Control: 7.9 Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration

Description

Enable only 'Azure Active Directory' (Microsoft Entra ID) authentication for Azure VPN Gateway point-to-site connections.

Microsoft Entra ID authentication provides strong security and centralized identity management, and reduces risks associated with static credentials and certificate management.

Remediation

Remediate from Azure Portal

Go to Virtual network gateways.
Under VPN gateway, click VPN gateways.
Click the name of a VPN gateway.
Under Settings, click Point-to-site configuration.
Ensure Authentication type click to expand the drop-down menu.
Check the box next to Azure Active Directory, and uncheck the boxes next to Azure certificate and RADIUS authentication.
Provide a Tenant, Audience, and Issuer for the Azure Active Directory configuration.
Click Save.
Repeat steps 1-8 for each VPN gateway requiring remediation.

Default Value

'Authentication type' is selected during creation of point-to-site configuration.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v500_7_9

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v500_7_9 --share

SQL

This control uses a named query:

select
  g.id as resource,
  case
    when vpn_client_configuration -> 'vpnAuthenticationTypes' @> '["AAD"]'::jsonb and jsonb_array_length(vpn_client_configuration -> 'vpnAuthenticationTypes') = 1 then 'ok'
    when jsonb_array_length(vpn_client_configuration -> 'vpnAuthenticationTypes') < 1 then 'skip'
    else 'alarm'
  end as status,
  case
    when vpn_client_configuration -> 'vpnAuthenticationTypes' @> '["AAD"]'::jsonb
     and jsonb_array_length(vpn_client_configuration -> 'vpnAuthenticationTypes') = 1 then g.name || ' VPN authentication type is set to only Azure Active Directory.'
    when jsonb_array_length(vpn_client_configuration -> 'vpnAuthenticationTypes') < 1 then g.name || ' has no point-to-site configuration defined.'
    else g.name || ' VPN authentication type is not restricted to only Azure Active Directory.'
  end as reason
  
  , g.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_virtual_network_gateway as g
  left join azure_subscription as sub on g.subscription_id = sub.subscription_id;

Control: 7.9 Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration

Description

Remediation

Default Value

Usage

SQL

Tags