CIS Microsoft Azure Foundations Benchmark v6.0.0

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)

By default, Azure Databricks uses a Databricks-Managed VNet.

Audit from Azure Portal 1. Go to Azure Portal Search for Databricks Workspaces. 1. Select the Databricks Workspace to audit. 1. Under Networking, check if the workspace is deployed in a Customer-Managed VNet. 1. If the Virtual Network field shows Databricks-Managed VNet, it is non-compliant. 1. Verify NSG rules and Private Endpoints for fine-grained access control. Audit from Azure CLI Run the following command to check if Databricks is using a customer-managed VNet: az network vnet show --resource-group <resource-group-name> --name <vnet-name> Ensure that Databricks subnets are present in the VNet configuration. Validate NSG rules attached to the Databricks subnets. Audit from PowerShell Get-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> | Select-Object VirtualNetworkId If VirtualNetworkId is null or shows a Databricks-Managed VNet, it is non-compliant. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 9c25c9e4-ee12-4882-afd2-11fb9d87893f - Name: 'Azure Databricks Workspaces should be in a virtual network'

• Requires additional configuration during Databricks workspace deployment. - Might increase operational overhead for network maintenance. - May impact connectivity if misconfigured (e.g., restrictive NSG rules or missing routes).

Automated

Using a customer-managed VNet ensures better control over network security and aligns with zero-trust architecture principles. It allows for: - Restricted outbound internet access to prevent unauthorized data exfiltration. - Integration with on-premises networks via VPN or ExpressRoute for hybrid connectivity. - Fine-grained NSG policies to restrict access at the subnet level. - Private Link for secure API access, avoiding public internet exposure.

Remediate from Azure Portal 1. Delete the existing Databricks workspace (migration required). 1. Create a new Databricks workspace with VNet Injection: 1. Go to Azure Portal Create Databricks Workspace. 1. Select Advanced Networking. 1. Choose Deploy into your own Virtual Network. 1. Specify a customer-managed VNet and associated subnets. 1. Enable Private Link for secure API access. Remediate from Azure CLI Deploy a new Databricks workspace in a custom VNet: az databricks workspace create --name <databricks-workspace-name> \ --resource-group <resource-group-name> \ --location <region> \ --managed-resource-group <managed-rg-name> \ --enable-no-public-ip true \ --network-security-group-rule NoAzureServices \ --public-network-access Disabled \ --custom-virtual-network-id /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name> Ensure NSG Rules are correctly configured: az network nsg rule create --resource-group <resource-group-name> \ --nsg-name <nsg-name> \ --name DenyAllOutbound \ --direction Outbound \ --access Deny \ --priority 4096 Remediate from PowerShell New-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> -Location <region> -ManagedResourceGroupName <managed-rg-name> -CustomVirtualNetworkId /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure that Network Security Groups are Configured for Databricks Subnets

By default, Databricks subnets do not have NSGs assigned.

Audit from Azure Portal 1. Navigate to Virtual Networks > Subnets, and review NSG assignments. Audit from Azure CLI az network nsg list --query [].{Name:name, Rules:securityRules} Audit from PowerShell Get-AzNetworkSecurityGroup -ResourceGroupName <resource-group-name>

• NSGs require periodic maintenance to ensure rule accuracy. * Misconfigured NSGs could inadvertently block required traffic.

Automated

Using NSGs with both explicit allow and deny rules provides clear documentation and control over permitted and prohibited traffic. While Azure NSGs implicitly deny all traffic not explicitly allowed, defining explicit deny rules for known malicious or unnecessary sources enhances clarity, simplifies troubleshooting, and supports compliance audits.

Remediate from Azure Portal 1. Assign NSG to Databricks subnets under Networking > NSG Settings.

Level 2

2 Analytics Services

2.1 Azure Databricks

Ensure that Traffic is Encrypted Between Cluster Worker Nodes

By default, traffic is not encrypted between cluster worker nodes.

Audit from Azure Portal Review cluster init scripts: 1. Navigate to your Azure Databricks workspace, go to the Clusters section, select a cluster, and check the Advanced Options for any init scripts that configure encryption settings. Verify spark configuration: 2. Ensure that the following Spark configurations are set: spark.authenticate true spark.authenticate.enableSaslEncryption true spark.network.crypto.enabled true spark.network.crypto.keyLength 256 spark.network.crypto.keyFactoryAlgorithm PBKDF2WithHmacSHA1 spark.io.encryption.enabled true These settings can be found in the cluster's Spark configuration properties. Check keystone management: 3. Verify that the Java KeyStore (JKS) file is securely stored in DBFS and that its integrity is maintained. 4. Ensure that the keystore password is securely managed and not hardcoded in scripts.

• Enabling encryption may introduce a performance penalty due to the computational overhead associated with encrypting and decrypting traffic. This can result in longer query execution times, especially for data-intensive operations. * Implementing encryption requires creating and managing init scripts, which adds complexity to cluster configuration and maintenance. * The shared encryption secret is derived from the hash of the keystore stored in DBFS. If the keystore is updated or rotated, all running clusters must be restarted to prevent authentication failures between Spark workers and drivers.

Manual

• Protects sensitive data during transit between cluster nodes, mitigating risks of data interception or unauthorized access. * Aligns with organizational security policies and compliance requirements that mandate encryption of data in transit. * Enhances overall security posture by ensuring that all inter-node communications within the cluster are encrypted.

Create a JKS keystore: 1. Generate a Java KeyStore (JKS) file that will be used for SSL/TLS encryption. 2. Upload the keystore file to a secure directory in DBFS (e.g. /dbfs/<keystore-directory>/jetty_ssl_driver_keystore.jks). Develop an init script: 3. Create an init script that performs the following tasks: - Retrieves the JKS keystore file and password. - Derives a shared encryption secret from the keystore. - Configures Spark driver and executor settings to enable encryption. 4. Example init script: #!/bin/bash set -euo pipefail keystore_dbfs_file=/dbfs/<keystore-directory>/jetty_ssl_driver_keystore.jks max_attempts=30 while [ ! -f ${keystore_dbfs_file} ]; do if [ $max_attempts == 0 ]; then echo ERROR: Unable to find the file : $keystore_dbfs_file. Failing the script. exit 1 fi sleep 2s ((max_attempts--)) done sasl_secret=$(sha256sum $keystore_dbfs_file | cut -d' ' -f1) if [ -z ${sasl_secret} ]; then echo ERROR: Unable to derive the secret. Failing the script. exit 1 fi local_keystore_file=$DB_HOME/keys/jetty_ssl_driver_keystore.jks local_keystore_password=gb1gQqZ9ZIHS if [[ $DB_IS_DRIVER = TRUE ]]; then driver_conf=${DB_HOME}/driver/conf/spark-branch.conf echo Configuring driver conf at $driver_conf if [ ! -e $driver_conf ]; then echo spark.authenticate true >> $driver_conf echo spark.authenticate.secret $sasl_secret >> $driver_conf echo spark.authenticate.enableSaslEncryption true >> $driver_conf echo spark.network.crypto.enabled true >> $driver_conf echo spark.network.crypto.keyLength 256 >> $driver_conf echo spark.network.crypto.keyFactoryAlgorithm PBKDF2WithHmacSHA1 >> $driver_conf echo spark.io.encryption.enabled true >> $driver_conf echo spark.ssl.enabled true >> $driver_conf echo spark.ssl.keyPassword $local_keystore_password >> $driver_conf echo spark.ssl.keyStore $local_keystore_file >> $driver_conf echo spark.ssl.keyStorePassword $local_keystore_password >> $driver_conf echo spark.ssl.protocol TLSv1.3 >> $driver_conf fi fi executor_conf=${DB_HOME}/conf/spark.executor.extraJavaOptions echo Configuring executor conf at $executor_conf if [ ! -e $executor_conf ]; then echo -Dspark.authenticate=true >> $executor_conf echo -Dspark.authenticate.secret=$sasl_secret >> $executor_conf echo -Dspark.authenticate.enableSaslEncryption=true >> $executor_conf echo -Dspark.network.crypto.enabled=true >> $executor_conf echo -Dspark.network.crypto.keyLength=256 >> $executor_conf echo -Dspark.network.crypto.keyFactoryAlgorithm=PBKDF2WithHmacSHA1 >> $executor_conf echo -Dspark.io.encryption.enabled=true >> $executor_conf echo -Dspark.ssl.enabled=true >> $executor_conf echo -Dspark.ssl.keyPassword=$local_keystore_password >> $executor_conf echo -Dspark.ssl.keyStore=$local_keystore_file >> $executor_conf echo -Dspark.ssl.keyStorePassword=$local_keystore_password >> $executor_conf echo -Dspark.ssl.protocol=TLSv1.3 >> $executor_conf fi 5. Save.

