ad_guest_user_reviewed_monthlyad_manual_controlapimanagement_service_client_certificate_enabledapimanagement_service_with_virtual_networkapp_configuration_encryption_enabledapp_configuration_private_link_usedapp_configuration_sku_standardapp_service_environment_internal_encryption_enabledapplication_gateway_waf_enabledapplication_gateway_waf_uses_specified_modeapplication_insights_block_log_ingestion_and_querying_from_publicapplication_insights_linked_to_log_analytics_workspaceappservice_api_app_client_certificates_onappservice_api_app_cors_no_starappservice_api_app_ftps_enabledappservice_api_app_latest_tls_versionappservice_api_app_remote_debugging_disabledappservice_api_app_use_httpsappservice_api_app_uses_managed_identityappservice_authentication_enabledappservice_ftp_deployment_disabledappservice_function_app_authentication_onappservice_function_app_client_certificates_onappservice_function_app_cors_no_starappservice_function_app_ftps_enabledappservice_function_app_latest_http_versionappservice_function_app_latest_java_versionappservice_function_app_latest_python_versionappservice_function_app_latest_tls_versionappservice_function_app_only_https_accessibleappservice_function_app_remote_debugging_disabledappservice_function_app_restrict_public_accesappservice_function_app_uses_managed_identityappservice_plan_minimum_skuappservice_web_app_always_onappservice_web_app_client_certificates_onappservice_web_app_cors_no_starappservice_web_app_diagnostic_logs_enabledappservice_web_app_failed_request_tracing_enabledappservice_web_app_ftps_enabledappservice_web_app_health_check_enabledappservice_web_app_http_logs_enabledappservice_web_app_incoming_client_cert_onappservice_web_app_latest_dotnet_framework_versionappservice_web_app_latest_http_versionappservice_web_app_latest_java_versionappservice_web_app_latest_php_versionappservice_web_app_latest_python_versionappservice_web_app_latest_tls_versionappservice_web_app_register_with_active_directory_enabledappservice_web_app_remote_debugging_disabledappservice_web_app_slot_use_httpsappservice_web_app_use_httpsappservice_web_app_use_virtual_service_endpointappservice_web_app_uses_managed_identityappservice_web_app_worker_more_than_onearc_compute_machine_linux_log_analytics_agent_installedarc_compute_machine_windows_log_analytics_agent_installedautomation_account_variable_encryption_enabledbatch_account_encrypted_with_cmkbatch_account_identity_provider_enabledbatch_account_logging_enabledcognitive_account_encrypted_with_cmkcognitive_account_private_link_usedcognitive_account_public_network_access_disabledcognitive_account_restrict_public_accesscognitive_service_local_auth_disabledcompute_disk_access_uses_private_linkcompute_disk_data_access_auth_mode_enabledcompute_disk_public_access_disabledcompute_disk_unattached_encrypted_with_cmkcompute_os_and_data_disk_encrypted_with_cmkcompute_os_and_data_disk_encrypted_with_cmk_and_platform_managedcompute_unattached_disk_encrypted_with_cmkcompute_vm_account_with_password_linuxcompute_vm_and_sacle_set_encryption_at_host_enabledcompute_vm_attached_with_networkcompute_vm_data_and_os_disk_uses_managed_diskcompute_vm_disaster_recovery_enabledcompute_vm_guest_configuration_installedcompute_vm_guest_configuration_installed_linuxcompute_vm_guest_configuration_installed_windowscompute_vm_guest_configuration_with_no_managed_identitycompute_vm_guest_configuration_with_system_assigned_managed_identitycompute_vm_guest_configuration_with_user_and_system_assigned_managed_identitycompute_vm_jit_access_protectedcompute_vm_log_analytics_agent_installedcompute_vm_log_analytics_agent_installed_windowscompute_vm_malware_agent_automatic_upgrade_enabledcompute_vm_malware_agent_installedcompute_vm_max_password_age_70_days_windowscompute_vm_meet_security_baseline_requirements_linuxcompute_vm_meet_security_baseline_requirements_windowscompute_vm_min_password_age_1_day_windowscompute_vm_min_password_length_14_windowscompute_vm_network_traffic_data_collection_linux_agent_installedcompute_vm_network_traffic_data_collection_windows_agent_installedcompute_vm_password_complexity_setting_enabled_windowscompute_vm_passwords_stored_using_reversible_encryption_windowscompute_vm_remote_access_restrictedcompute_vm_remote_access_restricted_all_portscompute_vm_restrict_previous