance Services | Level 2 |
| 6.1.1.6 | Ensure that Virtual Network Flow Logs are Captured and Sent to Log Analytics | Management and Governance Services | Level 2 |
| 6.1.1.7 | Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Graph Activity Logs to an Appropriate Destination | Management and Governance Services | Level 2 |
| 6.1.1.8 | Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Entra Activity Logs to an Appropriate Destination | Management and Governance Services | Level 2 |
| 6.1.1.9 | Ensure that Intune Logs are Captured and Sent to Log Analytics | Management and Governance Services | Level 2 |
| 6.1.2.1 | Ensure that Activity Log Alert Exists for Create Policy Assignment | Management and Governance Services | Level 1 |
| 6.1.2.2 | Ensure that Activity Log Alert exists for Delete Policy Assignment | Management and Governance Services | Level 1 |
| 6.1.2.3 | Ensure that Activity Log Alert Exists for Create or Update Network Security Group | Management and Governance Services | Level 1 |
| 6.1.2.4 | Ensure that Activity Log Alert Exists for Delete Network Security Group | Management and Governance Services | Level 1 |
| 6.1.2.5 | Ensure that Activity Log Alert Exists for Create or Update Security Solution | Management and Governance Services | Level 1 |
| 6.1.2.6 | Ensure that Activity Log Alert Exists for Delete Security Solution | Management and Governance Services | Level 1 |
| 6.1.2.7 | Ensure that Activity Log Alert Exists for Create or Update SQL Server Firewall Rule | Management and Governance Services | Level 1 |
| 6.1.2.8 | Ensure that Activity Log Alert Exists for Delete SQL Server Firewall Rule | Management and Governance Services | Level 1 |
| 6.1.2.9 | Ensure that Activity Log Alert Exists for Create or Update Public IP Address rule | Management and Governance Services | Level 1 |
| 6.1.2.10 | Ensure that Activity Log Alert Exists for Delete Public IP Address rule | Management and Governance Services | Level 1 |
| 6.1.2.11 | Ensure that an Activity Log Alert Exists for Service Health | Management and Governance Services | Level 1 |
| 6.1.3.1 | Ensure Application Insights are Configured | Management and Governance Services | Level 2 |
| 7.1 | Ensure that RDP Access from the Internet is Evaluated and Restricted | Networking Services | Level 1 |
| 7.2 | Ensure that SSH Access from the Internet is Evaluated and Restricted | Networking Services | Level 1 |
| 7.3 | Ensure that UDP Port Access from the Internet is Evaluated and Restricted | Networking Services | Level 1 |
| 7.4 | Ensure that HTTP(S) Access from the Internet is Evaluated and Restricted | Networking Services | Level 1 |
| 7.5 | Ensure that Network Security Group Flow Log Retention Days is Set to Greater than or equal to 90 | Networking Services | Level 2 |
| 7.6 | Ensure that Network Watcher is 'Enabled' for Azure Regions That are in Use | Networking Services | Level 2 |
| 7.7 | Ensure that Public IP Addresses are Evaluated on a Periodic Basis | Networking Services | Level 1 |
| 7.8 | Ensure that Virtual Network Flow Log Retention Days is Set to Greater than or Equal to 90 | Networking Services | Level 2 |
| 7.9 | Ensure 'Authentication type' is Set to 'Azure Active Directory' only for Azure VPN Gateway Point-to-Site Configuration | Networking Services | Level 2 |
| 7.10 | Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Application Gateway | Networking Services | Level 2 |
| 7.11 | Ensure Subnets Are Associated with Network Security Groups | Networking Services | Level 1 |
| 7.12 | Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_2' or Higher on Azure Application Gateway | Networking Services | Level 1 |
| 7.13 | Ensure 'HTTP2' is Set to 'Enabled' on Azure Application Gateway | Networking Services | Level 1 |
| 7.14 | Ensure Request Body Inspection is Enabled in Azure Web Application Firewall policy on Azure Application Gateway | Networking Services | Level 2 |
| 7.15 | Ensure Bot Protection is Enabled in Azure Web Application Firewall Policy on Azure Application Gateway | Networking Services | Level 2 |