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure that Users and Groups are Synced from Microsoft Entra ID to Azure Databricks

By default, Azure Databricks does not sync users and groups from Microsoft Entra ID.

Audit from Azure Portal Verify SCIM provisioning is enabled: 1. Go to Microsoft Entra ID. 1. Under Manage, click Enterprise applications. 1. Click the name of the Azure Databricks SCIM application. 1. Under Provisioning, confirm that SCIM provisioning is enabled and running. Check user sync status in Azure Portal: 5. Under Provisioning Logs, verify the last successful sync and any failed entries. Check user sync status in Databricks: 6. Go to Admin Console > Identity and Access Management. 7. Confirm that Users and Groups match those assigned in Microsoft Entra ID. Ensure role-based access control (RBAC) mapping is correct: 8. Verify that users are assigned appropriate Databricks roles (e.g. Admin, User, Contributor). 9. Confirm that groups are mapped to workspace access roles.

SCIM provisioning requires role mapping to avoid misconfigured user privileges.

Manual

Syncing users and groups from Microsoft Entra ID centralizes access control, enforces the least privilege principle by automatically revoking unnecessary access, reduces administrative overhead by eliminating manual user management, and ensures auditability and compliance with industry regulations.

Remediate from Azure Portal Enable provisioning in Azure Portal: 1. Go to Microsoft Entra ID. 1. Under Manage, click Enterprise applications. 1. Click the name of the Azure Databricks SCIM application. 1. Under Provisioning, select Automatic and enter the SCIM endpoint and API token from Databricks. Enable provisioning in Databricks: 5. Navigate to Admin Console > Identity and Access Management. 6. Enable SCIM provisioning and generate an API token. Configure role assignments: 7. Ensure groups from Entra ID are mapped to appropriate Databricks roles. 8. Restrict administrative privileges to designated security groups. Regularly monitor sync logs: 9. Periodically review sync logs in Microsoft Entra ID and Databricks Admin Console. 10. Configure Azure Monitor alerts for provisioning failures. Disable manual user creation in Databricks: 11. Ensure that all user management is controlled via SCIM sync from Entra ID. 12. Disable personal access token usage for authentication. Remediate from Azure CLI Enable SCIM User and Group Provisioning in Azure Databricks: az ad app update --id <databricks-app-id> --set provisioning.provisioningMode=Automatic

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure that Unity Catalog is Configured for Azure Databricks

New workspaces have Unity Catalog enabled by default. Existing workspaces may require manual enablement.

Method 1: Verify unity catalog deployment: 1. As an Azure Databricks account admin, log into the account console. 1. Click Workspaces. 1. Find your workspace and check the Metastore column. If a metastore name is present, your workspace is attached to a Unity Catalog metastore and therefore enabled for Unity Catalog. Method 2: Run a SQL query to confirm Unity Catalog enablement Run the following SQL query in the SQL query editor or a notebook that is attached to a Unity Catalog-enabled compute resource. No admin role is required. SELECT CURRENT_METASTORE(); If the query returns a metastore ID like the following, then your workspace is attached to a Unity Catalog metastore and therefore enabled for Unity Catalog.

• Improperly configured permissions may lead to data exfiltration or unauthorized access. * Unity Catalog requires structured governance policies to be effective and prevent overly permissive access.

Manual

• Enforces centralized access control policies and reduces data security risks. * Enables identity-based authentication via Microsoft Entra ID. * Improves compliance with industry regulations (e.g. GDPR, HIPAA, SOC 2) by providing audit logs and access visibility. * Prevents unauthorized data access through table-, row-, and column-level security (RLS & CLS).

Use the remediation procedure written in this article: https://learn.microsoft.com/en-us/azure/databricks/data-governance/unity-catalog/get-started.

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure that Usage is Restricted and Expiry is Enforced for Databricks Personal Access Tokens

By default, personal access tokens are enabled and users can create the Personal access token and their expiry time.

Azure Databricks administrators can monitor and revoke personal access tokens within their workspace. Detailed instructions are available in the Monitor and Revoke Personal Access Tokens section of the Microsoft documentation: https://learn.microsoft.com/en-us/azure/databricks/admin/access-control/tokens. To evaluate the usage of personal access tokens in your Azure Databricks account, you can utilize the provided notebook that lists all PATs not rotated or updated in the last 90 days, allowing you to identify tokens that may require revocation. This process is detailed here: https://docs.azure.cn/en-us/databricks/security/auth/oauth-pat-usage. Implementing diagnostic logging provides a comprehensive reference of audit log services and events, enabling you to track activities related to personal access tokens. More information can be found in the diagnostic log reference section: https://docs.azure.cn/en-us/databricks/security/auth/oauth-pat-usage.

If revoked improperly, applications relying on these tokens may fail, requiring a remediation plan for token rotation. Increased administrative effort is required to track and manage API tokens effectively.

Manual

Restricting usage and enforcing expiry for personal access tokens reduces exposure to long-lived tokens, minimizes the risk of API abuse if compromised, and aligns with security best practices through controlled issuance and enforced expiry.

Remediate from Azure Portal Disable personal access tokens: If your workspace does not require PATs, you can disable them entirely to prevent their use.

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure that Diagnostic Log Delivery is Configured for Azure Databricks

Audit from Azure Portal Check if diagnostic logging is enabled for the Databricks workspace: 1. Go to Azure Databricks. 1. Select a workspace. 1. In the left-hand menu, select Monitoring > Diagnostic settings. 1. Verify if a diagnostic setting is configured. If not, diagnostic logging is not enabled. Ensure that logging is enabled for the following categories:

Logs consume storage and may require additional monitoring tools, leading to increased operational overhead and costs. Incomplete log configurations may result in missing critical events, reducing monitoring effectiveness.

Automated

Diagnostic logging provides visibility into security and operational activities within Databricks workspaces while maintaining an audit trail for forensic investigations, and it supports compliance with regulatory standards that require logging and monitoring.

Remediate from Azure Portal Enable diagnostic logging for Azure Databricks: 1. Navigate to your Azure Databricks workspace. 1. In the left-hand menu, select Monitoring > Diagnostic settings. 1. Click + Add diagnostic setting. 1. Under Category details, select the log categories you wish to capture, such as AuditLogs, Clusters, Notebooks, and Jobs. 1. Choose a destination for the logs: - Log Analytics workspace: For advanced querying and monitoring. - Storage account: For long-term retention. - Event Hub: For integration with third-party systems. 1. Provide a Name for the diagnostic setting. 1. Click Save. Implement log retention policies: 1. Navigate to your Log Analytics workspace. 1. Under General, select Usage and estimated costs. 1. Click Data Retention. 1. Adjust the retention period slider to the desired number of days (up to 730 days). 1. Click OK. Monitor logs for anomalies: 1. Navigate to Azure Monitor. 1. Select Alerts > + New alert rule. 1. Under Scope, specify the Databricks resource. 1. Define Condition based on log queries that identify anomalies (e.g. unauthorized access attempts). 1. Configure Actions to notify stakeholders or trigger automated responses. 1. Provide an Alert rule name and description. 1. Click Create alert rule. Remediate from Azure CLI Enable diagnostic logging for Azure Databricks: az monitor diagnostic-settings create --name DatabricksLogging --resource <databricks-resource-id> --logs '[{category: AuditLogs, enabled: true}, {category: Clusters, enabled: true}, {category: Notebooks, enabled: true}, {category: Jobs, enabled: true}]' --workspace <log-analytics-id> Implement log retention policies: az monitor log-analytics workspace update --resource-group <resource-group> --name <log-analytics-name> --retention-time 365 Monitor logs for anomalies: az monitor activity-log alert create --name DatabricksAnomalyAlert --resource-group <resource-group> --scopes <databricks-resource-id> --condition contains 'UnauthorizedAccess'

• Ensure that the Azure Databricks workspace is on the Premium plan to utilize diagnostic logging features. * Regularly review and update alert rules to adapt to evolving security threats and operational requirements.