_24_passwords_resuse_windowscompute_vm_restrict_remote_connection_from_accounts_without_password_linuxcompute_vm_scale_set_automatic_upgrade_enabledcompute_vm_scale_set_boot_diagnostics_enabledcompute_vm_scale_set_log_analytics_agent_installedcompute_vm_scale_set_logging_enabledcompute_vm_scale_set_ssh_key_authentication_linuxcompute_vm_scale_set_uses_managed_diskscompute_vm_secure_communication_protocols_configuredcompute_vm_ssh_key_authentication_linuxcompute_vm_system_updates_installedcompute_vm_tcp_udp_access_restricted_internetcompute_vm_uses_azure_resource_managercompute_vm_utilizing_managed_diskcompute_vm_vulnerability_assessment_solution_enabledcompute_vm_windows_defender_exploit_guard_enabledcompute_windows_vm_secure_boot_enabledcontainer_instance_container_group_encrypted_using_cmkcontainer_instance_container_group_identity_provider_enabledcontainer_instance_container_group_in_virtual_networkcontainer_instance_container_group_secured_environment_variablecontainer_registry_admin_user_disabledcontainer_registry_encrypted_with_cmkcontainer_registry_geo_replication_enabledcontainer_registry_public_network_access_disabledcontainer_registry_quarantine_policy_enabledcontainer_registry_restrict_public_accesscontainer_registry_retention_policy_enabledcontainer_registry_trust_policy_enabledcontainer_registry_use_virtual_service_endpointcontainer_registry_uses_private_linkcosmosdb_account_encryption_at_rest_using_cmkcosmosdb_account_key_based_metadata_write_access_disabledcosmosdb_account_uses_aad_and_rbaccosmosdb_account_uses_private_linkcosmosdb_account_virtual_network_filter_enabledcosmosdb_account_with_firewall_rulescosmosdb_use_virtual_service_endpointdata_factory_encrypted_with_cmkdata_factory_public_network_access_disableddata_factory_uses_git_repositorydata_factory_uses_private_linkdatabox_edge_device_double_encryption_enableddatalake_analytics_account_logging_enableddatalake_store_account_encryption_enableddatalake_store_account_logging_enabledeventgrid_domain_identity_provider_enabledeventgrid_domain_private_link_usedeventgrid_domain_restrict_public_accesseventgrid_topic_identity_provider_enabledeventgrid_topic_local_auth_enabledeventgrid_topic_private_link_usedeventhub_namespace_cmk_encryption_enabledeventhub_namespace_logging_enabledeventhub_namespace_private_link_usedeventhub_namespace_use_virtual_service_endpointfrontdoor_waf_enabledhdinsight_cluster_encrypted_at_rest_with_cmkhdinsight_cluster_encryption_at_host_enabledhdinsight_cluster_encryption_in_transit_enabledhealthcare_fhir_azure_api_encrypted_at_rest_with_cmkhealthcare_fhir_uses_private_linkhpc_cache_encrypted_with_cmkiam_conditional_access_mfa_enablediam_conditional_access_mfa_enabled_for_administratorsiam_deprecated_accountiam_deprecated_account_with_owner_rolesiam_external_user_with_owner_roleiam_external_user_with_read_permissioniam_external_user_with_write_permissioniam_global_administrator_max_5iam_no_custom_roleiam_no_custom_subscription_owner_roles_creatediam_subscription_owner_max_3iam_subscription_owner_more_than_1iam_subscriptions_with_custom_roles_no_overly_permissiveiam_user_consent_to_apps_accessing_data_on_their_behalf_disablediam_user_no_built_in_contributor_roleiam_user_not_allowed_to_create_security_groupiam_user_not_allowed_to_create_tenantsiam_user_not_allowed_to_register_applicationiot_hub_logging_enablediot_hub_private_link_usedkeyvault_firewall_enabledkeyvault_key_expiration_setkeyvault_logging_enabledkeyvault_managed_hms_logging_enabledkeyvault_managed_hms_purge_protection_enabledkeyvault_purge_protection_enabledkeyvault_rbac_enabledkeyvault_secret_expiration_setkeyvault_soft_delete_enabledkeyvault_vault_private_link_usedkeyvault_vault_public_network_access_disabledkeyvault_vault_recoverablekeyvault_vault_use_virtual_service_endpointkeyvault_with_non_rbac_key_expiration_setkeyvault_with_non_rbac_secret_expiration_setkeyvault_with_rbac_key_expiration_setkeyvault_with_rbac_secret_expiration_setkubernetes_cluster_add_on_azure_policy_enabledkubernetes_cluster_addon_azure_policy_enabledkubernetes_cluster_authorized_ip_range_definedkubernetes_cluster_http_application_routing_disabledkubernetes_cluster_key_vault_secret_rotation_enabledkubernetes_cluster_logging_enabledkubernetes_cluster_max_pod_50kubernetes_cluster_network_