| 7.16 | Ensure Azure Network Security Perimeter is Used to Secure Azure Platform-as-a-service Resources | Networking Services | Level 2 |
| 8.5 | Ensure Azure DDoS Network Protection is Enabled on Virtual Networks | Security Services | Level 2 |
| 8.1.10 | Ensure that Microsoft Defender for Cloud is Configured to Check VM Operating Systems for Updates | Security Services | Level 1 |
| 8.1.11 | Ensure that non-deprecated Microsoft Cloud Security Benchmark policies are not set to 'Disabled' | Security Services | Level 1 |
| 8.1.12 | Ensure That 'All users with the following roles' is Set to 'Owner' | Security Services | Level 1 |
| 8.1.13 | Ensure 'Additional email addresses' is Configured with a Security Contact Email | Security Services | Level 1 |
| 8.1.14 | Ensure that 'Notify about alerts with the following severity (or higher)' is Enabled | Security Services | Level 1 |
| 8.1.15 | Ensure that 'Notify about attack paths with the following risk level (or higher)' is Enabled | Security Services | Level 1 |
| 8.1.16 | Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is Enabled | Security Services | Level 2 |
| 8.1.1.1 | Ensure Microsoft Defender CSPM is Set to 'On' | Security Services | Level 2 |
| 8.1.2.1 | Ensure Microsoft Defender for APIs is Set to 'On' | Security Services | Level 2 |
| 8.1.3.1 | Ensure that Defender for Servers is Set to 'On' | Security Services | Level 2 |
| 8.1.3.2 | Ensure that 'Vulnerability assessment for machines' Component Status is set to 'On' | Security Services | Level 2 |
| 8.1.3.3 | Ensure that 'Endpoint protection' Component Status is set to 'On' | Security Services | Level 2 |
| 8.1.3.4 | Ensure that 'Agentless scanning for machines' Component Status is Set to 'On' | Security Services | Level 2 |
| 8.1.3.5 | Ensure that 'File Integrity Monitoring' Component Status is Set to 'On' | Security Services | Level 2 |
| 8.1.4.1 | Ensure That Microsoft Defender for Containers Is Set To 'On' | Security Services | Level 2 |
| 8.1.5.1 | Ensure That Microsoft Defender for Storage Is Set To 'On' | Security Services | Level 2 |
| 8.1.5.2 | Ensure Advanced Threat Protection Alerts for Storage Accounts Are Monitored | Security Services | Level 2 |
| 8.1.6.1 | Ensure That Microsoft Defender for App Services Is Set To 'On' | Security Services | Level 2 |
| 8.1.7.1 | Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' | Security Services | Level 2 |
| 8.1.7.2 | Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' | Security Services | Level 2 |
| 8.1.7.3 | Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On' | Security Services | Level 2 |
| 8.1.7.4 | Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' | Security Services | Level 2 |
| 8.1.8.1 | Ensure That Microsoft Defender for Key Vault Is Set To 'On' | Security Services | Level 2 |
| 8.1.9.1 | Ensure That Microsoft Defender for Resource Manager Is Set To 'On' | Security Services | Level 2 |
| 8.2.1 | Ensure That Microsoft Defender for IoT Hub Is Set To 'On' | Security Services | Level 2 |
| 8.3.1 | Ensure that the Expiration Date is Set for all Keys in Key Vaults using RBAC | Security Services | Level 1 |
| 8.3.2 | Ensure that the Expiration Date is set for All Keys in Key Vaults using access policies (legacy) | Security Services | Level 1 |
| 8.3.3 | Ensure that the Expiration Date is set for All Secrets in Key Vaults using RBAC | Security Services | Level 1 |
| 8.3.4 | Ensure that the Expiration Date is set for All Secrets in Key Vaults using access policies (legacy) | Security Services | Level 1 |
| 8.3.5 | Ensure 'Purge protection' is Set to 'Enabled' | Security Services | Level 1 |
| 8.3.6 | Ensure that Role Based Access Control for Azure Key Vault is Enabled | Security Services | Level 2 |
| 8.3.7 | Ensure Public Network Access is Disabled | Security Services | Level 1 |
| 8.3.8 | Ensure Private Endpoints are Used to Access Azure Key Vault | Security Services | Level 2 |
