Azure Security Checks

207+ Azure Security Checks

Complete list of Azure security checks across 19+ services based on CIS Azure Foundations Benchmark v2.1, PCI-DSS v4.0, ISO 27001:2022, SOC 2, and 13+ compliance frameworks.

Start Azure Scan Azure CSPM Overview

207+

Security Checks

18+

Azure Services

13+

Compliance Frameworks

v2.1

CIS Benchmark

Security Checks by Azure Service

Comprehensive security checks organized by Azure service. Click any check for detailed remediation guidance.

Azure Storage Accounts

15 checks

Ensure storage account secure transfer is enabled

Ensure storage account has infrastructure encryption enabled

Ensure storage account uses customer-managed keys

Ensure storage account public access is disabled

CIS 3.7critical

Ensure storage account minimum TLS version is 1.2

Ensure storage account has private endpoints enabled

Ensure storage account network rules are restrictive

Ensure storage account has blob soft delete enabled

Ensure storage account has container soft delete enabled

Ensure storage account has versioning enabled

Ensure storage account shared key access is disabled

Ensure storage account logging is enabled

Ensure storage account queue logging is enabled

Ensure storage account uses immutable storage

Ensure storage account has cross-tenant replication disabled

Azure Virtual Network

20 checks

Ensure NSG flow logs are enabled

Ensure NSG does not allow SSH from internet

Ensure NSG does not allow RDP from internet

Ensure NSG does not allow unrestricted access to high-risk ports

Ensure Network Watcher is enabled

Ensure virtual networks use DDoS Protection

Ensure VNet has a gateway subnet for VPN

Ensure Azure Firewall is deployed for egress filtering

Ensure Azure Firewall has threat intelligence enabled

Ensure Application Gateway has WAF enabled

Ensure Application Gateway WAF is in Prevention mode

Ensure private DNS zones are used

Ensure VNet peering is properly configured

Ensure Express Route has redundant connections

Ensure VPN Gateway uses strong encryption

Ensure Load Balancer diagnostic logs are enabled

Ensure Front Door has WAF policy configured

Ensure Traffic Manager has monitoring configured

Ensure Bastion is used for VM access

Ensure NAT Gateway is used for outbound connections

Azure Virtual Machines

20 checks

Ensure VM disk encryption is enabled

Ensure VMs do not have public IP addresses

Ensure VMs have approved extensions only

Ensure VM boot diagnostics are enabled

Ensure VMs use managed disks

Ensure VMs have automatic OS updates enabled

Ensure VMs have endpoint protection installed

Ensure VM scale sets have automatic instance repairs

Ensure VMs use managed identities

Ensure VMs are properly tagged

Ensure VMs have JIT access enabled

Ensure VMs use confidential computing where required

Ensure VM backup is enabled

Ensure VM availability sets or zones are used

Ensure VMs have Azure Monitor agent installed

Ensure VM images are from trusted sources

Ensure VMs have network isolation configured

Ensure VM guest configuration is enabled

Ensure VMs have disaster recovery configured

Ensure VM serial console access is logged

Azure Active Directory

15 checks

Ensure MFA is enabled for all users

CIS 1.1critical

Ensure MFA is enabled for privileged accounts

CIS 1.2critical

Ensure guest user access is restricted

Ensure self-service password reset is enabled

Ensure password hash sync is enabled for hybrid identity

Ensure privileged identity management is used

Ensure conditional access policies block legacy authentication

Ensure Conditional Access policies require compliant devices

Ensure security defaults are enabled if no Conditional Access

Ensure access reviews are configured for privileged roles

Ensure service principals use certificates instead of secrets

Ensure sign-in risk policy is enabled

Ensure user risk policy is enabled

Ensure directory audit logs are retained

Ensure emergency access accounts exist

Azure SQL Database

12 checks

Ensure Azure SQL auditing is enabled

Ensure Azure SQL has Advanced Threat Protection enabled

Ensure Azure SQL TDE is enabled

Ensure Azure SQL uses customer-managed TDE key

Ensure Azure SQL uses Azure AD authentication

Ensure Azure SQL firewall denies public access

Ensure Azure SQL has private endpoint enabled

Ensure Azure SQL has vulnerability assessment enabled

CIS 4.2.2medium

Ensure Azure SQL audit logs are retained adequately

CIS 4.1.6medium

Ensure Azure SQL has geo-redundant backups enabled

Ensure Azure SQL minimum TLS version is 1.2

Ensure Azure SQL data masking is configured

Azure Key Vault

12 checks

Ensure Key Vault has soft delete enabled

Ensure Key Vault has purge protection enabled

Ensure Key Vault uses RBAC for access control

Ensure Key Vault has private endpoint enabled

Ensure Key Vault network access is restricted

Ensure Key Vault diagnostic logging is enabled

Ensure Key Vault keys have expiration dates

Ensure Key Vault secrets have expiration dates

Ensure Key Vault certificates are renewed before expiration

Ensure Key Vault uses HSM-protected keys where required

Ensure Key Vault access policies follow least privilege

Ensure Key Vault is properly tagged

Azure Kubernetes Service (AKS)