Level 2

2 Analytics Services

2.1 Azure Databricks

Ensure Critical Data in Azure Databricks is Encrypted with Customer-managed Keys (CMK)

By default, Encryption type is set to Microsoft Managed Keys.

Audit: Audit from Azure Portal 1. Go to Azure Portal → Databricks Workspaces. 2. Select a Databricks Workspace and go to Encryption settings. 3. Check if customer-managed keys (CMK) are enabled under Managed Disk Encryption .4. If CMK is not enabled, the workspace is non-compliant. Audit from Azure CLI Run the following command to check encryption settings for Databricks workspace: az databricks workspace show --name <databricks-workspace-name> --resourcegroup <resource-group-name> --query encryption Ensure that keySource is set to Microsoft.KeyVault. Audit from PowerShell Get-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> -Name <databricks-workspace-name> | Select-Object Encryption Verify that encryption is set to Customer-Managed Keys (CMK). Audit from Databricks CLI databricks workspace get-metadata --workspace-id <workspace-id> Ensure that encryption settings reflect a CMK setup.

If the key expires due to setting the 'activation date' and 'expiration date', the key must be rotated manually. Using Customer Managed Keys may also incur additional man-hour requirements to create, store, manage, and protect the keys as needed.

Manual

By default in Azure, data at rest tends to be encrypted using Microsoft Managed Keys. If your organization wants to control and manage encryption keys for compliance and defense-in-depth, Customer Managed Keys can be established. While it is possible to automate the assessment of this recommendation, the assessment status for this recommendation remains 'Manual' due to ideally limited scope. The scope of application - which workloads CMK is applied to - should be carefully considered to account for organizational capacity and targeted to workloads with specific need for CMK.

NOTE: These remediations assume that an Azure KeyVault already exists in the subscription. Remediate from Azure CLI 1. Create a dedicated key: az keyvault key create --vault-name <keyvault-name> --name <key-name> -protection <software or hsm> 2. Assign permissions to Databricks: az keyvault set-policy --name <keyvault-name> --resource-group <resourcegroup-name> --spn <databricks-spn> --key-permissions get wrapKey unwrapKey 3. Enable encryption with CMK: az databricks workspace update --name <databricks-workspace-name> --resourcegroup <resource-group-name> --key-source Microsoft.KeyVault --key-name <key-name> --keyvault-uri <keyvault-uri> Remediate from PowerShell $Key = Add-AzKeyVaultKey -VaultName <keyvault-name> -Name <key-name> Destination <software or hsm> Set-AzDatabricksWorkspace -ResourceGroupName <resource-group-name> WorkspaceName <databricks-workspace-name> -EncryptionKeySource Microsoft.KeyVault -KeyVaultUri $Key.Id

This recommendation is based on the Common Reference Recommendation Ensure critical data is encrypted with customer-managed keys (CMK).

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure 'No Public IP' is Set to 'Enabled'

No Public IP is set to Enabled by default.

Audit from Azure Portal 1. Go to Azure Databricks. 2. Click the name of a workspace. 3. Under Settings, click Networking. 4. Under Network access, ensure that Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) is set to Enabled. 5. Repeat steps 1-4 for each workspace. Audit from Azure CLI Run the following command to list workspaces: az databricks workspace list For each workspace, run the following command to get the enableNoPublicIp setting: az databricks workspace show --resource-group <resource-group> --name <workspace> --query parameters.enableNoPublicIp.value Ensure that true is returned. Audit from PowerShell Run the following command to list workspaces: Get-AzDatabricksWorkspace Run the following command to get the workspace in a resource group with a given name: $workspace = Get-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> Run the following command to get the EnableNoPublicIp setting: $workspace.EnableNoPublicIP Ensure that True is returned. Audit from Azure Policy - Policy ID: [51c1490f-3319-459c-bbbc-7f391bbed753] - Name: 'Azure Databricks Clusters should disable public IP'

Enabling secure cluster connectivity requires careful network configuration. Before secure cluster connectivity can be enabled, Azure Databricks workspaces must be deployed in a customer-managed virtual network (VNet injection).

Automated

Enabling secure cluster connectivity limits exposure to the public internet, improving security and reducing the risk of external attacks.

Remediate from Azure Portal 1. Go to Azure Databricks. 2. Click the name of a workspace. 3. Under Settings, click Networking. 4. Under Network access, next to Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP), click the radio button next to Enabled. 5. Click Save. 6. Repeat steps 1-5 for each workspace requiring remediation. Remediate from Azure CLI For each workspace requiring remediation, run the following command to set enableNoPublicIp to true: az databricks workspace update --resource-group <resource-group> --name <workspace> --enable-no-public-ip true Remediate from PowerShell For each workspace requiring remediation, run the following command to set EnableNoPublicIP to True: Update-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> -EnableNoPublicIP

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure 'Allow Public Network Access' is set to 'Disabled'

Allow Public Network Access is set to Enabled by default.

Audit from Azure Portal 1. Go to Azure Databricks. 2. Click the name of a workspace. 3. Under Settings click Networking. 4. Under Network access, ensure Allow Public Network Access is set to Disabled. 5. Repeat steps 1-4 for each workspace. Audit from Azure CLI Run the following command to list workspaces: az databricks workspace list For each workspace, run the following command to get the publicNetworkAccess setting: az databricks workspace show --resource-group <resource-group> --name <workspace> --query publicNetworkAccess Ensure that Disabled is returned. Audit from PowerShell Run the following command to list workspaces: Get-AzDatabricksWorkspace Run the following command to get the PublicNetworkAccess setting: $workspace = Get-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> $workspace.PublicNetworkAccess Ensure that Disabled is returned. Audit from Azure Policy - Policy ID: [0e7849de-b939-4c50-ab48-fc6b0f5eeba2] - Name: 'Azure Databricks Workspaces should disable public network access'

Prior to disabling public network access, it is strongly recommended that virtual network integration is completed or private endpoints/links are set up. Disabling public network access restricts access to the service and will require the configuration of a virtual network and/or private endpoints for any services or users needing access within trusted networks.

Automated

Disabling public network access improves security by ensuring that Azure Databricks workspaces are not exposed on the public internet.

Remediate from Azure Portal 1. Go to Azure Databricks. 2. Click the name of a workspace. 3. Under Settings click Networking. 4. Under Network access, next to Allow Public Network Access, click the radio button next to Disabled. 5. Click Save. 6. Repeat steps 1-5 for each workspace requiring remediation. Remediate from Azure CLI For each workspace requiring remediation, run the following command to set publicNetworkAccess to Disabled: az databricks workspace update --resource-group <resource-group> --name <workspace> --public-network-access Disabled Remediate from PowerShell For each workspace requiring remediation, run the following command to set PublicNetworkAccess to Disabled: Update-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> -PublicNetworkAccess Disabled

This recommendation is based on the Common Reference Recommendation Ensure public network access is Disabled.

Level 2

2 Analytics Services

2.1 Azure Databricks

Ensure Private Endpoints are used to access Azure Databricks workspaces

Private endpoints are not configured for Azure Databricks workspaces by default.

Audit from Azure Portal 1. Go to Azure Databricks. 2. Click the name of a workspace. 3. Under Settings, click Networking. 4. Click Private endpoint connections. 5. Ensure a private endpoint connection exists with a connection state of Approved. 6. Repeat steps 1-5 for each workspace. Audit from Azure CLI Run the following command to list workspaces: az databricks workspace list For each workspace, run the following command to get the privateEndpointConnections configuration: az databricks workspace show --resource-group <resource-group> --name <workspace> --query privateEndpointConnections Ensure a private endpoint connection is returned with a privateLinkServiceConnectionState status of Approved. Audit from PowerShell Run the following command to list workspaces: Get-AzDatabricksWorkspace Run the following command to get the PrivateEndpointConnection configuration: $workspace = Get-AzDatabricksWorkspace -ResourceGroupName <resource-group> -Name <workspace> $workspace.PrivateEndpointConnection | Select-Object -Property Id,PrivateLinkServiceConnectionStateStatus Ensure a private endpoint connection is returned with a PrivateLinkServiceConnectionStateStatus of Approved. Audit from Azure Policy - Policy ID: [258823f2-4595-4b52-b333-cc96192710d8] - Name: 'Azure Databricks Workspaces should use private link'

If an Azure Virtual Network is not implemented correctly, this may result in the loss of critical network traffic. Private endpoints are charged per hour of use. Before a private endpoint can be configured, Azure Databricks workspaces must be deployed in a customer-managed virtual network, must have secure cluster connectivity enabled, and must be on the Premium pricing tier.

