Azure security rules

General

• Action Group should be enabled High
• Activity Log Alert should be enabled High
• AKS cluster logs should be sent to Log Analytics Medium
• AKS cluster must enable RBAC High
• AKS cluster must enable RBAC Critical
• AKS cluster should be a private cluster High
• AKS cluster should disable local accounts High
• AKS cluster should enable Azure RBAC for Kubernetes Medium
• AKS cluster should have diagnostic settings configured Medium
• AKS cluster should have network policy configured High
• AKS cluster should use Azure AD integration High
• AKS cluster should use managed identity Medium
• AKS node pool should enable encryption at host High
• All VNet subnets should have NSG associated High
• API Management should be integrated with a Virtual Network Medium
• API Management should disable public network access High
• API Management should enforce TLS 1.2 or higher High
• API Management should use Managed Identity Medium
• App Configuration should disable local authentication High
• App Configuration should disable public network access High
• App Configuration should enable purge protection Medium
• App Service logs should be sent to Log Analytics Medium
• App Service must disable FTP or require FTPS only High
• App Service must enforce HTTPS only High
• App Service must require FTPS or disable FTP High
• App Service must use managed identity Medium
• App Service must use managed identity for automatic logoff and credential management High
• App Service must use TLS 1.2 or higher High
• App Service Plan should enable zone redundancy Medium
• App Service should disable remote debugging High
• App Service should enable HTTP/2 Low
• App Service should have diagnostic settings configured Medium
• App Service should require client certificates Medium
• App Service should route all traffic through VNet Medium
• App Service Slot should enforce HTTPS only High
• Application Gateway logs should be sent to Log Analytics Medium
• Application Gateway should have diagnostic settings configured Medium
• Application Gateway should have WAF enabled High
• Application Gateway should use TLS 1.2 or higher High
• Application Gateway WAF should be in Prevention mode High
• Application Security Group should be in succeeded state Medium
• Automation Account should disable local authentication High
• Automation Account should disable public network access High
• Automation Runbook should enable verbose logging Medium
• Availability Set should have at least 2 fault domains Medium
• Azure Firewall logs should be sent to Log Analytics Medium
• Azure Firewall Premium should enable intrusion detection (IDPS) High
• Azure Firewall should have diagnostic settings configured Medium
• Azure Firewall should have DNS Proxy enabled Medium
• Azure Firewall should have Threat Intelligence enabled High
• Azure Firewall should use Standard or Premium tier High
• Bastion Host should disable shareable link Medium
• Bastion Host should use Standard SKU High
• Batch account should disable public network access High
• Batch account should use customer-managed key encryption Medium
• Batch account should use User Subscription pool allocation mode Medium
• Blob service should enable soft delete High
• Blob service should enable versioning Medium
• Cassandra cluster should use password authentication High
• CDN endpoint should disable HTTP and enforce HTTPS only High
• CDN profile should use managed identity Medium
• Cognitive Services should disable local authentication High
• Cognitive Services should disable public network access High
• Cognitive Services should restrict network access High
• Cognitive Services should use Managed Identity Medium
• Communication Service should use managed identity Medium
• Compute Gallery should enable soft delete Medium
• Conditional access policies should be active High
• Connection Monitor should be actively monitoring Medium
• Container App ingress should not be externally accessible unless required Medium
• Container App should use managed identity High
• Container Apps Environment should be deployed in a virtual network High
• Container Apps Environment should enable zone redundancy Medium
• Container Instance should use managed identity Medium
• Container Registry logs should be sent to Log Analytics Medium
• Container Registry must disable admin user High
• Container Registry must not allow anonymous pull for asset control High
• Container Registry should have diagnostic settings configured Medium
• Container Registry should restrict network access High
• Container Registry should restrict public network access High
• Container Registry should use customer-managed key encryption Medium
• Container Registry should use managed identity Medium
• Container Registry should use private endpoints High
• Container Registry Webhook should be active Medium
