Checks

Azure Key Vault diagnostic settings capture audit logs (AuditEvent) when the AuditEvent category is enabled, or when category groups audit and allLogs are enabled, and routed to a supported destination. Logged events include management and data-plane operations on vaults, keys, secrets, and certificates.

Each enabled secret in an Azure Key Vault (non-RBAC) is assessed to confirm it has an explicit expiration date (expires attribute) defined.

Azure Key Vault has private endpoint connections to serve secret and key operations over a private IP within your virtual network via Azure Private Link.

Azure Key Vault uses the Azure RBAC permission model for data-plane access to keys, secrets, and certificates, rather than legacy access policies.

Evaluates whether data access is managed through role assignments at the vault.

Each enabled key in an Azure Key Vault with RBAC-enabled access control is assessed to confirm it has an expiration (exp) attribute defined.

Each enabled secret in an Azure Key Vault (RBAC) is assessed to confirm it has an exp (expiration) date configured.

Azure Key Vault recoverability requires both enable_soft_delete and enable_purge_protection. With these enabled, vault objects remain recoverable after deletion and cannot be permanently purged during the retention period.

Azure Monitor Activity Log alert configurations are assessed for an activity log alert on Microsoft.Authorization/policyAssignments/write, indicating monitoring of newly created Azure Policy assignments

Azure Monitor Activity Log alert monitors Network Security Group changes via the Microsoft.Network/networkSecurityGroups/write operation to capture create/update events across the subscription

Azure Monitor activity log alert for Public IP addresses tracks Microsoft.Network/publicIPAddresses/write events at the subscription level, covering any creation or update of public IP resources.

Azure Monitor activity log alert is configured to capture Security Solutions create/update operations (Microsoft.Security/securitySolutions/write) at subscription scope.

Azure Monitor activity log alerts are configured for Azure SQL Server firewall rule changes, targeting the Microsoft.Sql/servers/firewallRules/write operation.

This evaluates whether notifications or automated actions are set when firewall rules are created or updated.

Azure Monitor activity log alerts include the NSG deletion signal (Microsoft.Network/networkSecurityGroups/delete or Microsoft.ClassicNetwork/networkSecurityGroups/delete). The finding indicates whether a subscription has an alert rule configured to trigger when a Network Security Group is deleted.

Azure Monitor Activity log alerts for policy assignment deletions using the Microsoft.Authorization/policyAssignments/delete operation at subscription scope

Azure Monitor activity log alert exists for the Delete Public IP Address operation (Microsoft.Network/publicIPAddresses/delete), capturing subscription-wide events when Public IP resources are removed.

Azure activity log alerts monitor deletions of Security Solutions by targeting the operation Microsoft.Security/securitySolutions/delete at subscription scope.

Identifies whether notifications are configured for security solution removal events.

Azure Monitor Activity log alerts watch the admin operation Microsoft.Sql/servers/firewallRules/delete, indicating when an Azure SQL firewall rule is removed across a subscription.

Azure Monitor Activity Log alert is configured for Service Health notifications where category is ServiceHealth and properties.incidentType is Incident, with the rule enabled.

Azure Monitor Diagnostic Settings are configured to export the Activity Log to an external destination (Log Analytics, Storage, Event Hub, or partner).

Azure Monitor Diagnostic Settings capture control-plane events at the subscription level. This evaluates whether at least one setting collects the categories: Administrative, Security, Policy, and Alert.

Azure Monitor Activity Logs sent to a Storage account are evaluated to confirm encryption with Customer-Managed Keys (CMK) instead of Microsoft-managed keys.

Azure Monitor Activity Logs sent to a Storage account are evaluated for Blob public access. The finding identifies whether the account that stores the logs has AllowBlobPublicAccess turned on.

Azure Database for MySQL Flexible Server audit configuration includes the CONNECTION event in audit_log_events.

Azure Database for MySQL Flexible Server with audit_log_enabled set to ON generates audit logs for connections, authentication, DDL/DML, and administrative actions.