Automated

Using private endpoints for Azure Databricks workspaces ensures that all communication between clients, services, and data sources occurs over a secure, private IP space within an Azure Virtual Network (VNet). This approach eliminates exposure to the public internet, significantly reducing the attack surface and aligning with Zero Trust principles.

Remediate from Azure Portal 1. Go to Azure Databricks. 2. Click the name of a workspace. 3. Under Settings, click Networking. 4. Click Private endpoint connections. 5. Click + Private endpoint. 6. Under Project details, select a Subscription and a Resource group. 7. Under Instance details, provide a Name, Network Interface Name, and select a Region. 8. Click Next : Resource >. 9. Select a Target sub-resource. 10. Click Next : Virtual Network >. 11. Under Networking, select a Virtual network and a Subnet. 12. Optionally, configure Private IP configuration and Application security group. 13. Click Next : DNS >. 14. Optionally, configure Private DNS integration. 15. Click Next : Tags >. 16. Optionally, configure tags. 17. Click Next : Review + create >. 18. Click Create. 19. Repeat steps 1-18 for each workspace requiring remediation. Remediate from Azure CLI For each workspace requiring remediation, run the following command to create a private endpoint connection: az network private-endpoint create --resource-group <resource-group> --name <private-endpoint> --location <location> --vnet-name <virtual-network> --subnet <subnet> --private-connection-resource-id <workspace> --connection-name <private-endpoint-connection> --group-id <browser_authentication|databricks_ui_api>

This recommendation is based on the Common Reference Recommendation Ensure Private Endpoints are used to access {service}.

Level 1

2 Analytics Services

2.1 Azure Databricks

Ensure Azure Databricks groups are reviewed periodically

By default Azure Databricks only has the Owner user and role assigned.

Audit from Azure Portal 1. From Azure Home select Azure Databricks. 1. Select the Databricks implementation you wish to audit. 1. Select Access control (IAM). 1. In the horizontal menu select Role assignments. 1. Audit the list for each role and its assignment to each user.

Administrative overhead of user management.

Manual

To ensure accurate privileges for your Azure Databricks implementation, your organization should review all users and permission assignments on a regular interval.

Remediate from Azure Portal 1. From Azure Home select Azure Databricks. 1. Select the Databricks implementation you wish to audit. 1. Select Access control (IAM). 1. Scroll down and select Add role assignment. 1. Search for the role you wish to add. Then select Next. 1. Select the group members you wish to add. Then select Next. 1. Review the info you have chosen, then select Review + assign.

Level 2

3 Compute Services

3.1 Virtual Machines

Ensure only MFA Enabled Identities can Access Privileged Virtual Machine

Audit from Azure Portal 1. Log in to the Azure portal. 1. Select the Subscription, then click on Access control (IAM). 1. Click Role : All and click All to display the drop-down menu. 1. Type Virtual Machine Administrator Login and select Virtual Machine Administrator Login. 1. Review the list of identities that have been assigned the Virtual Machine Administrator Login role. 1. Go to Microsoft Entra ID. 1. For Per-user MFA: 1. Under Manage, click Users. 1. Click Per-user MFA. 1. Ensure that none of the identities assigned the Virtual Machine Administrator Login role from step 4 have Status set to disabled. 1. For Conditional Access: 1. Under Manage, click Security. 1. Under Protect, click Conditional Access. 1. Ensure that none of the identities assigned the Virtual Machine Administrator Login role from step 4 are exempt from a Conditional Access policy requiring MFA for all users.

This recommendation requires the Entra ID P2 license to implement. Ensure that identities provisioned to a virtual machine utilize an RBAC/ABAC group and are allocated a role using Azure PIM, and that the role settings require MFA or use another third-party PAM solution for accessing virtual machines.

Manual

Integrating multi-factor authentication (MFA) as part of the organizational policy can greatly reduce the risk of an identity gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs. An Adversary may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized to move laterally and perform actions with the virtual machine's managed identity. The adversary may then perform management actions or access cloud-hosted resources as the logged-on managed identity.

Remediate from Azure Portal 1. Log in to the Azure portal. 2. This can be remediated by enabling MFA for user, Removing user access or Reducing access of managed identities attached to virtual machines. - Case I : Enable MFA for users having access on virtual machines. 1. Go to Microsoft Entra ID. 1. For Per-user MFA: 1. Under Manage, click Users. 1. Click Per-user MFA. 1. For each user requiring remediation, check the box next to their name. 1. Click Enable MFA. 1. Click Enable. 1. For Conditional Access: 1. Under Manage, click Security. 1. Under Protect, click Conditional Access. 1. Update the Conditional Access policy requiring MFA for all users, removing each user requiring remediation from the Exclude list. - Case II : Removing user access on a virtual machine. 1. Select the Subscription, then click on Access control (IAM). 2. Select Role assignments and search for Virtual Machine Administrator Login or Virtual Machine User Login or any role that provides access to log into virtual machines. 3. Click on Role Name, Select Assignments, and remove identities with no MFA configured. - Case III : Reducing access of managed identities attached to virtual machines. 1. Select the Subscription, then click on Access control (IAM). 2. Select Role Assignments from the top menu and apply filters on Assignment type as Privileged administrator roles and Type as Virtual Machines. 3. Click on Role Name, Select Assignments, and remove identities access make sure this follows the least privileges principal.

Level 1

5 Identity Services

5.1 Security Defaults (Per-User MFA)

Ensure that 'security defaults' is Enabled in Microsoft Entra ID

If your tenant was created on or after October 22, 2019, security defaults may already be enabled in your tenant.

Audit from Azure Portal To ensure security defaults is enabled in your directory: 1. From Azure Home select the Portal Menu. 2. Browse to Microsoft Entra ID > Properties. 3. Select Manage security defaults. 4. Under Security defaults, verify that Enabled (recommended) is selected.

This recommendation should be implemented initially and then may be overridden by other service/product specific CIS Benchmarks. Administrators should also be aware that certain configurations in Microsoft Entra ID may impact other Microsoft services such as Microsoft 365.

Automated

Security defaults provide secure default settings that we manage on behalf of organizations to keep customers safe until they are ready to manage their own identity security settings. For example, doing the following: - Requiring all users and admins to register for MFA. - Challenging users with MFA - when necessary, based on factors such as location, device, role, and task. - Disabling authentication from legacy authentication clients, which cant do MFA.

Remediate from Azure Portal To enable security defaults in your directory: 1. From Azure Home select the Portal Menu. 1. Browse to Microsoft Entra ID > Properties. 1. Select Manage security defaults. 1. Under Security defaults, select Enabled (recommended). 1. Select Save.

This recommendation differs from the Microsoft 365 Benchmark. This is because the potential impact associated with disabling Security Defaults is dependent upon the security settings implemented in the environment. It is recommended that organizations disabling Security Defaults implement appropriate security settings to replace the settings configured by Security Defaults.

Level 1

5 Identity Services

5.1 Security Defaults (Per-User MFA)

Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes'

By default, Require Multifactor Authentication to register or join devices with Microsoft Entra is set to No.

Audit from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Entra ID 1. Under Manage, select Devices 1. Under Manage, select Device settings 1. Under Microsoft Entra join and registration settings, ensure that Require Multifactor Authentication to register or join devices with Microsoft Entra is set to Yes

A slight impact of additional overhead, as Administrators will now have to approve every access to the domain.

Manual

Multi-factor authentication is recommended when adding devices to Microsoft Entra ID. When set to Yes, users who are adding devices from the internet must first use the second method of authentication before their device is successfully added to the directory. This ensures that rogue devices are not added to the domain using a compromised user account.

