CGPulse

Sign In

Cloud Security Baseline

Azure 166 automated checks

Recommended security best practices for cloud services, based on common compliance frameworks

Asset Management

Virtual Machine should use managed OS disk AM-2 · Medium
Public IP should be associated with a resource AM-2 · Low
Orphaned managed disks should be deleted AM-2 · Low

Backup & Recovery

PostgreSQL backup retention should be at least 7 days BR-1 · Medium
MySQL backup retention should be at least 7 days BR-1 · Medium
Cosmos DB should enable automatic failover BR-1 · Medium
MySQL should have geo-redundant backup enabled BR-2 · Medium
PostgreSQL Flexible Server should have high availability enabled BR-1 · Medium

Data Protection

Storage account must enforce HTTPS transfer DP-3 · High
Storage account must use TLS 1.2 minimum DP-3 · High
Storage account blob encryption must be enabled DP-4 · Critical
App Service must use TLS 1.2 or higher DP-3 · High
App Service must require FTPS or disable FTP DP-3 · High
Key Vault must enable soft delete DP-8 · High
Key Vault must enable purge protection DP-8 · High
SQL Server must use TLS 1.2 minimum DP-3 · High
Redis Cache must disable non-SSL port DP-3 · High
Redis Cache must use TLS 1.2 minimum DP-3 · High
Event Hub must use TLS 1.2 minimum DP-3 · High
Service Bus must use TLS 1.2 minimum DP-3 · High
MySQL Flexible Server must require secure transport DP-3 · High
Application Gateway should use TLS 1.2 or higher DP-3 · High
Virtual Machine should enable encryption at host DP-4 · High
Storage account should use customer-managed keys DP-5 · Medium
Managed Disk should be encrypted DP-4 · High
Virtual Network should have encryption enabled DP-3 · Medium
Cosmos DB should enforce TLS 1.2 or higher DP-3 · High
Container Registry should use customer-managed key encryption DP-5 · Medium
Storage account should have file service encryption enabled DP-4 · High
Front Door should have HTTPS enabled on all frontend endpoints DP-3 · High
Front Door should redirect HTTP to HTTPS DP-3 · High
API Management should enforce TLS 1.2 or higher DP-3 · High
Batch account should use customer-managed key encryption DP-5 · Medium

Endpoint Security

Virtual Machine should enable Trusted Launch (Secure Boot) ES-1 · Medium
Virtual Machine should have antimalware extension installed ES-2 · High
Virtual Machine should have monitoring agent installed ES-3 · Medium

Identity & Access

App Service must use managed identity IM-3 · Medium
Key Vault should use RBAC authorization PA-7 · Medium
SQL Server should use Azure AD-only authentication IM-1 · High
Virtual Machine should use managed identity IM-3 · Medium
Container Registry must disable admin user IM-1 · High
Container Registry should use managed identity IM-3 · Medium
Cosmos DB should disable local authentication IM-1 · High
Cosmos DB should use managed identity IM-3 · Medium
Event Hub should disable local authentication IM-1 · High
Service Bus should disable local authentication IM-1 · High
PostgreSQL Flexible Server should use managed identity IM-3 · Medium
AKS cluster must enable RBAC PA-7 · High
AKS cluster should use Azure AD integration IM-1 · High
AKS cluster should disable local accounts IM-1 · High
AKS cluster should use managed identity IM-3 · Medium
No more than 3 owners assigned to subscription PA-1 · High
No guest users should have Owner role PA-1 · Critical
No service principals should be subscription owners PA-1 · High
No custom roles should grant Owner-equivalent permissions PA-7 · High
Custom roles should be minimized PA-7 · Medium
Security defaults or conditional access must be enabled IM-7 · Critical
Conditional access policies should be active IM-7 · High
Guest access should be restricted IM-7 · High
App Service should require client certificates IM-4 · Medium
Subscription should not have excessive role assignments PA-4 · Medium
User Access Administrator count should be limited PA-4 · High
Storage account should use Managed Identity IM-1 · Medium
SQL Server should use Managed Identity IM-1 · Medium
API Management should use Managed Identity IM-1 · Medium
Cognitive Services should disable local authentication IM-1 · High
Cognitive Services should use Managed Identity IM-1 · Medium
SignalR Service should disable local authentication IM-1 · Medium
SignalR Service should require client certificates IM-4 · Medium
Batch account should use User Subscription pool allocation mode IM-1 · Medium

