Checks

The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server. If incoming client certificates are enabled only an authenticated client with valid certificates can access the app.

Registering the identity used by an App with AD allows it to interact with other services without using username and password

Enabling authentication ensures that all communications in the application are authenticated. The auth_settings block needs to be filled out with the appropriate auth backend settings

By default, clients can connect to function endpoints by using both HTTP or HTTPS. You should redirect HTTP to HTTPs because HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated.

Use the latest version of HTTP to ensure you are benefiting from security fixes

Use a more recent TLS/SSL policy for the App Service

Storage container public access should be off. It can be configured for blobs only, containers and blobs or off entirely. The default is off, with no public access. Explicitly overriding publicAccess to anything other than off should be avoided.

You can configure your storage account to accept requests from secure connections only by setting the Secure transfer required property for the storage account. When you require secure transfer, any requests originating from an insecure connection are rejected. Microsoft recommends that you always require secure transfer for all of your storage accounts.

Storage Analytics logs detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis.

Some Microsoft services that interact with storage accounts operate from networks that can't be granted access through network rules. To help this type of service work as intended, allow the set of trusted Microsoft services to bypass the network rules

Azure Storage supports four versions of the TLS protocol: 1.0, 1.1, 1.2, and 1.3. Azure Storage uses TLS 1.2 or TLS 1.3 on public HTTPS endpoints, while TLS 1.0 and TLS 1.1 are still supported for backward compatibility. This check will warn if the minimum TLS version is set lower than TLS1_2. TLS1_2 and TLS1_3 are both allowed.

The default_action for network rules should come into effect when no other rules are matched. The default action should be set to Deny.

Network ACLs allow you to reduce your exposure to risk by limiting what can access your key vault.

The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.

Expiration Date is an optional Key Vault Key behavior and is not set by default.

Set when the resource will be become inactive.

Content Type is an optional Key Vault Secret behavior and is not enabled by default.

Clients may specify the content type of a secret to assist in interpreting the secret data when it's retrieved. The maximum length of this field is 255 characters. There are no pre-defined values. The suggested usage is as a hint for interpreting the secret data.

Purge protection is an optional Key Vault behavior and is not enabled by default.

Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI or PowerShell.

Expiration Date is an optional Key Vault Secret behavior and is not set by default.

Set when the resource will be become inactive.

SQL Server sends alerts for threat detection via email, if there are no email addresses set then mitigation will be delayed.

Postgresql can generate logs for successful connections to improve visibility for audit and configuration issue resolution.

SSL connections should be enforced were available to ensure secure transfer and reduce the risk of compromising data in flight.

Postgresql can generate logs for connection throttling to improve visibility for audit and configuration issue resolution.

Database resources should not publicly available. You should limit all access to the minimum that is required for your application to function.

Subscription owners should be notified when there are security alerts. By ensuring the administrators of the account have been notified they can quickly assist in any required remediation

Postgresql can generate logs for checkpoints to improve visibility for audit and configuration issue resolution.