Remediate from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Entra ID 1. Under Manage, select Devices 1. Under Manage, select Device settings 1. Under Microsoft Entra join and registration settings, set Require Multifactor Authentication to register or join devices with Microsoft Entra to Yes 1. Click Save

If Conditional Access is available, this recommendation should be bypassed in favor of the Conditional Access implementation of requiring Multifactor Authentication to register or join devices with Microsoft Entra. https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-mfa-device-register-join

Level 1

5 Identity Services

5.1 Security Defaults (Per-User MFA)

Ensure that 'multifactor authentication' is 'enabled' For All Users

Multifactor authentication is not enabled for all users by default. Starting in 2024, multifactor authentication is enabled for administrative accounts by default.

Audit from Azure Portal 1. Go to Microsoft Entra ID. 1. Under Manage, click Users. 1. Click Per-user MFA from the top menu. 1. Ensure that Status is enabled for all users. Audit from REST API Run the following Graph PowerShell command: get-mguser -All | where {$_.StrongAuthenticationMethods.Count -eq 0} | Select-Object -Property UserPrincipalName If the output contains any UserPrincipalName, then this recommendation is non-compliant.

Users would require two forms of authentication before any access is granted. Additional administrative time will be required for managing dual forms of authentication when enabling multifactor authentication.

Automated

Multifactor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multifactor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multifactor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

Remediate from Azure Portal 1. Go to Microsoft Entra ID. 1. Under Manage, click Users. 1. Click Per-user MFA from the top menu. 1. Click the box next to a user with Status disabled. 1. Click Enable MFA. 1. Click Enable. 1. Repeat steps 1-6 for each user requiring remediation. Other options within Azure Portal - https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings - https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted#enable-multi-factor-authentication-with-conditional-access

Level 1

5 Identity Services

5.1 Security Defaults (Per-User MFA)

Ensure that 'Allow users to remember multifactor authentication on devices they trust' is Disabled

By default, Allow users to remember multi-factor authentication on devices they trust is disabled.

Audit from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Entra ID 1. Under Manage, click Users 1. Click the Per-user MFA button on the top bar 1. Click on Service settings 1. Ensure that Allow users to remember multi-factor authentication on devices they trust is not enabled

For every login attempt, the user will be required to perform multi-factor authentication.

Manual

Remembering Multi-Factor Authentication (MFA) for devices and browsers allows users to have the option to bypass MFA for a set number of days after performing a successful sign-in using MFA. This can enhance usability by minimizing the number of times a user may need to perform two-step verification on the same device. However, if an account or device is compromised, remembering MFA for trusted devices may affect security. Hence, it is recommended that users not be allowed to bypass MFA.

Remediate from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Entra ID 1. Under Manage, click Users 1. Click the Per-user MFA button on the top bar 1. Click on Service settings 1. Uncheck the box next to Allow users to remember multi-factor authentication on devices they trust 1. Click Save

Level 1

5 Identity Services

5.3 Periodic Identity Reviews

Ensure that Azure Admin Accounts Are Not Used for Daily Operations

Audit from Azure Portal Monitor: 1. Go to Monitor. 1. Click Activity log. 1. Review the activity log and ensure that admin accounts are not being used for daily operations. Microsoft Entra ID: 1. Go to Microsoft Entra ID. 1. Under Monitoring, click Sign-in logs. 1. Review the sign-in logs and ensure that admin accounts are not being accessed more frequently than necessary.

Minor administrative overhead includes managing separate accounts, enforcing stricter access controls, and potential licensing costs for advanced security features.

Manual

Using admin accounts for daily operations increases the risk of accidental misconfigurations and security breaches.

If admin accounts are being used for daily operations, consider the following: - Monitor and alert on unusual activity. - Enforce the principle of least privilege. - Revoke any unnecessary administrative access. - Use Conditional Access to limit access to resources. - Ensure that administrators have separate admin and user accounts. - Use Microsoft Entra ID Protection helps organizations detect, investigate, and remediate identity-based risks. - Use Privileged Identity Management (PIM) in Microsoft Entra ID to limit standing administrator access to privileged roles, discover who has access, and review privileged access.

Level 1

5 Identity Services

5.3 Periodic Identity Reviews

Ensure that Guest Users are Reviewed on a Regular Basis

By default no guest users are created.

Audit from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Entra ID 1. Under Manage, select Users 1. Click on Add filter 1. Select User type 1. Select Guest from the Value dropdown 1. Click Apply 1. Audit the listed guest users Audit from Azure CLI az ad user list --query [?userType=='Guest'] Ensure all users listed are still required and not inactive. Audit from Azure PowerShell Get-AzureADUser |Where-Object {$_.UserType -like Guest} |Select-Object DisplayName, UserPrincipalName, UserType -Unique Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: e9ac8f8e-ce22-4355-8f04-99b911d6be52 - Name: 'Guest accounts with read permissions on Azure resources should be removed' - Policy ID: 94e1c2ac-cbbe-4cac-a2b5-389c812dee87 - Name: 'Guest accounts with write permissions on Azure resources should be removed' - Policy ID: 339353f6-2387-4a45-abe4-7f529d121046 - Name: 'Guest accounts with owner permissions on Azure resources should be removed'

Before removing guest users, determine their use and scope. Like removing any user, there may be unforeseen consequences to systems if an account is removed without careful consideration.

Manual

Guest users are typically added outside your employee on-boarding/off-boarding process and could potentially be overlooked indefinitely. To prevent this, guest users should be reviewed on a regular basis. During this audit, guest users should also be determined to not have administrative privileges.

Remediate from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Entra ID 1. Under Manage, select Users 1. Click on Add filter 1. Select User type 1. Select Guest from the Value dropdown 1. Click Apply 1. Check the box next to all Guest users that are no longer required or are inactive 1. Click Delete 1. Click OK Remediate from Azure CLI Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems. az ad user update --id <exampleaccountid@domain.com> --account-enabled {false} After determining that there are no dependent systems, delete the user. Remove-AzureADUser -ObjectId <exampleaccountid@domain.com> Remediate from Azure PowerShell Before deleting the user, set it to inactive using the ID from the Audit Procedure to determine if there are any dependent systems. Set-AzureADUser -ObjectId <exampleaccountid@domain.com> -AccountEnabled false After determining that there are no dependent systems, delete the user. PS C:\>Remove-AzureADUser -ObjectId <exampleaccountid@domain.com>

It is good practice to use a dynamic security group to manage guest users. To create the dynamic security group: 1. Navigate to the 'Microsoft Entra ID' blade in the Azure Portal 2. Select the 'Groups' item 3. Create new 4. Type of 'dynamic' 5. Use the following dynamic selection rule. (user.userType -eq Guest) 6. Once the group has been created, select access reviews option and create a new access review with a period of monthly and send to relevant administrators for review.

Level 1

5 Identity Services

5.3 Periodic Identity Reviews

Ensure That Use of the 'User Access Administrator' Role is Restricted

Audit from Azure Portal 1. From Azure Home select the Portal Menu. 1. Select Subscriptions. 1. Select a subscription. 1. Select Access control (IAM). 1. Look for the following banner at the top of the page: Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access. If the banner is displayed, the User Access Administrator is assigned. Audit from Azure CLI Run the following command: az role assignment list --role User Access Administrator --scope / Ensure that the command does not return any User Access Administrator role assignment information.

Increased administrative effort to manage and remove role assignments appropriately.

Automated

The User Access Administrator role provides extensive access control privileges. Unnecessary assignments heighten the risk of privilege escalation and unauthorized access. Removing the role immediately after use minimizes security exposure.

Remediate from Azure Portal 1. From Azure Home select the Portal Menu. 1. Select Subscriptions. 1. Select a subscription. 1. Select Access control (IAM). 1. Look for the following banner at the top of the page: Action required: X users have elevated access in your tenant. You should take immediate action and remove all role assignments with elevated access. 1. Click View role assignments. 1. Click Remove. Remediate from Azure CLI Run the following command: az role assignment delete --role User Access Administrator --scope /

Level 1

5 Identity Services

5.3 Periodic Identity Reviews

Ensure that All 'Privileged' Role Assignments are Periodically Reviewed

Audit from Azure Portal 1. From Azure Home select the Portal Menu. 2. Select Subscriptions. 3. Select a subscription. 4. Select Access control (IAM). 5. Look for the number under the word Privileged accompanied by a link titled View Assignments. Click the View assignments link. 6. For each privileged role listed, evaluate whether the assignment is appropriate and current for each User, Group, or App assigned to each privileged role. NOTE: Determining 'appropriate' assignments requires a clear understanding of your organization's personnel, systems, policy, and security requirements.