15 checks

Ensure AKS cluster has Azure AD integration enabled

Ensure AKS cluster has Azure RBAC enabled

Ensure AKS cluster API server is not publicly accessible

Ensure AKS uses Azure Policy add-on

Ensure AKS cluster has network policy enabled

CIS 8.2.1medium

Ensure AKS cluster uses managed identities

Ensure AKS nodes use managed disks with encryption

Ensure AKS uses latest Kubernetes version

Ensure AKS has Defender for Containers enabled

Ensure AKS uses Azure Container Registry with scanning

Ensure AKS monitoring is enabled

Ensure AKS cluster has secret store CSI driver enabled

Ensure AKS uses user node pools

Ensure AKS has audit logging enabled

Ensure AKS has HTTP application routing disabled

Microsoft Defender for Cloud

15 checks

Ensure Microsoft Defender for Cloud is enabled

Ensure Defender for Servers is enabled

Ensure Defender for App Service is enabled

Ensure Defender for Azure SQL is enabled

Ensure Defender for Storage is enabled

Ensure Defender for Containers is enabled

Ensure Defender for Key Vault is enabled

Ensure Defender for Resource Manager is enabled

Ensure Defender for DNS is enabled

Ensure security contact email is configured

Ensure high severity alerts trigger email notifications

Ensure auto-provisioning of Log Analytics agent is enabled

Ensure secure score is monitored

Ensure regulatory compliance assessments are enabled

Ensure Defender alerts are integrated with SIEM

Azure App Service

12 checks

Ensure App Service uses HTTPS only

Ensure App Service uses latest TLS version

Ensure App Service has managed identity enabled

Ensure App Service authentication is enabled

Ensure App Service uses latest runtime version

Ensure App Service has diagnostic logging enabled

Ensure App Service has client certificates enabled

Ensure App Service has CORS restrictions configured

Ensure App Service has remote debugging disabled

Ensure App Service uses virtual network integration

Ensure App Service has backup configured

Ensure App Service uses private endpoints

Azure Cosmos DB

8 checks

Ensure Cosmos DB has firewall rules configured

Ensure Cosmos DB uses encryption at rest

Ensure Cosmos DB disables public network access

Ensure Cosmos DB has diagnostic logging enabled

Ensure Cosmos DB uses Azure AD authentication

Ensure Cosmos DB has automatic failover enabled

Ensure Cosmos DB uses private endpoints

Ensure Cosmos DB has backup retention configured

Azure Monitor

10 checks

Ensure activity log is retained for at least 90 days

CIS 5.1.1medium

Ensure activity log alert exists for Create Policy Assignment

Ensure activity log alert exists for Create or Update Security Solution

Ensure activity log alert exists for Create or Update NSG

CIS 5.2.3medium

Ensure activity log alert exists for Delete NSG

CIS 5.2.4medium

Ensure activity log alert exists for Create or Update NSG Rule

CIS 5.2.5medium

Ensure activity log alert exists for Delete NSG Rule

CIS 5.2.6medium

Ensure activity log alert exists for Create or Update SQL Server Firewall Rule

CIS 5.2.7medium

Ensure activity log alert exists for Delete SQL Server Firewall Rule

CIS 5.2.8medium

Ensure Log Analytics workspace has appropriate retention

Azure Functions

8 checks

Ensure Azure Functions uses HTTPS only

Ensure Azure Functions uses managed identity