plugin_azurekubernetes_cluster_network_policy_enabledkubernetes_cluster_node_restrict_public_accesskubernetes_cluster_os_and_data_disks_encrypted_with_cmkkubernetes_cluster_restrict_public_accesskubernetes_cluster_sku_standardkubernetes_cluster_temp_disks_and_agent_node_pool_cache_encrypted_at_hostkubernetes_cluster_upgrade_channelkubernetes_cluster_upgraded_with_non_vulnerable_versionkubernetes_instance_rbac_enabledkusto_cluster_disk_encryption_enabledkusto_cluster_double_encryption_enabledkusto_cluster_encrypted_at_rest_with_cmkkusto_cluster_sku_with_slalog_analytics_workspace_block_log_ingestion_and_querying_from_publiclog_analytics_workspace_block_non_azure_ingestionlog_profile_enabled_for_all_subscriptionlogic_app_workflow_logging_enabledmachine_learning_workspace_encrypted_with_cmkmanual_controlmanual_control_hipaamariadb_server_geo_redundant_backup_enabledmariadb_server_private_link_usedmariadb_server_public_network_access_disabledmariadb_server_ssl_enabledmonitor_application_insights_configuredmonitor_diagnostic_settings_captures_proper_categoriesmonitor_log_alert_create_policy_assignmentmonitor_log_alert_create_update_nsgmonitor_log_alert_create_update_nsg_rulemonitor_log_alert_create_update_public_ip_addressmonitor_log_alert_create_update_security_solutionmonitor_log_alert_create_update_sql_servers_firewall_rulemonitor_log_alert_delete_nsgmonitor_log_alert_delete_nsg_rulemonitor_log_alert_delete_policy_assignmentmonitor_log_alert_delete_public_ip_addressmonitor_log_alert_delete_security_solutionmonitor_log_alert_delete_sql_servers_firewall_rulemonitor_log_alert_for_administrative_operationsmonitor_log_alert_sql_firewall_rulemonitor_log_profile_enabled_for_all_categoriesmonitor_log_profile_enabled_for_all_regionsmonitor_log_profile_retention_365_daysmonitor_logs_storage_container_insights_activity_logs_encrypted_with_byokmonitor_logs_storage_container_insights_activity_logs_not_public_accessiblemonitor_logs_storage_container_insights_operational_logs_encrypted_with_byokmonitor_logs_storage_container_insights_operational_logs_not_public_accessiblemssql_managed_instance_encryption_at_rest_using_cmkmssql_managed_instance_vulnerability_assessment_enabledmysql_db_server_geo_redundant_backup_enabledmysql_flexible_server_audit_logging_enabledmysql_flexible_server_audit_logging_events_connection_setmysql_flexible_server_min_tls_1_2mysql_flexible_server_ssl_enabledmysql_server_audit_logging_enabledmysql_server_audit_logging_events_connection_setmysql_server_encrypted_at_rest_using_cmkmysql_server_infrastructure_encryption_enabledmysql_server_min_tls_1_2mysql_server_private_link_usedmysql_server_public_network_access_disabledmysql_ssl_enablednetwork_bastion_host_min_1network_ddos_enablednetwork_interface_ip_forwarding_disablednetwork_lb_diagnostics_logs_enablednetwork_lb_no_basic_skunetwork_network_peering_connectednetwork_public_ip_no_basic_skunetwork_security_group_diagnostic_setting_deployednetwork_security_group_https_access_restrictednetwork_security_group_not_configured_gateway_subnetsnetwork_security_group_outbound_access_restrictednetwork_security_group_rdp_access_restrictednetwork_security_group_remote_access_restrictednetwork_security_group_restrict_inbound_icmp_portnetwork_security_group_restrict_inbound_tcp_port_135network_security_group_restrict_inbound_tcp_port_1433network_security_group_restrict_inbound_tcp_port_20network_security_group_restrict_inbound_tcp_port_21network_security_group_restrict_inbound_tcp_port_23network_security_group_restrict_inbound_tcp_port_25network_security_group_restrict_inbound_tcp_port_3306network_security_group_restrict_inbound_tcp_port_4333network_security_group_restrict_inbound_tcp_port_445network_security_group_restrict_inbound_tcp_port_53network_security_group_restrict_inbound_tcp_port_5432network_security_group_restrict_inbound_tcp_port_5500network_security_group_restrict_inbound_tcp_port_5900network_security_group_restrict_inbound_udp_port_137network_security_group_restrict_inbound_udp_port_138network_security_group_restrict_inbound_udp_port_1434network_security_group_restrict_inbound_udp_port_445network_security_group_restrict_inbound_udp_port_53network_security_group_ssh_access_restrictednetwork_security_group_subnet_associatednetwork_security_group_udp_service_restrictednetwork_sg_flowlog_enablednetwork_sg_flowlog_retention_period_greater_than_90network_virtual_network_gateway_no_basic_skunetwork_watcher_enablednetwork_watcher_flow_log_enablednetwork_watcher_flow_log_traffic_analytics_enablednetwork_watcher_in_regions_with_virtual_networkpostgres_db_server_allow_access_to_azure_services_disabledpostgres_db_server_connection_throttling_onpostgres_db_server_geo_redundant_backup_enabledpostgres_db_server_latest_tls_versionpostgres_db_server_log_checkpoints_onpostgres_db_server_log_connections_onpostgres_db_server_log_disconnections_onpostgres_db_server_log_duration_onpostgres_db_server_log_retention_days_3postgres_flexible_server_allow_access_to_azure_services_disabledpostgres_flexible_server_connection_throttling_onpostgres_flexible_server_log_checkpoints_onpostgres_flexible_server_log_retention_days_3postgres_server_private_link_usedpostgres_sql_flexible_server_ssl_enabledpostgres_sql_server_encrypted_at_rest_using_cmkpostgres_sql_ssl_enabledpostgresql_server_infrastructure_encryption_enabledpostgresql_server_public_network_access_disabledrecovery_service_vault_uses_managed_identityrecovery_service_vault_uses_private_linkrecovery_service_vault_uses_private_link_for_backupredis_cache_in_virtual_networkredis_cache_min_tls_1_2redis_cache_no_basic_skuredis_cache_ssl_enabledredis_cache_uses_private_linksearch_service_logging_enabledsearch_service_public_network_access_disabledsearch_service_replica_count_3search_service_uses_managed_identitysearch_service_uses_private_linksearch_service_uses_sku_supporting_private_linksecuritycenter_additional_email_configuredsecuritycenter_asc_default_setting_not_disabledsecuritycenter_automatic_provisioning_monitoring_agent_onsecuritycenter_azure_defender_on_for_appservicesecuritycenter_azure_defender_on_for_containerregistrysecuritycenter_azure_defender_on_for_containerssecuritycenter_azure_defender_on_for_cosmosdbsecuritycenter_azure_defender_on_for_databasesecuritycenter_azure_defender_on_for_dnssecuritycenter_azure_defender_on_for_k8ssecuritycenter_azure_defender_on_for_keyvaultsecuritycenter_azure_defender_on_for_opensource_relational_dbsecuritycenter_azure_defender_on_for_resource_managersecuritycenter_azure_defender_on_for_serversecuritycenter_azure_defender_on_for_sqldbsecuritycenter_azure_defender_on_for_sqlservervmsecuritycenter_azure_defender_on_for_storagesecuritycenter_container_image_scan_enabledsecuritycenter_email_configuredsecuritycenter_mcas_integrationsecuritycenter_notify_alerts_configuredsecuritycenter_pricing_standardsecuritycenter_security_alerts_to_owner_enabledsecuritycenter_wdatp_integrationservicebus_name_space_private_link_usedservicebus_namespace_azure_ad_authentication_enabledservicebus_namespace_logging_enabledservicebus_namespace_no_overly_permissive_network_accessservicebus_premium_namespace_cmk_encryptedservicebus_use_virtual_service_endpointservicefabric_cluster_active_directory_authentication_enabledservicefabric_cluster_protection_level_as_encrypt_and_signsignalr_service_no_free_tier_skusignalr_service_private_link_usedspring_cloud_service_network_injection_enabledsql_database_allow_internet_accesssql_database_long_term_geo_redundant_backup_enabledsql_database_transparent_data_encryption_enabledsql_database_vulnerability_findings_resolvedsql_db_active_directory_admin_configuredsql_db_public_network_access_disabledsql_server_and_databases_va_enabledsql_server_atp_enabledsql_server_auditing_onsql_server_auditing_retention_period_90sql_server_auditing_storage_account_destination_retention_90_dayssql_server_azure_ad_authentication_enabledsql_server_azure_defender_enabledsql_server_tde_protector_cmk_encryptedsql_server_threat_detection_all_enabledsql_server_transparent_data_encryption_enabledsql_server_use_virtual_service_endpointsql_server_uses_private_linksql_server_va_setting_periodic_scan_enabledsql_server_va_setting_reports_notify_adminssql_server_va_setting_scan_reports_configuredstorage_account_blob_containers_public_access_privatestorage_account_blob_service_logging_enabledstorage_account_blobs_logging_enabledstorage_account_block_public_accessstorage_account_containing_vhd_os_disk_cmk_encryptedstorage_account_default_network_access_rule_deniedstorage_account_encryption_at_rest_using_cmkstorage_account_encryption_scopes_encrypted_at_rest_with_cmkstorage_account_geo_redundant_enabledstorage_account_infrastructure_encryption_enabledstorage_account_min_tls_1_2storage_account_queue_services_logging_enabledstorage_account_queues_logging_enabledstorage_account_restrict_network_accessstorage_account_secure_transfer_required_enabledstorage_account_soft_delete_enabledstorage_account_table_service_logging_enabledstorage_account_tables_logging_enabledstorage_account_trusted_microsoft_services_enabledstorage_account_use_virtual_service_endpointstorage_account_uses_azure_resource_managerstorage_account_uses_private_linkstorage_sync_private_link_usedstream_analytics_job_logging_enabledsynapse_workspace_data_exfiltration_protection_enabledsynapse_workspace_encryption_at_rest_using_cmksynapse_workspace_private_link_usedsynapse_workspace_vulnerability_assessment_enabled
Query: manual_control
Usage
powerpipe query azure_compliance.query.manual_controlSteampipe Tables
SQL
select id as resource, 'info' as status, 'Manual verification required.' as reason, display_name as subscriptionfrom azure_subscription;
Controls
The query is being used by the following controls:
- Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed
- Authorize access to security functions and information
- Azure Automation accounts should use customer-managed keys to encrypt data at rest
- Bot Service should be encrypted with a customer-managed key
- 3.11 Ensure Storage logging is enabled for Table service for read, write, and delete requests
- 3.2 Ensure that storage account access keys are periodically regenerated
- 3.4 Ensure that shared access signature tokens expire within an hour
- 4.3.8 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- 5.1.1 Ensure that a 'Diagnostics Setting' exists
- 5.3 Ensure that Diagnostic Logs are enabled for all services which support it
- 7.4 Ensure that only approved extensions are installed
- 7.5 Ensure that the latest OS Patches for all Virtual Machines are applied
- 7.6 Ensure that the endpoint protection for all Virtual Machines is installed
- 7.7 Ensure that VHD's are encrypted
- 8.3 Ensure that Resource Locks are set for mission critical Azure resources
- 9.11 Ensure Azure Keyvaults are used to store secrets
- 9.6 Ensure that 'PHP version' is the latest, if used to run the web app
- 9.7 Ensure that 'Python version' is the latest, if used to run the web app
- 9.8 Ensure that 'Java version' is the latest, if used to run the web app
- 3.11 Ensure Storage logging is enabled for Table service for 'Read', 'Write', and 'Delete' requests
- 3.2 Ensure that storage account access keys are periodically regenerated
- 3.4 Ensure that shared access signature tokens expire within an hour
- 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- 5.1.1 Ensure that a 'Diagnostics Setting' exists
- 5.3 Ensure that Diagnostic Logs are enabled for all services which support it
- 7.4 Ensure that only approved extensions are installed
- 7.5 Ensure that the latest OS Patches for all Virtual Machines are applied
- 7.6 Ensure that the endpoint protection for all Virtual Machines is installed
- 7.7 Ensure that VHD's are encrypted
- 8.5 Ensure that Resource Locks are set for mission critical Azure resources
- 9.11 Ensure Azure Keyvaults are used to store secrets
- 9.6 Ensure that 'PHP version' is the latest, if used to run the web app
- 9.7 Ensure that 'Python version' is the latest, if used to run the web app
- 9.8 Ensure that 'Java version' is the latest, if used to run the web app
- 10.1 Ensure that Resource Locks are set for Mission-Critical Azure Resources
- 2.1.12 Ensure That Microsoft Defender for IoT Is Set To 'On'
- 2.2.2 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On'
- 2.2.3 Ensure that Auto provisioning of 'Microsoft Defender for Containers components' is Set to 'On'
- 2.5 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'
- 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 3.6 Ensure that Shared Access Signature Tokens Expire Within an Hour
- 4.3.7 Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- 5.1.1 Ensure that a 'Diagnostics Setting' exists
- 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.7 Ensure that logging for Azure AppService 'AppServiceHTTPLogs' is enabled.
- 5.3 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