• Cosmos DB logs should be sent to Log Analytics Medium
• Cosmos DB should disable local authentication High
• Cosmos DB should disable public network access High
• Cosmos DB should enable automatic failover Medium
• Cosmos DB should enforce TLS 1.2 or higher High
• Cosmos DB should have diagnostic settings configured Medium
• Cosmos DB should use managed identity Medium
• Cosmos DB should use private endpoints High
• Custom roles should be minimized Medium
• Data Collection Endpoint should disable public network access High
• Data collection rule should have data flows configured High
• Data collection rule should have destinations configured High
• Data Factory should disable public network access High
• Data Factory should use managed identity High
• DDoS Protection Plan should be associated with virtual networks High
• DDoS Protection Plan should be successfully provisioned High
• Defender for App Services should be enabled High
• Defender for Containers should be enabled High
• Defender for DNS should be enabled High
• Defender for Key Vault should be enabled High
• Defender for Resource Manager should be enabled High
• Defender for SQL Servers should be enabled High
• Defender for Storage should be enabled High
• Defender for Virtual Machines should be enabled High
• Desktop Virtualization host pool should be a validation environment for testing updates Medium
• Desktop Virtualization host pool should limit max session count Medium
• DevTest Lab should restrict environment permissions High
• Disk Encryption Set should enable automatic key rotation High
• Disk Encryption Set should use EncryptionAtRestWithCustomerKey Medium
• DNS Zone should have name servers configured High
• Event Grid domain should disable local authentication High
• Event Grid domain should disable public network access High
• Event Grid System Topic should use managed identity Medium
• Event Grid topic should disable local authentication High
• Event Grid topic should disable public network access High
• Event Hub logs should be sent to Log Analytics Medium
• Event Hub must use TLS 1.2 minimum High
• Event Hub should disable local authentication High
• Event Hub should have diagnostic settings configured Medium
• Event Hub should have multiple partitions for availability Medium
• Event Hub should have sufficient message retention Medium
• Event Hub should restrict public network access High
• ExpressRoute Circuit should be successfully provisioned High
• ExpressRoute Circuit should use Premium SKU tier Medium
• Firewall Policy should enable threat intelligence in Deny mode High
• Firewall Policy should use Premium SKU tier Medium
• Front Door should be in Enabled state Medium
• Front Door should have health probes configured Medium
• Front Door should have HTTPS enabled on all frontend endpoints High
• Front Door should have Web Application Firewall enabled Critical
• Front Door should redirect HTTP to HTTPS High
• Guest access should be restricted High
• HDInsight cluster should enable encryption in transit High
• HDInsight cluster should enforce TLS 1.2+ High
• IoT Hub should disable local authentication High
• IoT Hub should disable public network access High
• IoT Hub should enforce TLS 1.2+ High
• IP Group should have IP addresses configured Medium
• Key Vault diagnostic logs should be sent to Log Analytics Medium
• Key Vault must enable purge protection High
• Key Vault must enable soft delete High
• Key Vault must have soft delete and purge protection for contingency planning High
• Key Vault Secret should be enabled Medium
• Key Vault Secret should have an expiration date set High
• Key Vault should disable public network access High
• Key Vault should have diagnostic logging enabled High
• Key Vault should restrict public network access High
• Key Vault should use private endpoints High
• Key Vault should use RBAC authorization Medium
• Kusto cluster should enable disk encryption High
• Load Balancer should use Standard SKU High
• Log Analytics workspace retention should be at least 90 days Medium
• Log Analytics workspace should have diagnostic settings configured Medium
• Logic App should restrict trigger access Medium
• Machine Learning workspace should be configured as high business impact Medium
• Machine Learning workspace should disable public network access High
• Machine Learning workspace should use managed identity High
• Managed Disk logs should be sent to Log Analytics Medium
• Managed Disk should be encrypted High
• Managed Disk should disable public network access High
• Managed Disk should have diagnostic settings configured Medium
• Managed HSM should disable public network access High
• Managed HSM should enable purge protection Critical
• Maps account should disable local authentication High
• Metric Alert should be enabled High