| 8.3.9 | Ensure Automatic Key Rotation is Enabled within Azure Key Vault | Security Services | Level 2 |
| 8.3.10 | Ensure that Azure Key Vault Managed HSM is Used when Required | Security Services | Level 2 |
| 8.3.11 | Ensure Certificate 'Validity Period (in months)' is Less Than or Equal to '12' | Security Services | Level 1 |
| 8.4.1 | Ensure an Azure Bastion Host Exists | Security Services | Level 2 |
| 9.1.1 | Ensure Soft Delete for Azure File Shares is Enabled | Storage Services | Level 1 |
| 9.1.2 | Ensure 'SMB protocol version' is Set to 'SMB 3.1.1' or Higher for SMB file shares | Storage Services | Level 1 |
| 9.1.3 | Ensure 'SMB channel encryption' is Set to 'AES-256-GCM' or Higher for SMB file shares | Storage Services | Level 1 |
| 9.2.1 | Ensure That Soft Delete for Blobs on Azure Blob Storage Storage Accounts is Enabled | Storage Services | Level 1 |
| 9.2.2 | Ensure that Soft Delete for Containers on Azure Blob Storage Storage Accounts is Enabled | Storage Services | Level 1 |
| 9.2.3 | Ensure 'Versioning' is Set to 'Enabled' on Azure Blob Storage Storage Accounts | Storage Services | Level 2 |
| 9.3.4 | Ensure that 'Secure transfer required' is Set to 'Enabled' | Storage Services | Level 1 |
| 9.3.5 | Ensure 'Allow trusted Microsoft services to access this resource' is Enabled for Storage Account Access | Storage Services | Level 2 |
| 9.3.6 | Ensure the 'Minimum TLS version' for Storage Accounts is Set to 'Version 1.2' | Storage Services | Level 1 |
| 9.3.7 | Ensure 'Cross Tenant Replication' is Not Enabled | Storage Services | Level 1 |
| 9.3.8 | Ensure that 'Allow Blob Anonymous Access' is Set to 'Disabled' | Storage Services | Level 1 |
| 9.3.9 | Ensure Azure Resource Manager Delete Locks are Applied to Azure Storage Accounts | Storage Services | Level 1 |
| 9.3.10 | Ensure Azure Resource Manager ReadOnly Locks are Considered for Azure Storage Accounts | Storage Services | Level 2 |
| 9.3.11 | Ensure Redundancy is Set to 'geo-redundant storage (GRS)' on Critical Azure Storage Accounts | Storage Services | Level 2 |
| 9.3.1.1 | Ensure That 'Enable key rotation reminders' is Enabled for Each Storage Account | Storage Services | Level 1 |
| 9.3.1.2 | Ensure That Storage Account Access keys are Periodically Regenerated | Storage Services | Level 1 |
| 9.3.1.3 | Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled' | Storage Services | Level 1 |
| 9.3.2.1 | Ensure Private Endpoints are Used to Access Storage Accounts | Storage Services | Level 2 |
| 9.3.2.2 | Ensure that 'Public Network Access' is 'Disabled' for Storage Accounts | Storage Services | Level 1 |
| 9.3.2.3 | Ensure Default Network Access Rule for Storage Accounts is Set to Deny | Storage Services | Level 1 |
| 9.3.3.1 | Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is Set to 'Enabled' | Storage Services | Level 1 |
CIS Microsoft Azure Compute Services v2.0.0
99 controls · individual check pages follow once each section's service is confirmed
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 2.5 | Ensure Azure Key Vaults are Used to Store Secrets | Section 2 | Level 2 |
| 2.6 | Ensure App Service Environment is deployed with an internal load balancer | Section 2 | Level 2 |
| 2.7 | Ensure App Service Environment is provisioned with v3 or higher | Section 2 | Level 1 |
| 2.8 | Ensure App Service Environment has internal encryption enabled | Section 2 | Level 2 |
| 2.9 | Ensure App Service Environment has TLS 1.0 and 1.1 disabled | Section 2 | Level 1 |
| 2.10 | Ensure App Service Environment has TLS cipher suite ordering configured | Section 2 | Level 1 |
| 2.1.1 | Ensure 'Java version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.1.2 | Ensure 'Python version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.1.3 | Ensure 'PHP version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.1.4 | Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' | Section 2 | Level 1 |
| 2.1.5 | Ensure 'FTP State' is set to 'FTPS only' or 'Disabled' | Section 2 | Level 1 |