- 7.4 Ensure that only approved extensions are installed
- 7.5 Ensure that the endpoint protection for all Virtual Machines is installed
- 7.6 Ensure that VHD's are encrypted
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 9.11 Ensure Azure Keyvaults are used to store secrets
- 9.6 Ensure that 'PHP version' is the latest, if used to run the web app
- 9.7 Ensure that 'Python version' is the latest stable version, if used to run the web app
- 9.8 Ensure that 'Java version' is the latest, if used to run the web app
- 10.1 Ensure that Resource Locks are set for Mission-Critical Azure Resources
- 2.1.12 Ensure That Microsoft Defender for Resource Manager Is Set To 'On'
- 2.1.13 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'
- 2.1.16 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On'
- 2.1.17 Ensure that Auto provisioning of 'Microsoft Defender for Containers components' is Set to 'On'
- 2.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 3.6 Ensure that Shared Access Signature Tokens Expire Within an Hour
- 4.5.3 Use Azure Active Directory (AAD) Client Authentication and Azure RBAC where possible
- 5.1.1 Ensure that a 'Diagnostic Setting' exists
- 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.7 Ensure that logging for Azure AppService 'HTTP logs' is enabled
- 5.4 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
- 6.7 Ensure that Public IP addresses are Evaluated on a Periodic Basis
- 7.5 Ensure that Only Approved Extensions Are Installed
- 7.6 Ensure that Endpoint Protection for all Virtual Machines is installed
- 7.7 Ensure that VHDs are Encrypted
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 9.11 Ensure Azure Key Vaults are Used to Store Secrets
- 9.6 Ensure That 'PHP version' is the Latest, If Used to Run the Web App
- 9.7 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App
- 9.8 Ensure that 'Java version' is the latest, if used to run the Web App
- 10.1 Ensure that Resource Locks are set for Mission-Critical Azure Resources
- 2.1.12 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'
- 2.1.13 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 2.1.15 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On'
- 2.1.22 Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled
- 2.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- 3.16 Ensure 'Cross Tenant Replication' is not enabled
- 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 3.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 3.6 Ensure that Shared Access Signature Tokens Expire Within an Hour
- 4.5.3 Use Entra ID Client Authentication and Azure RBAC where possible
- 5.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
- 5.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 5.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled
- 5.4 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
- 6.7 Ensure that Public IP addresses are Evaluated on a Periodic Basis
- 7.5 Ensure that Only Approved Extensions Are Installed
- 7.6 Ensure that Endpoint Protection for all Virtual Machines is installed
- 7.7 [Legacy] Ensure that VHDs are Encrypted
- 7.8 Ensure only MFA enabled identities can access privileged Virtual Machine
- 7.9 Ensure Trusted Launch is enabled on Virtual Machines
- 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 9.10 Ensure Azure Key Vaults are Used to Store Secrets
- 10.1 Ensure that Resource Locks are set for Mission-Critical Azure Resources
- 3.1.10 Ensure that Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed'
- 3.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'
- 3.1.15 Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is enabled
- 3.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On'
- 3.1.3.4 Ensure that 'Agentless scanning for machines' component status is set to 'On'
- 3.1.3.5 Ensure that 'File Integrity Monitoring' component status is set to 'On'
- 3.1.4.3 Ensure that 'Agentless container vulnerability assessment' component status is 'On'
- 3.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'
- 3.3.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services
- 4.16 Ensure 'Cross Tenant Replication' is not enabled
- 4.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account
- 4.4 Ensure that Storage Account Access Keys are Periodically Regenerated
