Checks

Azure Function apps are assessed for the runtime version set via FUNCTIONS_EXTENSION_VERSION. The finding identifies apps not configured to use the current supported major version ~4.

Azure Function apps are assessed for whether they are reachable from the public Internet. The evaluation considers the app's publicNetworkAccess state and the presence of access restrictions or private endpoints to limit inbound traffic.

Azure Function apps configured with Virtual Network integration uses a chosen subnet so outbound traffic is routed via the VNet and can reach private or service-endpoint-secured resources.

The finding reflects whether a function app is associated with a subnet resource ID.

Azure App Service web apps diagnostic settings include HTTP request logging when the AppServiceHTTPLogs category (or the allLogs group) is enabled to capture web access events.

Azure subscription contains at least one Application Insights resource collecting application telemetry (metrics, traces, logs) for monitored workloads.

The check determines whether telemetry collection exists at the subscription level, indicating that application monitoring is configured.

Azure App Service web apps are assessed for the configured minimum TLS version for HTTPS. The expected baseline is 1.2 or 1.3; settings that permit lower versions indicate acceptance of legacy TLS during client negotiation.

Azure App Service web apps are configured with a managed identity (identity: SystemAssigned or UserAssigned) for token-based access to Azure resources without embedded credentials

Azure Container Registry admin account configuration, confirming the built-in admin user is disabled so access relies on Microsoft Entra-based RBAC identities and scoped roles.

Azure Container Registry configuration indicates whether the registry permits unrestricted public access based on the Public network access setting.

Azure Container Registry access via Private Endpoints (Azure Private Link). Registries with private endpoint connections use private IPs; others rely on the public endpoint.

Azure Cosmos DB accounts are evaluated for automatic failover configuration. When enabled, Cosmos DB automatically promotes a secondary region to primary during a regional outage, ensuring continuous availability without manual intervention.

Azure Cosmos DB accounts are evaluated for continuous backup policy. Continuous backup provides point-in-time restore (PITR) enabling recovery to any point within the retention window, unlike periodic backup which only supports full restores at fixed intervals.

Azure Cosmos DB accounts limit connectivity to selected networks using virtual network rules and/or IP allowlists rather than permitting access from all networks.

The evaluation determines whether the account's network firewall enforces this restriction.

Azure Cosmos DB accounts are evaluated for minimum TLS version. TLS 1.0 and 1.1 are deprecated and contain known weaknesses. Enforcing TLS 1.2 ensures all client connections negotiate modern, secure encryption protocols.

Azure Cosmos DB accounts are evaluated for public network access. Disabling public network access ensures the account is only reachable through private endpoints or VNet service endpoints, reducing the attack surface and preventing direct exposure of the data plane to the internet.

Azure Cosmos DB accounts configured to use Microsoft Entra ID with Azure RBAC by disabling key-based credentials (disableLocalAuth=true). Clients authenticate with identities rather than account keys.

Azure Cosmos DB accounts are assessed for private endpoint connections that keep data-plane traffic on private IPs within authorized virtual networks.

Azure Databricks workspaces are evaluated for use of customer-managed keys (CMK) on at-rest encryption, based on the workspace's managed disk encryption configuration.

Azure Databricks workspaces are evaluated for secure cluster connectivity (No Public IP / NPIP). When enabled, compute (cluster) nodes are deployed without public IP addresses and communicate with the control plane through a secure relay, reducing the workspace's exposure to the internet.

Azure Databricks workspaces are evaluated for public network access. Disabling public network access ensures the workspace is only reachable through private endpoints, reducing the attack surface and preventing direct exposure of the control plane and data plane to the internet.

Azure Databricks workspaces using VNet injection are placed in a customer-managed VNet rather than a Databricks-managed network. This evaluates whether a workspace is linked to a customer VNet.

Microsoft Defender for Cloud security contact settings include additional email recipients defined in the emails field to receive alert notifications.

Azure virtual machines are assessed for the presence of an endpoint protection (antimalware) solution and its reported health across the subscription

Microsoft Defender for Cloud attack path email notifications are configured per subscription with a defined minimal risk level, and the setting is present and meets the required threshold.