• MySQL backup retention should be at least 7 days Medium
• MySQL Flexible Server must require secure transport High
• MySQL Flexible Server should disable public network access High
• MySQL logs should be sent to Log Analytics Medium
• MySQL should have diagnostic settings configured Medium
• MySQL should have geo-redundant backup enabled Medium
• NAT Gateway should have public IP addresses assigned High
• NAT Gateway should use Standard SKU High
• Network Interface should have a Network Security Group attached High
• Network Interface should not have a public IP address High
• Network Security Group should have diagnostic settings configured Medium
• Network Watcher should be successfully provisioned High
• No custom roles should grant Owner-equivalent permissions High
• No guest users should have Owner role Critical
• No more than 3 owners assigned to subscription High
• No service principals should be subscription owners High
• Notification Hub namespace should use Standard or higher SKU Medium
• NSG logs should be sent to Log Analytics Medium
• NSG must have security rules configured to restrict inbound traffic Critical
• NSG must not allow RDP from Internet Critical
• NSG must not allow SSH from Internet Critical
• NSG should not allow HTTP from Internet High
• Organization should assess third-party vendor security Medium
• Organization should conduct penetration testing High
• Organization should conduct periodic risk assessments High
• Organization should conduct security awareness training Medium
• Organization should deploy and maintain anti-malware software High
• Organization should establish a data management process High
• Organization should establish a data recovery process High
• Organization should establish a secure configuration process High
• Organization should establish a security awareness program High
• Organization should establish an access control process High
• Organization should establish an account management process High
• Organization should establish an audit log management process High
• Organization should establish an incident response program Critical
• Organization should establish network monitoring and defense Medium
• Organization should have a business continuity and disaster recovery plan High
• Organization should have a documented incident response plan High
• Organization should have a formal change management process Medium
• Organization should have a vulnerability management program High
• Organization should implement email security protections Medium
• Organization should implement HR security controls Medium
• Organization should implement physical security controls Medium
• Organization should maintain a data classification policy Medium
• Organization should maintain a privacy policy Medium
• Organization should maintain an inventory of enterprise hardware assets High
• Organization should maintain an inventory of enterprise software assets High
• Organization should perform periodic access reviews High
• Orphaned managed disks should be deleted Low
• PostgreSQL backup retention should be at least 7 days Medium
• PostgreSQL Flexible Server should have high availability enabled Medium
• PostgreSQL Flexible Server should use managed identity Medium
• PostgreSQL logs should be sent to Log Analytics Medium
• PostgreSQL should disable public network access High
• PostgreSQL should have diagnostic settings configured Medium
• Private DNS Zone should be linked to at least one virtual network High
• Private Endpoint connection should be in Approved state High
• Private Endpoint should have custom DNS configuration Medium
• Proximity Placement Group should have associated VMs Low
• Public IP address logs should be sent to Log Analytics Medium
• Public IP address should have DDoS protection High
• Public IP address should have diagnostic settings configured Medium
• Public IP should be associated with a resource Low
• Public IP should use Standard SKU Medium
• Purview account should disable public network access High
• Purview account should use managed identity High
• Recovery Services vault should disable public network access Medium
• Recovery Services vault should enable immutability Medium
• Recovery Services vault should enable soft delete High
• Redis Cache logs should be sent to Log Analytics Medium
• Redis Cache must disable non-SSL port High
• Redis Cache must use TLS 1.2 minimum High
• Redis Cache should have diagnostic settings configured Medium
• Redis cache should have patch schedule configured Medium
• Redis Cache should restrict public network access High
• Redis Cache should use managed identity Medium
• Redis Cache should use private endpoints High
• Relay namespace should use Standard SKU Medium
• Resource lock should use CanNotDelete or ReadOnly level Medium