| 2.1.6 | Ensure 'HTTP version' is set to '2.0' (if in use) | Section 2 | Level 1 |
| 2.1.7 | Ensure 'HTTPS Only' is set to 'On' | Section 2 | Level 1 |
| 2.1.8 | Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher | Section 2 | Level 1 |
| 2.1.9 | Ensure end-to-end TLS encryption is enabled | Section 2 | Level 1 |
| 2.1.10 | Ensure 'Remote debugging' is set to 'Off' | Section 2 | Level 1 |
| 2.1.11 | Ensure incoming client certificates are enabled and required (if in use) | Section 2 | Level 2 |
| 2.1.12 | Ensure 'App Service authentication' is set to 'Enabled' | Section 2 | Level 2 |
| 2.1.13 | Ensure managed identities are configured | Section 2 | Level 1 |
| 2.1.14 | Ensure public network access is disabled | Section 2 | Level 1 |
| 2.1.15 | Ensure App Service plan SKU supports private endpoints | Section 2 | Level 2 |
| 2.1.16 | Ensure private endpoints are used to access App Service apps | Section 2 | Level 2 |
| 2.1.17 | Ensure private endpoints used to access App Service apps use private DNS zones | Section 2 | Level 2 |
| 2.1.18 | Ensure app is integrated with a virtual network | Section 2 | Level 1 |
| 2.1.19 | Ensure configuration is routed through the virtual network integration | Section 2 | Level 2 |
| 2.1.20 | Ensure all traffic is routed through the virtual network | Section 2 | Level 1 |
| 2.1.21 | Ensure cross-origin resource sharing does not allow all origins | Section 2 | Level 2 |
| 2.2.1 | Ensure 'Java version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.2.2 | Ensure 'Python version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.2.3 | Ensure 'PHP version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.2.4 | Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' | Section 2 | Level 1 |
| 2.2.5 | Ensure 'FTP state' is set to 'FTPS only' or 'Disabled' | Section 2 | Level 1 |
| 2.2.6 | Ensure 'HTTP version' is set to '2.0' (if in use) | Section 2 | Level 1 |
| 2.2.7 | Ensure 'HTTPS Only' is set to 'On' | Section 2 | Level 1 |
| 2.2.8 | Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher | Section 2 | Level 1 |
| 2.2.9 | Ensure end-to-end TLS encryption is enabled | Section 2 | Level 1 |
| 2.2.10 | Ensure 'Remote debugging' is set to 'Off' | Section 2 | Level 1 |
| 2.2.11 | Ensure incoming client certificates are enabled and required (if in use) | Section 2 | Level 2 |
| 2.2.12 | Ensure managed identities are configured | Section 2 | Level 1 |
| 2.2.13 | Ensure public network access is disabled | Section 2 | Level 1 |
| 2.2.14 | Ensure deployment slot is integrated with a virtual network | Section 2 | Level 1 |
| 2.2.15 | Ensure configuration is routed through the virtual network integration | Section 2 | Level 2 |
| 2.2.16 | Ensure all traffic is routed through the virtual network | Section 2 | Level 1 |
| 2.2.17 | Ensure cross-origin resource sharing does not allow all origins | Section 2 | Level 2 |
| 2.3.1 | Ensure 'Java version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.3.2 | Ensure 'Python version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.3.3 | Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' | Section 2 | Level 1 |
| 2.3.4 | Ensure 'FTP state' is set to 'FTPS only' or 'Disabled' | Section 2 | Level 1 |
| 2.3.5 | Ensure 'HTTP version' is set to '2.0' (if in use) | Section 2 | Level 1 |
| 2.3.6 | Ensure 'HTTPS Only' is set to 'On' | Section 2 | Level 1 |
| 2.3.7 | Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher | Section 2 | Level 1 |
| 2.3.8 | Ensure end-to-end TLS encryption is enabled | Section 2 | Level 1 |
| 2.3.9 | Ensure 'Remote debugging' is set to 'Off' | Section 2 | Level 1 |
| 2.3.10 | Ensure incoming client certificates are enabled and required (if in use) | Section 2 | Level 2 |
| 2.3.11 | Ensure 'App Service authentication' is set to 'Enabled' | Section 2 | Level 2 |
| 2.3.12 | Ensure managed identities are configured | Section 2 | Level 1 |
| 2.3.13 | Ensure public network access is disabled | Section 2 | Level 1 |