- 4.5 Ensure that Shared Access Signature Tokens Expire Within an Hour
- 5.4.3 Use Entra ID Client Authentication and Azure RBAC where possible
- 6.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
- 6.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics
- 6.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled
- 6.4 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
- 7.7 Ensure that Public IP addresses are Evaluated on a Periodic Basis
- 8.10 Ensure only MFA enabled identities can access privileged Virtual Machine
- 8.11 Ensure Trusted Launch is enabled on Virtual Machines
- 8.7 Ensure that Only Approved Extensions Are Installed
- 8.8 Ensure that Endpoint Protection for all Virtual Machines is installed
- 8.9 [Legacy] Ensure that VHDs are Encrypted
- 9.11 Ensure Azure Key Vaults are Used to Store Secrets
- 9.6 Ensure that 'Basic Authentication' is 'Disabled'
- Allowlist rules in your adaptive application control policy should be updated
- Azure Backup should be enabled for Virtual Machines
- Vulnerabilities in container security configurations should be remediated
- VM Image Builder templates should use private link
- Windows machines should meet requirements for 'Security Options - Network Access'
- Windows machines should meet requirements for 'Security Options - Recovery console'
- Windows machines should meet requirements for 'Security Options - User Account Control'
- Monitor missing Endpoint Protection in Azure Security Center
- Non-internet-facing virtual machines should be protected with network security groups
- Audit Linux machines that do not have the passwd file permissions set to 0644
- Endpoint protection solution should be installed on virtual machine scale sets
- System updates on virtual machine scale sets should be installed
- Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources
- SQL servers on machines should have vulnerability findings resolved
- Container registry images should have vulnerability findings resolved
- Azure Data Box jobs should enable double encryption for data at rest on the device
- Azure Data Box jobs should use a customer-managed key to encrypt the device unlock password
- Accounts with owner permissions on Azure resources should be MFA enabled
- Accounts with read permissions on Azure resources should be MFA enabled
- Accounts with write permissions on Azure resources should be MFA enabled
- IoT Hub device provisioning service data should be encrypted using customer-managed keys (CMK)
- Certificates should have the specified maximum validity period
- Kubernetes cluster containers CPU and memory resource limits should not exceed the specified limits
- Kubernetes cluster containers should not share host process ID or host IPC namespace
- Kubernetes clusters should not allow container privilege escalation
- Kubernetes cluster containers should only use allowed AppArmor profiles
- Kubernetes cluster containers should only use allowed capabilities
- Kubernetes cluster containers should only use allowed images
- Kubernetes cluster containers should run with a read only root file system
- Kubernetes clusters should be accessible only over HTTPS
- Kubernetes cluster pod hostPath volumes should only use allowed host paths
- Kubernetes cluster pods should only use approved host network and port range
- Kubernetes cluster pods and containers should only run with approved user and group IDs
- Kubernetes cluster should not allow privileged containers
- Kubernetes cluster services should listen only on allowed ports
- Logic Apps Integration Service Environment should be encrypted with customer-managed keys
- Azure Machine Learning workspaces should use private link
- Saved-queries in Azure Monitor should be saved in customer storage account for logs encryption
- Azure Monitor Logs clusters should be encrypted with customer-managed key
- Azure Monitor Logs clusters should be created with infrastructure-encryption enabled (double encryption)
- All Internet traffic should be routed via your deployed Azure Firewall
- Azure Recovery Services vaults should use customer-managed keys for encrypting backup data
- Azure Stream Analytics jobs should use customer-managed keys to encrypt data
- Azure Web PubSub Service should use private link