Standards · Microsoft Azure
CIS Microsoft Azure benchmarks.
339 controls, one scan.
Foundations v6.0.0 plus the Compute, Database and Storage Services v2.0.0 benchmarks, all assessed in one read-only Azure scan.
- Controls
- 339
- Benchmarks
- 4
- Level 1
- 205
- Level 2
- 134
Four benchmarks. 339 controls.
One Azure scan covers Foundations, Compute, Database and Storage Services.
What are the CIS Microsoft Azure benchmarks?
The Center for Internet Security (CIS) is a non-profit organisation whose CIS Benchmarks are prescriptive configuration recommendations for hardening operating systems, cloud platforms and SaaS applications.
For Azure, the Foundations Benchmark is the broad baseline; CIS also publishes service benchmarks for Azure compute, database and storage services.
Benchmarks and sections.
The section breakdown is shown for the Foundations Benchmark.
CIS Microsoft Azure Foundations Benchmarkv6.0.0
- 2Analytics Services →12controls
- 3Compute Services1controls
- 5Identity Services15controls
- 6Management and Governance Services24controls
- 7Networking Services16controls
- 8Security Services38controls
- 9Storage Services21controls
CIS Microsoft Azure Compute Services Benchmarkv2.0.0
CIS Microsoft Azure Database Services Benchmarkv2.0.0
CIS Microsoft Azure Storage Services Benchmarkv2.0.0
Level 1 or Level 2.
- Level 1
205 controls
Safe, minimal impact. Baseline recommendations intended to be applied broadly with minimal impact on day-to-day use.
- Level 2
134 controls
Stricter, security-focused. For environments with higher security requirements. Some may affect functionality and warrant testing first.
How ConfigCobra assesses it.
ConfigCobra for Azure is available.
Read-only
Reader on your subscriptions. Never writes.
An Entra app registration with a certificate, Reader on the subscriptions you choose (plus Key Vault Reader for Key Vault checks) and Microsoft Graph Policy.Read.All.
ConfigCobra for Azure →Per resource
Every finding points at the exact resource.
Scan every subscription the app can read, or a selected list, and see each finding with the evidence and the objects it affects.
Cloud Security Posture Management →
Frequently asked questions
Which CIS Microsoft Azure benchmarks does ConfigCobra cover?
CIS Microsoft Azure Foundations Benchmark v6.0.0 (127 controls), Compute Services Benchmark v2.0.0 (99), Database Services Benchmark v2.0.0 (49) and Storage Services Benchmark v2.0.0 (64) — 339 controls in total.
How many Level 1 and Level 2 controls are there?
205 Level 1 and 134 Level 2 across the four benchmarks. Foundations: 74 / 53. Compute Services: 71 / 28. Database Services: 27 / 22. Storage Services: 33 / 31.
Is Azure scanning available today?
Yes. ConfigCobra for Azure is available. Start a free trial or ask us for a quote.
What permissions does the Azure scan need?
An Entra app registration with certificate authentication (no client secret), Reader on the target subscriptions (plus Key Vault Reader for Key Vault checks) and Microsoft Graph Policy.Read.All. It is read-only and never writes to your Azure.
See it on your own tenant
Read-only access — ConfigCobra never changes your tenant.