• Route Table should disable BGP route propagation Medium
• Route Table should have a default route for internet traffic control High
• Scheduled query rule should be enabled High
• Scheduled query rule should have at least one scope High
• Search service should disable local authentication High
• Search service should disable public network access High
• Security defaults or conditional access must be enabled Critical
• Service Bus logs should be sent to Log Analytics Medium
• Service Bus must use TLS 1.2 minimum High
• Service Bus queue should enable dead-lettering on message expiration Medium
• Service Bus queue should enable duplicate detection Medium
• Service Bus should disable local authentication High
• Service Bus should have diagnostic settings configured Medium
• Service Bus should restrict public network access High
• Service Bus topic should enable duplicate detection Medium
• Service Bus topic should enable partitioning Medium
• SignalR Service should disable local authentication Medium
• SignalR Service should disable public network access High
• SignalR Service should require client certificates Medium
• Snapshot should disable public network access High
• Snapshot should restrict network access policy High
• Spring Cloud service should be deployed in a virtual network High
• SQL Database should enable zone redundancy Medium
• SQL Database should use geo-redundant backup storage Medium
• SQL Elastic Pool should enable zone redundancy Medium
• SQL Managed Instance should disable public data endpoint High
• SQL Managed Instance should enforce TLS 1.2+ High
• SQL Managed Instance should use managed identity Medium
• SQL Server must use TLS 1.2 minimum High
• SQL Server must use TLS 1.2 or higher High
• SQL Server should disable public network access High
• SQL Server should have diagnostic settings configured Medium
• SQL Server should have diagnostic settings configured Medium
• SQL Server should use Azure AD-only authentication High
• SQL Server should use Managed Identity Medium
• SQL Server should use private endpoints High
• Storage account blob encryption must be enabled Critical
• Storage account logs should be sent to Log Analytics Medium
• Storage account must deny public network access by default High
• Storage account must disable anonymous blob public access Critical
• Storage account must enforce HTTPS transfer High
• Storage account must use customer-managed or Microsoft-managed encryption keys Medium
• Storage account must use TLS 1.2 minimum High
• Storage account should have diagnostic settings configured Medium
• Storage account should have file service encryption enabled High
• Storage account should use customer-managed keys Medium
• Storage account should use Managed Identity Medium
• Storage account should use private endpoints High
• Stream Analytics job should use latest compatibility level Medium
• Subscription should not have excessive role assignments Medium
• Synapse workspace should disable public network access High
• Synapse workspace should enable double encryption Medium
• Synapse workspace should use managed virtual network High
• Traffic Manager profile should be enabled High
• Traffic Manager should use HTTPS for endpoint monitoring High
• User Access Administrator count should be limited High
• User Assigned Identity should have a valid principal Medium
• Virtual Machine logs should be sent to Log Analytics Medium
• Virtual Machine must enable encryption at host High
• Virtual Machine must have endpoint protection installed High
• Virtual Machine OS disk must use managed disks High
• Virtual Machine should enable encryption at host High
• Virtual Machine should enable Trusted Launch (Secure Boot) Medium
• Virtual Machine should enable vTPM Medium
• Virtual Machine should have antimalware extension installed High
• Virtual Machine should have diagnostic settings configured Medium
• Virtual Machine should have monitoring agent installed Medium
• Virtual Machine should use managed identity Medium
• Virtual Machine should use managed OS disk Medium
• Virtual Network Gateway should enable active-active configuration High
• Virtual Network Gateway should use Generation2 VPN Medium
• Virtual Network logs should be sent to Log Analytics Medium
• Virtual Network should have DDoS protection enabled High
• Virtual Network should have diagnostic settings configured Medium
• Virtual Network should have encryption enabled Medium
• VM Scale Set should enable automatic OS upgrades Medium
• VM Scale Set should use managed identity High
• VPN Gateway should be successfully provisioned High
• VPN Gateway should not use internet routing preference Medium
• WAF Policy should be enabled Critical
• WAF Policy should be in Prevention mode High
• Web PubSub should disable local authentication High
• Web PubSub should disable public network access High