| 2.3.14 | Ensure function app is integrated with a virtual network | Section 2 | Level 1 |
| 2.3.15 | Ensure configuration is routed through the virtual network integration | Section 2 | Level 2 |
| 2.3.16 | Ensure all traffic is routed through the virtual network | Section 2 | Level 1 |
| 2.3.17 | Ensure cross-origin resource sharing does not allow all origins | Section 2 | Level 2 |
| 2.4.1 | Ensure 'Java version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.4.2 | Ensure 'Python version' is currently supported (if in use) | Section 2 | Level 1 |
| 2.4.3 | Ensure 'Basic Authentication Publishing Credentials' are 'Disabled' | Section 2 | Level 1 |
| 2.4.4 | Ensure 'FTP state' is set to 'FTPS only' or 'Disabled' | Section 2 | Level 1 |
| 2.4.5 | Ensure 'HTTP version' is set to '2.0' (if in use) | Section 2 | Level 1 |
| 2.4.6 | Ensure 'HTTPS Only' is set to 'On' | Section 2 | Level 1 |
| 2.4.7 | Ensure 'Minimum Inbound TLS Version' is set to '1.2' or higher | Section 2 | Level 1 |
| 2.4.8 | Ensure end-to-end TLS encryption is enabled | Section 2 | Level 1 |
| 2.4.9 | Ensure 'Remote debugging' is set to 'Off' | Section 2 | Level 1 |
| 2.4.10 | Ensure incoming client certificates are enabled and required (if in use) | Section 2 | Level 2 |
| 2.4.11 | Ensure managed identities are configured | Section 2 | Level 1 |
| 2.4.12 | Ensure public network access is disabled | Section 2 | Level 1 |
| 2.4.13 | Ensure deployment slot is integrated with a virtual network | Section 2 | Level 1 |
| 2.4.14 | Ensure configuration is routed through the virtual network integration | Section 2 | Level 2 |
| 2.4.15 | Ensure all traffic is routed through the virtual network | Section 2 | Level 1 |
| 2.4.16 | Ensure cross-origin resource sharing does not allow all origins | Section 2 | Level 2 |
| 3.1 | Ensure Private Virtual Networks are used for Container Instances | Section 3 | Level 1 |
| 3.2 | Ensure a Managed Identity is used for interactions with other Azure services | Section 3 | Level 1 |
| 3.3 | Ensure the principle of least privilege is used when assigning roles to a Managed Identity | Section 3 | Level 1 |
| 4.1 | Ensure SSL is configured for CycleCloud | Section 4 | Level 1 |
| 15.1 | Ensure Batch account is set to use customer-managed keys to encrypt data | Section 15 | Level 2 |
| 15.2 | Ensure Batch pools disk encryption is set enabled | Section 15 | Level 1 |
| 15.3 | Ensure local authentication methods for accounts are disabled | Section 15 | Level 1 |
| 15.4 | Ensure Private endpoints are considered for Batch accounts | Section 15 | Level 2 |
| 15.5 | Ensure public network access is disabled for Batch accounts | Section 15 | Level 1 |
| 15.6 | Ensure private DNS zones for private endpoints that connect to Batch accounts are configured. | Section 15 | Level 2 |
| 15.7 | Ensure Diagnostics settings logs for Batch accounts are enabled | Section 15 | Level 1 |
| 20.1 | Ensure Virtual Machines are utilizing Managed Disks | Section 20 | Level 1 |
| 20.2 | Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK) | Section 20 | Level 2 |
| 20.3 | Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK) | Section 20 | Level 2 |
| 20.4 | Ensure that 'Disk Network Access' is NOT set to 'Enable public access from all networks' | Section 20 | Level 1 |
| 20.5 | Ensure that 'Enable Data Access Authentication Mode' is 'Checked' | Section 20 | Level 1 |
| 20.6 | Ensure that Only Approved Extensions Are Installed | Section 20 | Level 1 |
| 20.7 | Ensure that Endpoint Protection for all Virtual Machines is installed | Section 20 | Level 2 |
| 20.8 | [Legacy] Ensure that VHDs are Encrypted | Section 20 | Level 2 |
| 20.9 | Ensure only MFA enabled identities can access privileged Virtual Machine | Section 20 | Level 2 |
| 20.10 | Ensure Trusted Launch is enabled on Virtual Machines | Section 20 | Level 1 |
| 20.11 | Ensure that encryption at host is enabled | Section 20 | Level 1 |
CIS Microsoft Azure Database Services v2.0.0
49 controls · individual check pages follow once each section's service is confirmed