Increased administrative effort to manage and remove role assignments appropriately.

Manual

Privileged roles are crown jewel assets that can be used by malicious insiders, threat actors, and even through mistake to significantly damage an organization. These roles should be periodically reviewed to identify lingering permissions assignment and detect lateral movement through privilege escalation.

Review privileged role assignments and remove any that are no longer necessary or appropriate. Use Azure PIM (Privileged Identity Management) to implement just-in-time access for privileged roles.

Level 1

5 Identity Services

5.3 Periodic Identity Reviews

Ensure Disabled User Accounts do not Have Read, Write, or Owner Permissions

Disabled user accounts retain their prior role assignments.

Audit from Azure Portal 1. Go to Microsoft Entra ID. 2. Under Manage, click Users. 3. Click Add filter. 4. Click Account enabled. 5. Click the toggle switch to set the value to No. 6. Click Apply. 7. Click the Display name of a disabled user account. 8. Click Azure role assignments. 9. Ensure that no read, write, or owner roles are assigned to the user account. 10. Repeat steps 7-9 for each disabled user account. Audit from PowerShell Connect-AzureAD Get-AzureADUser $user = Get-AzureADUser -ObjectId <object-id> $user.AccountEnabled If AccountEnabled is False, run: Get-AzRoleAssignment -ObjectId $user.ObjectId Audit from Azure Policy - Policy ID: [0cfea604-3201-4e14-88fc-fae4c427a6c5] - Name: 'Blocked accounts with owner permissions on Azure resources should be removed' - Policy ID: [8d7e1fde-fe26-4b5f-8108-f8e432cbc2be] - Name: 'Blocked accounts with read and write permissions on Azure resources should be removed'

Ensure disabled accounts are not relied on for break glass or automated processes before removing roles to avoid service disruption.

Manual

Disabled accounts should not retain access to resources, as this poses a security risk. Removing role assignments mitigates potential unauthorized access and enforces the principle of least privilege.

Remediate from Azure Portal 1. Go to Microsoft Entra ID. 2. Under Manage, click Users. 3. Click Add filter. 4. Click Account enabled. 5. Click the toggle switch to set the value to No. 6. Click Apply. 7. Click the Display name of a disabled user account with read, write, or owner roles assigned. 8. Click Azure role assignments. 9. Click the name of a read, write, or owner role. 10. Click Assignments. 11. Click Remove in the row for the disabled user account. 12. Click Yes. 13. Repeat steps 7-12 for disabled user accounts requiring remediation. Remediate from PowerShell Remove-AzRoleAssignment -ObjectId $user.ObjectId -RoleDefinitionName <role-definition-name>

Level 1

5 Identity Services

5.3 Periodic Identity Reviews

Ensure 'Tenant Creator' Role Assignments are Periodically Reviewed

The Tenant Creator role is not assigned by default.

Audit from Azure Portal 1. Go to Microsoft Entra ID. 2. Under Manage, click Roles and administrators. 3. In the search bar, type Tenant Creator. 4. Click the role. 5. Review the assignments and ensure that they are appropriate.

Verify that the Tenant Creator role is no longer required by any assignments before removal to avoid disruption of critical functions.

Manual

Unnecessary assignments increase the risk of privilege escalation and unauthorized access. This recommendation should be applied alongside the recommendation 'Ensure that Restrict non-admin users from creating tenants is set to Yes'.

Remediate from Azure Portal 1. Go to Microsoft Entra ID. 2. Under Manage, click Roles and administrators. 3. In the search bar, type Tenant Creator. 4. Click the role. 5. Click the name of an assignment. 6. Check the box next to the Tenant Creator role. 7. Click X Remove assignments. 8. Click Yes. 9. Repeat steps 1-8 for each assignment requiring remediation.

Level 1

5 Identity Services

5.3 Periodic Identity Reviews

Ensure All Non-privileged Role Assignments are Periodically Reviewed

Users do not have non-privileged roles assigned to them by default.

Audit from Azure Portal 1. Go to Subscriptions. 2. Click the name of a subscription. 3. Click Access control (IAM). 4. Click Role assignments. 5. Click Job function roles. 6. For each role, ensure the assignments are appropriate. 7. Repeat steps 1-6 for each subscription.

Increased administrative effort to manage and remove role assignments appropriately.

Manual

To ensure the principle of least privilege is followed, non-privileged role assignments should be reviewed periodically to confirm that users are granted only the minimum level of permissions they need to perform their tasks.

Remediate from Azure Portal 1. Go to Subscriptions. 2. Click the name of a subscription. 3. Click Access control (IAM). 4. Click Role assignments. 5. Click Job function roles. 6. Check the box next to any inappropriate assignments. 7. Click Delete. 8. Click Yes. 9. Repeat steps 1-8 for each subscription.

Level 1

5 Identity Services

Ensure that No Custom Subscription Administrator Roles Exist

By default, no custom owner roles are created.

Audit from Azure Portal 1. From Azure Home select the Portal Menu. 1. Select Subscriptions. 1. Select a subscription. 1. Select Access control (IAM). 1. Select Roles. 1. Click Type and select Custom role from the drop-down menu. 1. Select View next to a role. 1. Select JSON. 1. Check for assignableScopes set to the subscription, and actions set to *. 1. Repeat steps 7-9 for each custom role. Audit from Azure CLI List custom roles: az role definition list --custom-role-only True Check for entries with assignableScope of the subscription, and an action of * Audit from PowerShell Connect-AzAccount Get-AzRoleDefinition |Where-Object {($_.IsCustom -eq $true) -and ($_.Actions.contains('*'))} Check the output for AssignableScopes value set to the subscription. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: a451c1ef-c6ca-483d-87ed-f49761e3ffb5 - Name: 'Audit usage of custom RBAC roles'

Subscriptions will need to be handled by Administrators with permissions.

Automated

Custom roles in Azure with administrative access can obfuscate the permissions granted and introduce complexity and blind spots to the management of privileged identities. For less mature security programs without regular identity audits, the creation of Custom roles should be avoided entirely. For more mature security programs with regular identity audits, Custom Roles should be audited for use and assignment, used minimally, and the principle of least privilege should be observed when granting permissions

Remediate from Azure Portal 1. From Azure Home select the Portal Menu. 1. Select Subscriptions. 1. Select a subscription. 1. Select Access control (IAM). 1. Select Roles. 1. Click Type and select Custom role from the drop-down menu. 1. Check the box next to each role which grants subscription administrator privileges. 1. Select Delete. 1. Select Yes. Remediate from Azure CLI List custom roles: az role definition list --custom-role-only True Check for entries with assignableScope of the subscription, and an action of *. To remove a violating role: az role definition delete --name <role name> Note that any role assignments must be removed before a custom role can be deleted. Ensure impact is assessed before deleting a custom role granting subscription administrator privileges.

Level 2

5 Identity Services

Ensure that a Custom Role is Assigned Permissions for Administering Resource Locks

A role for administering resource locks does not exist by default.

Audit from Azure Portal 1. In the Azure portal, navigate to a subscription or resource group. 1. Click Access control (IAM). 1. Click Roles. 1. Click Type : All. 1. Click to view the drop-down menu. 1. Select Custom role. 1. Click View in the Details column of a custom role. 1. Review the role permissions. 1. Click Assignments and review the assignments. 1. Click the X to exit the custom role details page. 1. Repeat steps 7-10. Ensure that at least one custom role exists that assigns the Microsoft.Authorization/locks permission to appropriate members. 1. Repeat steps 1-11 for each subscription or resource group.

By adding this role, specific permissions may be granted for managing only resource locks rather than needing to provide the broad Owner or User Access Administrator role, reducing the risk of the user being able to cause unintentional damage.

Manual

Given that the resource lock functionality is outside of standard Role-Based Access Control (RBAC), it would be prudent to create a resource lock administrator role to prevent inadvertent unlocking of resources.