Ensure Azure Functions has diagnostic logging enabled

Ensure Azure Functions uses latest runtime version

Ensure Azure Functions uses minimum TLS 1.2

Ensure Azure Functions has CORS configured properly

Ensure Azure Functions uses VNet integration

Ensure Azure Functions remote debugging is disabled

Azure Event Grid

5 checks

Ensure Event Grid topics use private endpoints

Ensure Event Grid uses managed identity for authentication

Ensure Event Grid has diagnostic logging enabled

Ensure Event Grid uses Azure AD authentication

Ensure Event Grid topics have network access restrictions

Azure Service Bus

6 checks

Ensure Service Bus uses customer-managed keys

Ensure Service Bus has network access restrictions

Ensure Service Bus uses private endpoints

Ensure Service Bus has diagnostic logging enabled

Ensure Service Bus uses managed identity

Ensure Service Bus disables local authentication

Azure Container Registry

10 checks

Ensure Container Registry has admin account disabled

Ensure Container Registry uses customer-managed keys

Ensure Container Registry has vulnerability scanning enabled

Ensure Container Registry has private endpoints enabled

Ensure Container Registry has network access restrictions

Ensure Container Registry has content trust enabled

Ensure Container Registry has quarantine policies configured

Ensure Container Registry has geo-replication enabled

Ensure Container Registry has diagnostic logging enabled

Ensure Container Registry uses Premium SKU for production

Azure API Management

10 checks

Ensure API Management uses HTTPS for APIs

Ensure API Management has subscription keys required

Ensure API Management has rate limiting configured

Ensure API Management uses managed identity

Ensure API Management has diagnostic logging enabled

Ensure API Management uses virtual network integration

Ensure API Management has OAuth 2.0 authorization configured

Ensure API Management has client certificate authentication

Ensure API Management has IP filtering configured

Ensure API Management validates API request schemas

Azure Logic Apps

7 checks

Ensure Logic Apps use managed identity

Ensure Logic Apps use HTTPS for triggers and actions

Ensure Logic Apps have secure input/output parameters

Ensure Logic Apps use virtual network integration

Ensure Logic Apps have diagnostic logging enabled

Ensure Logic Apps use access control for triggers

Ensure Logic Apps connections use OAuth

Azure Data Factory

7 checks

Ensure Data Factory uses managed identity

Ensure Data Factory uses customer-managed keys

Ensure Data Factory has public network access disabled

Ensure Data Factory has diagnostic logging enabled

Ensure Data Factory integration runtime uses VNet

Ensure Data Factory linked services use Key Vault for secrets

Ensure Data Factory has Git integration enabled

Supported Compliance Frameworks

Every check is mapped to relevant compliance framework controls

CIS Azure v2.0

CIS Azure v2.1

CIS Azure v3.0

CIS Azure v4.0

PCI-DSS v4.0

SOC 2 Type II

ISO 27001:2022

HIPAA

MITRE ATT&CK

NIS2 Directive

ENS RD2022

C5

Azure Security Benchmark

Run All 207+ Azure Security Checks

Get a comprehensive Azure security assessment in minutes. See all misconfigurations and compliance gaps.

Start Azure Scan Schedule Demo

No credit card required • Free tier available • 14-day trial