Logging & Monitoring

Storage account should have diagnostic settings configured LT-3 · Medium
Key Vault should have diagnostic logging enabled LT-3 · High
SQL Server should have diagnostic settings configured LT-3 · Medium
App Service should have diagnostic settings configured LT-3 · Medium
Key Vault diagnostic logs should be sent to Log Analytics LT-5 · Medium
SQL Server should have diagnostic settings configured LT-5 · Medium
Virtual Machine should have diagnostic settings configured LT-3 · Medium
Network Security Group should have diagnostic settings configured LT-3 · Medium
Container Registry should have diagnostic settings configured LT-3 · Medium
Cosmos DB should have diagnostic settings configured LT-3 · Medium
Redis Cache should have diagnostic settings configured LT-3 · Medium
Event Hub should have diagnostic settings configured LT-3 · Medium
Service Bus should have diagnostic settings configured LT-3 · Medium
PostgreSQL should have diagnostic settings configured LT-3 · Medium
AKS cluster should have diagnostic settings configured LT-3 · Medium
MySQL should have diagnostic settings configured LT-3 · Medium
Application Gateway should have diagnostic settings configured LT-3 · Medium
Public IP address should have diagnostic settings configured LT-3 · Medium
Managed Disk should have diagnostic settings configured LT-3 · Medium
Virtual Network should have diagnostic settings configured LT-3 · Medium
Storage account logs should be sent to Log Analytics LT-5 · Medium
App Service logs should be sent to Log Analytics LT-5 · Medium
Virtual Machine logs should be sent to Log Analytics LT-5 · Medium
NSG logs should be sent to Log Analytics LT-5 · Medium
Container Registry logs should be sent to Log Analytics LT-5 · Medium
Cosmos DB logs should be sent to Log Analytics LT-5 · Medium
Redis Cache logs should be sent to Log Analytics LT-5 · Medium
Event Hub logs should be sent to Log Analytics LT-5 · Medium
Service Bus logs should be sent to Log Analytics LT-5 · Medium
PostgreSQL logs should be sent to Log Analytics LT-5 · Medium
AKS cluster logs should be sent to Log Analytics LT-5 · Medium
MySQL logs should be sent to Log Analytics LT-5 · Medium
Application Gateway logs should be sent to Log Analytics LT-5 · Medium
Public IP address logs should be sent to Log Analytics LT-5 · Medium
Managed Disk logs should be sent to Log Analytics LT-5 · Medium
Virtual Network logs should be sent to Log Analytics LT-5 · Medium
Defender for Virtual Machines should be enabled LT-1 · High
Defender for App Services should be enabled LT-1 · High
Defender for SQL Servers should be enabled LT-1 · High
Defender for Storage should be enabled LT-1 · High
Defender for Key Vault should be enabled LT-1 · High
Defender for Resource Manager should be enabled LT-1 · High
Defender for Containers should be enabled LT-1 · High
Defender for DNS should be enabled LT-1 · High
Log Analytics workspace retention should be at least 90 days LT-6 · Medium
Azure Firewall should have diagnostic settings configured LT-3 · Medium
Azure Firewall logs should be sent to Log Analytics LT-5 · Medium
Log Analytics workspace should have diagnostic settings configured LT-3 · Medium

Network Security

Storage account must deny public network access by default NS-2 · High
Storage account must disable anonymous blob public access NS-2 · Critical
App Service must enforce HTTPS only DP-3 · High
App Service should enable HTTP/2 NS-8 · Low
Key Vault should restrict public network access NS-2 · High
SQL Server should disable public network access NS-2 · High
NSG must not allow SSH from Internet NS-1 · Critical
NSG must not allow RDP from Internet NS-1 · Critical
NSG should not allow HTTP from Internet NS-1 · High
Container Registry should restrict public network access NS-2 · High
Cosmos DB should disable public network access NS-2 · High
Redis Cache should restrict public network access NS-2 · High
Event Hub should restrict public network access NS-2 · High
Service Bus should restrict public network access NS-2 · High
PostgreSQL should disable public network access NS-2 · High
Key Vault should use private endpoints NS-2 · High
SQL Server should use private endpoints NS-2 · High
Storage account should use private endpoints NS-2 · High
Cosmos DB should use private endpoints NS-2 · High
Redis Cache should use private endpoints NS-2 · High
Container Registry should use private endpoints NS-2 · High
AKS cluster should have network policy configured NS-1 · High
AKS cluster should be a private cluster NS-2 · High
MySQL Flexible Server should disable public network access NS-2 · High
Application Gateway should have WAF enabled NS-6 · High
Application Gateway WAF should be in Prevention mode NS-6 · High
App Service should disable remote debugging NS-8 · High
App Service should route all traffic through VNet NS-2 · Medium
Public IP should use Standard SKU NS-5 · Medium
Managed Disk should disable public network access NS-2 · High
Virtual Network should have DDoS protection enabled NS-5 · High
All VNet subnets should have NSG associated NS-1 · High
Azure Firewall should use Standard or Premium tier NS-3 · High
Azure Firewall Premium should enable intrusion detection (IDPS) NS-4 · High
Azure Firewall should have Threat Intelligence enabled NS-6 · High
Azure Firewall should have DNS Proxy enabled NS-6 · Medium
Key Vault should disable public network access NS-2 · High
Container Registry should restrict network access NS-2 · High
Public IP address should have DDoS protection NS-5 · High
Front Door should have Web Application Firewall enabled NS-6 · Critical
Front Door should have health probes configured NS-1 · Medium
Front Door should be in Enabled state NS-1 · Medium
API Management should disable public network access NS-2 · High
API Management should be integrated with a Virtual Network NS-2 · Medium
Cognitive Services should disable public network access NS-2 · High
Cognitive Services should restrict network access NS-2 · High
SignalR Service should disable public network access NS-2 · High
Batch account should disable public network access NS-2 · High

Measure your Cloud Security Baseline posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation