Checks

Azure Database for PostgreSQL Flexible Server uses the log_disconnections setting to record when client sessions end and how long they lasted.

Log retention on Azure Database for PostgreSQL Flexible Server is governed by log_retention_days. Configuration is assessed as set and within 4-7 days versus unset or outside this range.

Azure Recovery Services backup policies are evaluated for adequate daily retention. Policies with fewer than 30 days of retention may not provide sufficient recovery points for incident investigation, compliance requirements, or ransomware recovery scenarios.

Azure Recovery Services vaults are evaluated for backup protected items. A vault with no protected items indicates that no resources (VMs, databases, file shares) are configured for backup through this vault, potentially leaving critical workloads unprotected.

Azure SQL Server auditing is assessed at the server level to confirm audit logging is active. Configurations with any auditing policy state set to Disabled indicate auditing is not configured for the server and its databases.

Azure SQL Server auditing settings are evaluated to ensure auditing is enabled and log retention is greater than 90 days. It considers the auditing policy state and the configured retention_days value.

Azure SQL Server is configured with a Microsoft Entra (Azure AD) administrator at the server scope, indicated by administrator_type set to ActiveDirectory.

Azure SQL Server instances are evaluated for the server-level security alert policy of Microsoft Defender for SQL, expecting the policy state to be Enabled.

Azure SQL logical servers are assessed for the configured minimum TLS version for client connections. The finding determines whether the minimal accepted version aligns with recommended modern values such as 1.2 or 1.3.

Azure SQL Server uses Transparent Data Encryption with a customer-managed key in Azure Key Vault, and each database has TDE Enabled

Azure SQL user databases have Transparent Data Encryption (TDE) enabled, ensuring encryption of database files, backups, and transaction logs at rest.

The master system database is excluded from evaluation.

Azure SQL Server server-level firewall rules are evaluated for an entry that allows the entire IPv4 space (0.0.0.0 to 255.255.255.255).

The finding identifies presence of this Internet-wide rule on the server firewall.

Azure SQL Server Vulnerability Assessment configuration, specifically whether recurring scans are set to email results to subscription admins/owners via Also send email notifications to admins and subscription owners.

Azure SQL servers are evaluated for Vulnerability Assessment configuration and whether periodic recurring scans are scheduled (e.g., weekly) for the server and its databases.

Servers with Vulnerability Assessment missing or scans not scheduled are identified.

Azure SQL Server vulnerability assessment uses recurring scans and emails results to designated recipients. This evaluates that VA is enabled and that Send scan reports to (or subscription admin notifications) is configured so scan reports are delivered.

Azure SQL Server has Vulnerability Assessment configured with a defined location to persist assessment reports and scan results

Azure Storage accounts are evaluated for whether Shared Key (account key) authorization is disabled, requiring identity-based access via Microsoft Entra ID and RBAC.

Azure Storage accounts with public network access disabled cannot be reached from public networks. Setting publicNetworkAccess to Disabled overrides the public access settings of individual containers and forces access through private endpoints or trusted services. This is independent from the 'Allow Blob Anonymous Access' setting.

Azure Storage accounts with blob anonymous (public) access disabled prevent containers or blobs from being set to a public access level. Setting allowBlobPublicAccess to false enforces no anonymous reads across the account. This is independent from the account's 'Public Network Access' setting, which is evaluated by storage_account_public_network_access_disabled.

Azure Storage accounts have blob versioning enabled (IsVersioningEnabled) to automatically retain previous versions of blobs created by updates or deletes

Azure Storage accounts are assessed for whether cross-tenant object replication is disallowed via AllowCrossTenantReplication=false, limiting replication policies to the same tenant.

Azure Storage accounts configure the default network access rule to Deny, so the public endpoint only accepts traffic from explicitly allowed virtual networks, IP ranges, or private endpoints

Azure Storage accounts with Default to Microsoft Entra authorization in the Azure portal use token-based Microsoft Entra ID (Azure RBAC) by default to access blobs, files, queues, and tables, rather than account keys

Azure Storage account network rules include the AzureServices bypass so trusted Microsoft services can reach the account even when firewalls restrict public access