Checks

Azure Storage accounts use customer-managed keys (CMK) from Key Vault/Managed HSM for service-side encryption of data at rest, rather than platform-managed keys (encryption_type=Microsoft.Keyvault).

Azure Storage file shares have soft delete with a retention period (days). The evaluation determines if the storage account's file service has this setting enabled and records the retention duration applied to all shares.

Azure Storage accounts enforce a minimum TLS version of 1.2 for client connections to data services

Azure Storage accounts are evaluated for the presence of Private Endpoint connections. When configured, traffic flows over a VNet private IP via Private Link; when absent, access occurs through the storage account's public endpoint.

Azure Storage accounts have container soft delete enabled via a retention policy that keeps deleted containers for a set period.

Azure Storage accounts configured for geo-redundant replication via Standard_GRS, Standard_GZRS, Standard_RAGRS, or Standard_RAGZRS.

The setting indicates data is copied to a paired secondary region, with RA-* allowing read access during primary-region unavailability.

Azure Storage accounts have infrastructure encryption enabled, providing double encryption at rest alongside service-level encryption (requireInfrastructureEncryption=true).

Azure Storage accounts must define a key expiration period for access-key rotation, with a maximum of 90 days. The evaluation looks for accounts lacking this setting or exceeding that limit.

Azure Storage accounts are evaluated for secure transfer enforcement, requiring all client requests to use HTTPS only (enableHttpsTrafficOnly) and blocking HTTP.

Azure Storage file shares (SMB) are evaluated for SMB channel encryption and whether the allowed ciphers include the recommended AES-256-GCM.

This identifies if encryption is configured and a secure algorithm is present in the SMB settings for file shares within the storage account.

Azure Storage file shares (SMB) are configured to allow only the latest SMB protocol version, blocking legacy SMB versions at the storage account level

Azure VMs are evaluated for protection by Azure Backup by confirming they exist as VM backup items in a Recovery Services vault.

VMs absent from any vault item indicate no configured backup coverage.

Azure virtual machines are compared against an organization allowlist of VM size SKUs defined in desired_vm_sku_sizes.

Instances using sizes outside this list are flagged as non-standard.

Attached Azure managed disks (OS and data) are assessed to confirm encryption uses customer-managed keys (CMK) via disk encryption sets rather than platform-managed keys. Scope includes disks currently attached to VMs, evaluating their encryption type to verify CMK is applied.

Unattached Azure managed disks use Customer-Managed Keys (CMK) for server-side encryption rather than platform-managed keys. Only disks not currently attached to a VM are in scope.

Azure VMs are evaluated for use of an approved custom image by inspecting the VM image reference. The expected format is a subscription-scoped ID like /subscriptions/.../providers/Microsoft.Compute/images/<image>, not marketplace, gallery, or community sources.

Azure virtual machines use managed disks for the OS disk and every data disk, rather than page blob VHDs in storage accounts.

The evaluation confirms that all attached VM disks are managed.

Azure virtual machines are associated with a Just-in-Time (JIT) network access policy that opens management ports only for approved, time-bound requests from specified source IPs.

Azure Linux virtual machines are assessed for SSH configuration where disablePasswordAuthentication is set to true, allowing only public key authentication and disallowing interactive passwords.

Azure VM scale sets are associated with at least one load balancer backend pool.

The evaluation looks for a backend pool link on each scale set's network configuration.

Azure VM scale sets with 0 VM instances are identified as empty.

Azure virtual machines are evaluated for a backup policy in a Recovery Services vault with a daily retention period that meets the configured minimum. VMs lacking protection or using a shorter retention window are identified for review.

Azure VMs are evaluated for Trusted Launch with both Secure Boot and vTPM enabled.

Identifies VMs not set to TrustedLaunch or missing secureBootEnabled and vTpmEnabled together.