Remediate from Azure Portal 1. In the Azure portal, navigate to a subscription or resource group. 1. Click Access control (IAM). 1. Click + Add. 1. Click Add custom role. 1. In the Custom role name field enter Resource Lock Administrator. 1. In the Description field enter Can Administer Resource Locks. 1. For Baseline permissions select Start from scratch. 1. Click Next. 1. Click Add permissions. 1. In the Search for a permission box, type Microsoft.Authorization/locks. 1. Click the result. 1. Check the box next to Permission. 1. Click Add. 1. Click Review + create. 1. Click Create. 1. Click OK. 1. Click + Add. 1. Click Add role assignment. 1. In the Search by role name, description, permission, or ID box, type Resource Lock Administrator. 1. Select the role. 1. Click Next. 1. Click + Select members. 1. Select appropriate members. 1. Click Select. 1. Click Review + assign. 1. Click Review + assign again. 1. Repeat steps 1-26 for each subscription or resource group requiring remediation. Remediate from PowerShell: Below is a PowerShell definition for a resource lock administrator role created at an Azure Management group level Import-Module Az.Accounts Connect-AzAccount $role = Get-AzRoleDefinition User Access Administrator $role.Id = $null $role.Name = Resource Lock Administrator $role.Description = Can Administer Resource Locks $role.Actions.Clear() $role.Actions.Add(Microsoft.Authorization/locks/*) $role.AssignableScopes.Clear() * Scope at the Management group level Management group $role.AssignableScopes.Add(/providers/Microsoft.Management/managementGroups/MG-Name) New-AzRoleDefinition -Role $role Get-AzureRmRoleDefinition Resource Lock Administrator

Level 2

5 Identity Services

Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one'

By default Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant are set to Allow everyone (default)

Audit from Azure Portal 1. From the Azure Portal Home select the portal menu 1. Select Subscriptions 1. In the Advanced options drop-down menu, select Manage Policies 1. Ensure Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant are set to Permit no one

Subscriptions will need to have these settings turned off to be moved.

Manual

Permissions to move subscriptions in and out of a Microsoft Entra tenant must only be given to appropriate administrative personnel. A subscription that is moved into a Microsoft Entra tenant may be within a folder to which other users have elevated permissions. This prevents loss of data or unapproved changes of the objects within by potential bad actors.

Remediate from Azure Portal 1. From the Azure Portal Home select the portal menu 1. Select Subscriptions 1. In the Advanced options drop-down menu, select Manage Policies 1. Set Subscription leaving Microsoft Entra tenant and Subscription entering Microsoft Entra tenant to Permit no one 1. Click Save changes

Level 1

5 Identity Services

Ensure there are between 2 and 3 Subscription Owners

A subscription has 1 owner by default.

Audit from Azure Portal 1. Go to Subscriptions. 2. Click the name of a subscription. 3. Click Access Controls (IAM). 4. Click Role assignments. 5. Click Role : All. 6. Click the arrow next to All. 7. Click Owner. 8. Ensure a minimum of 2 and a maximum of 3 members are returned. 9. Repeat steps 1-8 for each subscription. Audit from Azure CLI az role assignment list --role Owner --scope /subscriptions/<subscription-id> --query "[].{PrincipalName:principalName, Type:principalType}" Ensure a minimum of 2 and a maximum of 3 members are returned. Audit from PowerShell Get-AzRoleAssignment -RoleDefinitionName Owner -Scope /subscriptions/<subscription-id> Audit from Azure Policy - Policy ID: [09024ccc-0c5f-475e-9457-b7c0d9ed487b] - Name: 'There should be more than one owner assigned to your subscription' - Policy ID: [4f11b553-d42e-4e3a-89be-32ca364cad4c] - Name: 'A maximum of 3 owners should be designated for your subscription'

Implementation may require changes in administrative workflows or the redistribution of roles and responsibilities.

Automated

If groups are used, ensure their membership is tightly controlled and regularly reviewed to avoid privilege sprawl. This includes user accounts, Entra ID groups, service principals, and managed identities.

Remediate from Azure Portal 1. Go to Subscriptions. 2. Click the name of a subscription. 3. Click Access Controls (IAM). 4. Click Role assignments. 5. Click Role : All. 6. Click Owner. 7. Check the box next to members from whom the owner role should be removed. 8. Click Delete. 9. Click Yes. 10. Repeat for each subscription requiring remediation. Remediate from Azure CLI az role assignment delete --ids <role-assignment-ids>

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs

By default, diagnostic setting is not set.

Audit from Azure Portal To identify Diagnostic Settings on a subscription: 1. Go to Monitor 2. Click Activity Log 3. Click Export Activity Logs 4. Select a Subscription 5. Ensure a Diagnostic setting exists for the selected Subscription To identify Diagnostic Settings on specific resources: 1. Go to Monitoring 2. Click Diagnostic settings 3. Ensure a Diagnostic setting exists for all appropriate resources. Audit from Azure CLI To identify Diagnostic Settings on a subscription: az monitor diagnostic-settings subscription list --subscription <subscription ID> To identify Diagnostic Settings on a resource az monitor diagnostic-settings list --resource <resource Id> Audit from PowerShell To identify Diagnostic Settings on a Subscription: Get-AzDiagnosticSetting -SubscriptionId <subscription ID> To identify Diagnostic Settings on a specific resource: Get-AzDiagnosticSetting -ResourceId <resource ID>

Diagnostic settings incur costs based on the amount of data collected and the destination.

Automated

A diagnostic setting controls how a diagnostic log is exported. By default, logs are retained only for 90 days. Diagnostic settings should be defined so that logs can be exported and stored for a longer duration to analyze security activities within an Azure subscription.

Remediate from Azure Portal To enable Diagnostic Settings on a Subscription: 1. Go to Monitor 2. Click on Activity log 3. Click on Export Activity Logs 4. Click + Add diagnostic setting 5. Enter a Diagnostic setting name 6. Select Categories for the diagnostic setting 7. Select the appropriate Destination details (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 8. Click Save To enable Diagnostic Settings on a specific resource: 1. Go to Monitoring 1. Click Diagnostic settings 1. Select Add diagnostic setting 1. Enter a Diagnostic setting name 1. Select the appropriate log, metric, and destination (this may be Log Analytics, Storage Account, Event Hub, or Partner solution) 1. Click Save Repeat these step for all resources as needed. Remediate from Azure CLI To configure Diagnostic Settings on a Subscription: az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[--event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs <JSON encoded categories> (e.g. [{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}]) To configure Diagnostic Settings on a specific resource: az monitor diagnostic-settings create --subscription <subscription ID> --resource <resource ID> --name <diagnostic settings name> <[--event-hub <event hub ID> --event-hub-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs <resource specific JSON encoded log settings> --metrics <metric settings (shorthand|json-file|yaml-file)> Remediate from PowerShell To configure Diagnostic Settings on a subscription: $logCategories = @(); $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ServiceHealth -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Recommendation -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Autoscale -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category ResourceHealth -Enabled $true New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories To configure Diagnostic Settings on a specific resource: ``` $logCategories = @() $logCategories += New-AzDiagnosticSettingLogSettingsObject -Category <resource specific log category> -Enabled $true Repeat command and variable assignment for each Log category specific to the resource where this Diagnostic Setting will get configured. $metricCategories = @() $metricCategories += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true [-Category <resource specific metric category | AllMetrics>] [-RetentionPolicyDay <Integer>] [-RetentionPolicyEnabled $true] Repeat command and variable assignment for each Metric category or use the 'AllMetrics' category. New-AzDiagnosticSetting -ResourceId <resource ID> -Name <Diagnostic settings name> -Log $logCategories -Metric $metricCategories [-EventHubAuthorizationRuleId <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkspaceId <log analytics workspace ID>] [-MarketplacePartnerId <full ARM marketplace resource ID>]>

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure Diagnostic Setting Captures Appropriate Categories

When the diagnostic setting is created using Azure Portal, by default no categories are selected.

