Checks

Azure AI Search service limits its data-plane endpoint by disabling public network access. This evaluation checks whether the service only permits connections via private endpoints or narrowly scoped, explicitly allowed sources.

AKS clusters are evaluated for an automatic upgrade channel other than none. Automatic upgrades keep the Kubernetes control plane and node pools on supported patch/minor versions and reduce version drift across clusters.

Azure Kubernetes Service clusters are evaluated for Azure Monitor managed service for Prometheus (the cluster's azureMonitorProfile.metrics configuration). When enabled, cluster and workload metrics are collected into an Azure Monitor workspace for dashboards and alerting. This is distinct from Container Insights (the omsagent logs addon).

AKS clusters are evaluated for the Microsoft Defender security profile (securityProfile.defender.securityMonitoring.enabled=true). Defender for Containers extends security monitoring, threat detection, vulnerability assessment, and security posture insights to Azure Kubernetes Service workloads.

Azure Kubernetes Service clusters are evaluated for local account status. Disabling local accounts forces all cluster authentication through Microsoft Entra ID, ensuring centralized identity management, MFA, and conditional access.

AKS clusters with Kubernetes RBAC enforce authorization through roles and bindings mapped to identities and groups.

This evaluates whether the cluster has RBAC enabled to control access to namespaces and cluster-wide resources.

AKS agent pools use only private addressing, with node public IP assignment disabled (enableNodePublicIP=false). Clusters where any pool assigns a public IP to nodes are identified.

AKS clusters expose a private control plane FQDN and agent pools have enable_node_public_ip=false.

The evaluation focuses on the presence of a private FQDN and the absence of public IPs on nodes.

AKS clusters enforce Kubernetes network policies so that pod-to-pod traffic is governed by explicit ingress and egress rules. The finding evaluates whether a cluster has network policy enforcement enabled to support fine-grained, label-based segmentation between workloads.

API Management diagnostic logs in Log Analytics are analyzed for LLM-related operations. Requests are grouped by caller IP, the number of distinct monitored actions (e.g., ChatCompletions_Create, ImageGenerations_Create) within a configurable minutes window is measured, and that ratio is compared to a threshold to surface anomalous multi-action patterns.

Azure App Service apps enforce mutual TLS when client certificate mode is set to Required, meaning every inbound request must present a valid client certificate that the app can validate.

Azure App Service can enforce built-in Authentication/Authorization (Easy Auth) so requests are authenticated by a provider before reaching app code.

This evaluates whether platform auth is enabled for the app and an identity provider is configured.

Azure App Service web apps redirect HTTP traffic to HTTPS when the HTTPS Only setting is enabled. This evaluation identifies apps that do not force secure transport by checking whether plaintext requests are automatically redirected to encrypted endpoints.

Azure App Service web apps that run Java are assessed to ensure their configured runtime uses the latest supported major version (LTS) for the environment, across Linux and Windows.

Only apps with Java enabled are considered.

Azure App Service web apps running PHP are evaluated to ensure the runtime is configured to the latest supported release. The finding compares the app's PHP stack (from linuxFxVersion or php_version) with the newest available version.

Azure App Service web apps using Python are assessed to confirm the runtime is the latest supported version (e.g., 3.12). The evaluation reads the app's stack configuration to detect Python usage and compares the configured runtime against the defined latest baseline.

Azure App Service web apps are evaluated for HTTP/2 support via the http20_enabled configuration, indicating whether the site serves traffic using the HTTP/2 protocol

Azure App Service web apps are evaluated for FTP exposure via the ftpsState setting. Values FtpsOnly or Disabled indicate FTP is not allowed; AllAllowed means both FTP and FTPS are accepted.

Azure Function apps are evaluated for configured function access keys on HTTP endpoints.

The finding distinguishes functions with at least one access key defined from those without any keys configured.

Azure Function apps are configured to send telemetry to Application Insights when application settings include APPLICATIONINSIGHTS_CONNECTION_STRING or APPINSIGHTS_INSTRUMENTATIONKEY.

Azure Function apps redirect HTTP traffic to HTTPS when the HTTPS Only setting is enabled. This evaluation identifies Function apps that do not force secure transport by checking whether plaintext requests are automatically redirected to encrypted endpoints.

Azure Function apps are evaluated for the ftps_state setting that controls FTP/FTPS deployment endpoints. Values AllAllowed or FtpsOnly indicate deployment over FTP/FTPS is enabled, while Disabled indicates both endpoints are turned off.

Azure Function Apps are evaluated for an enabled managed identity (SystemAssigned or UserAssigned) configured on the app.

The finding indicates whether an identity is present to support token-based access to other Azure resources.

Azure Function apps with managed identities are evaluated for assignments to broad administrative roles: Owner, Contributor, User Access Administrator, RBAC Administrator.

The finding highlights functions whose identity carries elevated permissions beyond normal runtime needs.