Analytics Services

Section 2 of the CIS Microsoft Azure Foundations Benchmark v6.0.0 is named Analytics Services. It has 12 controls, numbered 2.1.1 to 2.1.12, and by their titles all of them concern Azure Databricks, the managed data and machine learning platform that runs workspaces and clusters inside your subscriptions. If your organisation has no Databricks workspaces, this section has nothing to check; if it has, the workspaces often hold some of your most valuable data, which is why the benchmark gives them a section of their own.

Reading the control titles, the section falls into four themes.

• Network isolation. Deploying the workspace in a customer-managed virtual network, configuring network security groups for the Databricks subnets, setting 'No Public IP' to enabled, disabling public network access, and using private endpoints to reach workspaces.
• Identity and access. Syncing users and groups from Microsoft Entra ID, restricting personal access tokens and enforcing their expiry, and reviewing Databricks groups periodically.
• Data governance and encryption. Configuring Unity Catalog, encrypting traffic between cluster worker nodes, and protecting critical data with customer-managed keys.
• Visibility. Configuring diagnostic log delivery so that workspace activity can be investigated afterwards.

The controls are split across both profiles. Several, such as customer-managed keys, encrypted worker traffic and private endpoints, are Level 2 and give extra protection at the cost of more setup, while the rest are Level 1 baseline settings. Plan the Level 2 items deliberately, because some of them can interrupt how existing clusters and users reach a workspace.

How ConfigCobra assesses it. ConfigCobra reads your Azure environment with a certificate-based app registration, Reader on the target subscriptions and a read-only Microsoft Graph policy permission, and it never writes to your Azure. It scans every subscription the app can read, or a selected list, and each finding points at the exact Azure resource, so a failing Databricks workspace is named rather than summarised. Those resources also appear in the Azure inventory with their security properties. For a failing control, remediation impact analysis shows the affected resources and identities before you apply the fix, with an impact level of High, Medium, Low or None, and each finding comes with a copy-paste remediation script or admin portal steps. Every connected cloud is scanned automatically every day, you can start an ad hoc scan at any time, and you get an email when a control regresses. The PDF report keeps findings and evidence together.