Azure Compliance / Control / Check
100 articles
- Ensure Trusted Locations Are Defined In Conditional Access Policies
- Ensure that an exclusionary Geographic Access Policy is considered
- Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups
- Ensure that A Multi-factor Authentication Policy Exists for All Users
- Ensure Multi-factor Authentication is Required for Risky Sign-ins
- Ensure Multi-factor Authentication is Required for Azure Management
- Ensure that 'Users can create Azure AD Tenants' is set to 'No'
- Ensure Access Review is Set Up for External Users in Azure AD Privileged Identity Management (PIM)
- Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization
- Ensure `User consent for applications` is set to `Do not allow user consent`
- Ensure ‘User consent for applications’ Is Set To ‘Allow for Verified Publishers’
- Ensure That 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'
- Ensure that 'Guest invite restrictions' is set to "Only users assigned to specific admin roles can invite guest users" .
- Ensure that 'Restrict user ability to access groups features in the Access Pane' is Set to 'Yes'
- Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- Ensure that "Enable Infrastructure Encryption" is enabled for Each Storage Account
- Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- Ensure Private Endpoints are used to access Storage Accounts
- Ensure a Custom Role is Assigned Permissions for Administering Resource Locks
- Ensure That Microsoft Defender for Databases Is Set To 'On'
- Ensure That ‘Subscription Entering AAD Directory’ and ‘Subscription Leaving AAD Directory’ Is Set To ‘Permit No One’
- Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'
- Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'
- Ensure That Microsoft Defender for DNS Is Set To 'On'
- Ensure That Microsoft Defender for Resource Manager Is Set To 'On'
- Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' (Manual)
- Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' (Automated) .
- Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On' .
- Ensure that Auto provisioning of 'Microsoft Defender for Containers components' is Set to 'On'
- Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected
- Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected
- Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- Microsoft Defender for External Attack Surface Monitoring
- Ensure that Resource Locks are set for Mission-Critical Azure Resources
- Ensure Azure Key Vaults are Used to Store Secrets
- Ensure that 'Java version' is the latest, if used to run the Web App
- Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests
- Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App
- Ensure that Register with Azure Active Directory is enabled on App Service
- Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests .
- Ensure the "Minimum TLS version" for storage accounts is set to "Version 1.2" .
- Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer managed key
- Ensure Web App is using the latest version of TLS encryption
- Ensure that Microsoft Entra Admin is Configured for SQL Servers
- Ensure App Service Authentication is set up for apps in Azure App Service
- Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers
- Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- Ensure that Private Endpoints are Used for Azure Key Vault
- Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
- Ensue Role Based Access Control permission model is Enabled for Azure Key Vault
- Ensure the Key Vault is Recoverable
- Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults .
- Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults.
- Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server
- [Legacy] Ensure that VHDs are Encrypted
- Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server
- Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server
- Ensure that Endpoint Protection for all Virtual Machines is installed
- Ensure that Only Approved Extensions Are Installed on VMs
- Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)
- Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server
- Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK)
- Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled'
- Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server
- Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server
- Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server
- Ensure Virtual Machines are utilizing Managed Disks
- Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server
- Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks for CosmosDB
- Ensure an Azure Bastion Host Exists
- Ensure CosmosDB uses AAD client authentication or RBAC where possible
- Ensure that Network Watcher is 'Enabled'
- Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- Ensure that logging for Azure Key Vault is 'Enabled' .
- Ensure that HTTP(S) access from the Internet is evaluated and restricted .
- Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- Ensure that logging for Azure AppService 'HTTP logs' is enabled .
- Ensure that Activity Log Alert exists for Create Policy Assignment
- Ensure that RDP access from the Internet is evaluated and restricted
- Ensure that Activity Log Alert exists for Delete Policy Assignment
- Ensure that Activity Log Alert exists for Create or Update Network Security Group
- Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)
- Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
- Ensure Application Insights are Configured
- Ensure that Activity Log Alert exists for Create or Update Public IP Address rule
- Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule .
- Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule
- Ensure that Activity Log Alert exists for Delete Security Solution
- Ensure That Private Endpoints Are Used for cosmosdb Where Possible
- Ensure that Activity Log Alert exists for Delete Public IP Address rule .
- Ensure that SSH access from the Internet is evaluated and restricted
- Ensure that UDP access from the Internet is evaluated and restricted
- Ensure that Public IP addresses are Evaluated on a Periodic Basis
- Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service
- Ensure That 'PHP version' is the Latest, If Used to Run the Web App