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 2.1 | Ensure 'Microsoft Entra Authentication' is 'Enabled' | Section 2 | Level 1 |
| 2.2 | Ensure that 'Allow access only via SSL' is set to 'Yes' | Section 2 | Level 1 |
| 2.3 | Ensure that 'Minimum TLS version' is set to TLS v1.2 (or higher) | Section 2 | Level 1 |
| 2.4 | Ensure that 'Access Policies' are Implemented and Reviewed Periodically | Section 2 | Level 2 |
| 2.5 | Ensure that 'System Assigned Managed Identity' is set to 'On' | Section 2 | Level 1 |
| 2.6 | Ensure that 'Public Network Access' is 'Disabled' | Section 2 | Level 2 |
| 2.7 | Ensure Azure Cache for Redis is Using a Private Link | Section 2 | Level 2 |
| 2.8 | Ensure that Azure Cache for Redis is Using Customer-Managed Keys | Section 2 | Level 2 |
| 2.9 | Ensure 'Access Keys Authentication' is set to 'Disabled' | Section 2 | Level 1 |
| 2.10 | Ensure 'Update Channel' is set to 'Stable' | Section 2 | Level 1 |
| 3.1 | Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks | Section 3 | Level 2 |
| 3.2 | Ensure that Cosmos DB uses Private Endpoints where possible | Section 3 | Level 2 |
| 3.3 | Ensure that 'disableLocalAuth' is set to 'true' | Section 3 | Level 1 |
| 3.4 | Ensure `Public Network Access` is `Disabled` | Section 3 | Level 2 |
| 3.5 | Ensure critical data is encrypted with customer-managed keys (CMK) | Section 3 | Level 2 |
| 3.6 | Ensure the firewall does not allow all network traffic | Section 3 | Level 1 |
| 3.7 | Ensure that Cosmos DB Logging is Enabled | Section 3 | Level 1 |
| 4.1 | Ensure Data Factory is encrypted using Customer Managed Keys | Section 4 | Level 2 |
| 4.2 | Ensure Data Factory is using Managed Identities | Section 4 | Level 1 |
| 4.3 | Ensure that Data Factory is using Azure Key Vault to store Credentials and Secrets | Section 4 | Level 2 |
| 4.4 | Ensure that Data Factory is using RBAC to manage privilege assignment | Section 4 | Level 2 |
| 5.1 | Ensure Azure Database for MySQL uses Customer Managed Keys for Encryption at Rest | Section 5 | Level 2 |
| 5.2 | Ensure Azure Database for MySQL uses only Microsoft Entra Authentication | Section 5 | Level 1 |
| 5.3 | Ensure `Public Network Access` is `Disabled` for Azure Database for MySQL | Section 5 | Level 2 |
| 5.4 | Ensure Private Endpoints Are Used for Azure MySQL Databases | Section 5 | Level 2 |
| 5.5 | Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL flexible server | Section 5 | Level 2 |
| 5.6 | Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL flexible server | Section 5 | Level 2 |
| 5.7 | Ensure server parameter 'error_server_log_file' is Enabled for MySQL Database Server | Section 5 | Level 2 |
| 5.8 | Ensure server parameter 'require_secure_transport' is set to 'ON' for MySQL Server | Section 5 | Level 1 |
| 5.9 | Ensure server parameter 'tls_version' is set to 'TLSv1.2' (or higher) for MySQL flexible server | Section 5 | Level 1 |
| 6.1 | Ensure Azure Database for PostgreSQL uses Customer Managed Keys for Encryption at Rest | Section 6 | Level 2 |
| 6.2 | Ensure Azure Database for PostgreSQL uses only Microsoft Entra Authentication | Section 6 | Level 1 |
| 6.3 | Ensure `Public Network Access` is `Disabled` for Azure Database for PostgreSQL | Section 6 | Level 2 |
| 6.4 | Ensure Private Endpoints Are Used for Azure Database for PostgreSQL | Section 6 | Level 2 |
| 6.5 | Ensure server parameter 'connection_throttle.enable' is set to 'ON' for PostgreSQL server | Section 6 | Level 1 |
| 6.6 | Ensure server parameter 'logfiles.retention_days' is greater than 3 days for PostgreSQL server | Section 6 | Level 1 |
| 6.7 | Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL server | Section 6 | Level 1 |
| 6.8 | Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL servers | Section 6 | Level 1 |
| 6.9 | Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL servers | Section 6 | Level 1 |
| 6.10 | Ensure server parameter 'require_secure_transport' is set to 'ON' for PostgreSQL server | Section 6 | Level 1 |
| 6.11 | Ensure server parameter 'ssl_min_protocol_version' is set to 'TLSv1.2' or higher for PostgreSQL server | Section 6 | Level 1 |
| 9.1 | Ensure that 'Auditing' is set to 'On' | Section 9 | Level 1 |
| 9.2 | Ensure that 'Public Network Access' is set to 'Disable' | Section 9 | Level 2 |
| 9.3 | Ensure no Azure SQL Database firewall rule is overly permissive | Section 9 | Level 1 |
| 9.4 | Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key | Section 9 | Level 2 |
| 9.5 | Ensure that Microsoft Entra authentication is Configured for SQL Servers | Section 9 | Level 1 |
| 9.6 | Ensure that 'Data encryption' is set to 'On' on a SQL Database | Section 9 | Level 1 |
| 9.7 | Ensure that 'Auditing' Retention is 'greater than 90 days' | Section 9 | Level 1 |
| 9.8 | Ensure 'Minimum TLS Version' is set to 'TLS 1.2' or higher | Section 9 | Level 1 |
CIS Microsoft Azure Storage Services v2.0.0
64 controls · individual check pages follow once each section's service is confirmed
| CIS ID | Check | Section | Profile |
|---|---|---|---|
| 3.1.1 | Ensure soft delete on Backup vaults is Enabled | Section 3 | Level 1 |
| 3.1.2 | Ensure immutability for Backup vaults is Enabled | Section 3 | Level 1 |
| 3.1.3 | Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK) | Section 3 | Level 2 |
| 3.1.4 | Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults | Section 3 | Level 2 |
| 3.1.5 | Ensure 'Cross Region Restore' is set to 'Enabled' on Backup vaults | Section 3 | Level 2 |
| 3.1.6 | Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Backup vaults | Section 3 | Level 1 |
| 3.2.1 | Ensure soft delete on Recovery Services vaults is Enabled | Section 3 | Level 1 |
| 3.2.2 | Ensure immutability for Recovery Services vaults is Enabled | Section 3 | Level 1 |
| 3.2.3 | Ensure backup data in Recovery Services vaults is encrypted using customer-managed keys (CMK) | Section 3 | Level 2 |
| 3.2.4 | Ensure 'Use infrastructure encryption for this vault' is enabled on Recovery Services vaults | Section 3 | Level 2 |
| 3.2.5 | Ensure public network access on Recovery Services vaults is Disabled | Section 3 | Level 1 |
| 3.2.6 | Ensure 'Cross Region Restore' is set to 'Enabled' on Recovery Services vaults | Section 3 | Level 2 |
| 3.2.7 | Ensure 'Cross Subscription Restore' is set to 'Disabled' or 'Permanently Disabled' on Recovery Services vaults | Section 3 | Level 1 |
| 3.2.8 | Ensure private endpoints are configured for Recovery Services Vaults | Section 3 | Level 2 |
| 4.1 | Ensure 'Key encryption key' is set to a customer-managed key for Azure Managed Lustre file systems | Section 4 | Level 2 |
| 7.1.1 | Ensure root squash for NFS file shares is configured (Microsoft.FileShares) | Section 7 | Level 1 |
| 7.1.2 | Ensure encryption in transit is required for File Shares (Microsoft.FileShares) | Section 7 | Level 1 |
| 7.1.3 | Ensure 'Public Endpoint Access' for File Shares is restricted to selected virtual networks (Microsoft.FileShares) | Section 7 | Level 1 |
| 7.1.4 | Ensure 'Public Endpoint Access' is set to 'Disabled' for File Shares (Microsoft.FileShares) | Section 7 | Level 2 |
| 7.1.5 | Ensure private endpoints are configured for File Shares (Microsoft.FileShares) | Section 7 | Level 2 |
| 7.2.1 | Ensure soft delete for Azure File Shares is Enabled (Classic File Shares) | Section 7 | Level 1 |
| 7.2.2 | Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares (Classic File Shares) | Section 7 | Level 1 |
| 7.2.3 | Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares (Classic File Shares) | Section 7 | Level 1 |
| 7.2.4 | Ensure root squash for NFS file shares is configured (Classic File Shares) | Section 7 | Level 1 |
| 9.1 | Ensure 'Encryption key source' is set to 'Customer Managed Key' for Azure NetApp Files accounts | Section 9 | Level 2 |
| 10.1 | Ensure 'Allowed Protocols' for shared access signature (SAS) tokens is set to 'HTTPS Only' | Section 10 | Level 1 |
| 10.2 | Ensure that shared access signature (SAS) tokens expire within an hour | Section 10 | Level 2 |
| 10.3 | Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled | Section 10 | Level 1 |
| 10.4 | Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens | Section 10 | Level 1 |
| 10.5 | Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts | Section 10 | Level 2 |
| 10.6 | Ensure locked immutability policies are used for containers storing business-critical blob data | Section 10 | Level 2 |
| 11.1 | Ensure double encryption is used for Azure Data Box in high-security environments | Section 11 | Level 2 |
| 14.1 | Ensure 'Public network access' is set to 'Disabled' on Azure Elastic SAN | Section 14 | Level 2 |
| 14.2 | Ensure customer-managed keys (CMK) are used to encrypt data at rest on Azure Elastic SAN volume groups | Section 14 | Level 2 |
| 15.1 | Ensure 'Allowed Protocols' for shared access signature (SAS) tokens is set to 'HTTPS Only' | Section 15 | Level 1 |
| 15.2 | Ensure that shared access signature (SAS) tokens expire within an hour | Section 15 | Level 2 |
| 15.3 | Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens | Section 15 | Level 1 |
| 16.4 | Ensure that 'Secure transfer required' is set to 'Enabled' | Section 16 | Level 1 |
| 16.5 | Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'Enabled' | Section 16 | Level 2 |
| 16.6 | Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access | Section 16 | Level 2 |
| 16.7 | Ensure Soft Delete is Enabled for Azure Containers and Blob Storage | Section 16 | Level 1 |
| 16.8 | Ensure storage logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' requests | Section 16 | Level 2 |
| 16.9 | Ensure storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests | Section 16 | Level 2 |
| 16.10 | Ensure storage logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests | Section 16 | Level 2 |
| 16.11 | Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2' | Section 16 | Level 1 |
| 16.12 | Ensure 'Cross Tenant Replication' is not enabled | Section 16 | Level 1 |
| 16.13 | Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled' | Section 16 | Level 1 |
| 16.14 | Ensure Azure Resource Manager Delete locks are applied to Azure Storage Accounts | Section 16 | Level 1 |
| 16.15 | Ensure Azure Resource Manager ReadOnly locks are considered for Azure Storage Accounts | Section 16 | Level 2 |
| 16.16 | Ensure Redundancy is set to a geo-redundant option on critical Azure Storage Accounts | Section 16 | Level 2 |
| 16.1.1 | Ensure that 'Enable key rotation reminders' is enabled for each Storage Account | Section 16 | Level 1 |
| 16.1.2 | Ensure 'Allowed Protocols' for shared access signature (SAS) tokens is set to 'HTTPS Only' | Section 16 | Level 1 |
| 16.1.3 | Ensure that Storage Account Access Keys are Periodically Regenerated | Section 16 | Level 1 |
| 16.1.4 | Ensure that a shared access signature (SAS) expiration policy is configured | Section 16 | Level 1 |
| 16.1.5 | Ensure the shared access signature (SAS) expiration policy action is set to 'Block' | Section 16 | Level 2 |
| 16.1.6 | Ensure that shared access signature (SAS) tokens expire within an hour | Section 16 | Level 2 |
| 16.1.7 | Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled' | Section 16 | Level 1 |
| 16.1.8 | Ensure Storage for Critical Data are Encrypted with Customer Managed Keys (CMK) | Section 16 | Level 2 |
| 16.2.1 | Ensure Private Endpoints are used to access Storage Accounts | Section 16 | Level 2 |
| 16.2.2 | Ensure that 'Public Network Access' is 'Disabled' for storage accounts | Section 16 | Level 2 |
| 16.2.3 | Ensure Default Network Access Rule for Storage Accounts is Set to Deny | Section 16 | Level 1 |
| 17.1 | Ensure that shared access signature (SAS) tokens expire within an hour | Section 17 | Level 2 |
| 17.2 | Ensure stored access policies (SAP) are used when generating shared access signature (SAS) tokens | Section 17 | Level 1 |
| 17.3 | Ensure Storage Explorer is using the latest version | Section 17 | Level 1 |