Audit from Azure Portal 1. Go to Monitor. 1. Click Activity log. 1. Click on Export Activity Logs. 1. Select the appropriate Subscription. 1. Click Edit setting next to a diagnostic setting. 1. Ensure that the following categories are checked: Administrative, Alert, Policy, and Security. Audit from Azure CLI Ensure the categories 'Administrative', 'Alert', 'Policy', and 'Security' set to: 'enabled: true' az monitor diagnostic-settings subscription list --subscription <subscription ID> Audit from PowerShell Ensure the categories Administrative, Alert, Policy, and Security are set to Enabled:True Get-AzSubscriptionDiagnosticSetting -Subscription <subscriptionID> Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 3b980d31-7904-4bb7-8575-5665739a8052 - Name: 'An activity log alert should exist for specific Security operations' - Policy ID: b954148f-4c11-4c38-8221-be76711e194a - Name: 'An activity log alert should exist for specific Administrative operations' - Policy ID: c5447c04-a4d7-4ba8-a263-c9ee321a6858 - Name: 'An activity log alert should exist for specific Policy operations'

Enabling additional categories may increase storage costs.

Automated

A diagnostic setting controls how the diagnostic log is exported. Capturing the diagnostic setting categories for appropriate control/management plane activities allows proper alerting.

Remediate from Azure Portal 1. Go to Monitor. 1. Click Activity log. 1. Click on Export Activity Logs. 1. Select the Subscription from the drop down menu. 1. Click Edit setting next to a diagnostic setting. 1. Check the following categories: Administrative, Alert, Policy, and Security. 1. Choose the destination details according to your organization's needs. 1. Click Save. Remediate from Azure CLI az monitor diagnostic-settings subscription create --subscription <subscription id> --name <diagnostic settings name> --location <location> <[--event-hub <event hub ID> --event-hub-auth-rule <event hub auth rule ID>] [--storage-account <storage account ID>] [--workspace <log analytics workspace ID>] --logs [{category:Security,enabled:true},{category:Administrative,enabled:true},{category:Alert,enabled:true},{category:Policy,enabled:true}] Remediate from PowerShell $logCategories = @(); $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Administrative -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Security -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Alert -Enabled $true $logCategories += New-AzDiagnosticSettingSubscriptionLogSettingsObject -Category Policy -Enabled $true New-AzSubscriptionDiagnosticSetting -SubscriptionId <subscription ID> -Name <Diagnostic settings name> <[-EventHubAuthorizationRule <event hub auth rule ID> -EventHubName <event hub name>] [-StorageAccountId <storage account ID>] [-WorkSpaceId <log analytics workspace ID>] [-MarketplacePartner ID <full ARM Marketplace resource ID>]> -Log $logCategories

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure the Storage Account Containing the Container with Activity Logs is Encrypted with Customer-managed Key (CMK)

By default, for a storage account keySource is set to Microsoft.Storage allowing encryption with vendor Managed key and not a Customer Managed Key.

Audit from Azure Portal 1. Go to Monitor. 1. Select Activity log. 1. Select Export Activity Logs. 1. Select a Subscription. 1. Note the name of the Storage Account for the diagnostic setting. 1. Navigate to Storage accounts. 1. Click on the storage account name noted in Step 5. 1. Under Security + networking, click Encryption. 1. Ensure Customer-managed keys is selected and a key is set. Audit from Azure CLI 1. Get storage account id configured with log profile: az monitor diagnostic-settings subscription list --subscription <subscription id> --query 'value[*].storageAccountId' 2. Ensure the storage account is encrypted with CMK: az storage account list --query [?name=='<Storage Account Name>'] In command output ensure keySource is set to Microsoft.Keyvault and keyVaultProperties is not set to null Audit from PowerShell Get-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name>|select-object -ExpandProperty encryption|format-list Ensure the value of KeyVaultProperties is not null or empty, and ensure KeySource is not set to Microsoft.Storage. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: fbb99e8e-e444-4da0-9ff1-75c92f5a85b2 - Name: 'Storage account containing the container with activity logs must be encrypted with BYOK'

NOTE: You must have your key vault setup to utilize this. All Audit Logs will be encrypted with a key you provide. You will need to set up customer managed keys separately, and you will select which key to use via the instructions here. You will be responsible for the lifecycle of the keys, and will need to manually replace them at your own determined intervals to keep the data secure.

Manual

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.

Remediate from Azure Portal 1. Go to Monitor. 1. Select Activity log. 1. Select Export Activity Logs. 1. Select a Subscription. 1. Note the name of the Storage Account for the diagnostic setting. 1. Navigate to Storage accounts. 1. Click on the storage account. 1. Under Security + networking, click Encryption. 1. Next to Encryption type, select Customer-managed keys. 1. Complete the steps to configure a customer-managed key for encryption of the storage account. Remediate from Azure CLI az storage account update --name <name of the storage account> --resource-group <resource group for a storage account> --encryption-key-source=Microsoft.Keyvault --encryption-key-vault <Key Vault URI> --encryption-key-name <KeyName> --encryption-key-version <Key Version> Remediate from PowerShell Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name> -KeyvaultEncryption -KeyVaultUri <key vault URI> -KeyName <key name>

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Logging for Azure Key Vault is 'Enabled'

By default, Diagnostic AuditEvent logging is not enabled for Key Vault instances.

Audit from Azure Portal 1. Go to Key vaults. 1. For each Key vault, under Monitoring, go to Diagnostic settings. 1. Click Edit setting next to a diagnostic setting. 1. Ensure that a destination is configured. 1. Under Category groups, ensure that audit and allLogs are checked. Audit from Azure CLI List all key vaults az keyvault list For each keyvault id az monitor diagnostic-settings list --resource <id> Ensure that storageAccountId reflects your desired destination and that categoryGroup and enabled are set as follows in the sample outputs below. logs: [ { categoryGroup: audit, enabled: true, }, { categoryGroup: allLogs, enabled: true, } Audit from PowerShell List the key vault(s) in the subscription Get-AzKeyVault For each key vault, run the following: Get-AzDiagnosticSetting -ResourceId <key_vault_id> Ensure that StorageAccountId, ServiceBusRuleId, MarketplacePartnerId, or WorkspaceId is set as appropriate. Also, ensure that enabled is set to true, and that categoryGroup reflects both audit and allLogs category groups. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: cf820ca0-f99e-4f3e-84fb-66e913812d21 - Name: 'Resource logs in Key Vault should be enabled'

Enabling logging incurs costs based on the volume of logs generated.

Automated

Monitoring how and when key vaults are accessed, and by whom, enables an audit trail of interactions with confidential information, keys, and certificates managed by Azure Key Vault. Enabling logging for Key Vault saves information in a user provided destination of either an Azure storage account or Log Analytics workspace. The same destination can be used for collecting logs for multiple Key Vaults.

Remediate from Azure Portal 1. Go to Key vaults. 2. Select a Key vault. 3. Under Monitoring, select Diagnostic settings. 4. Click Edit setting to update an existing diagnostic setting, or Add diagnostic setting to create a new one. 5. If creating a new diagnostic setting, provide a name. 6. Configure an appropriate destination. 7. Under Category groups, check audit and allLogs. 8. Click Save. Remediate from Azure CLI To update an existing Diagnostic Settings az monitor diagnostic-settings update --name <diagnostic_setting_name> --resource <key_vault_id> To create a new Diagnostic Settings az monitor diagnostic-settings create --name <diagnostic_setting_name> --resource <key_vault_id> --logs [{category:audit,enabled:true},{category:allLogs,enabled:true}] --metrics [{category:AllMetrics,enabled:true}] <[--event-hub <event_hub_ID> --event-hub-rule <event_hub_auth_rule_ID> | --storage-account <storage_account_ID> |--workspace <log_analytics_workspace_ID> | --marketplace-partner-id <solution_resource_ID>]> Remediate from PowerShell Create the Log settings object $logSettings = @() $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category audit $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category allLogs Create the Metric settings object $metricSettings = @() $metricSettings += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -Category AllMetrics Create the Diagnostic Settings for each Key Vault New-AzDiagnosticSetting -Name <diagnostic_setting_name> -ResourceId <key_vault_id> -Log $logSettings -Metric $metricSettings [-StorageAccountId <storage_account_ID> | -EventHubName <event_hub_name> -EventHubAuthorizationRuleId <event_hub_auth_rule_ID> | -WorkSpaceId <log analytics workspace ID> | -MarketPlacePartnerId <full resource ID for third-party solution>]

DEPRECATION WARNING Retention rules for Key Vault logging is being migrated to Azure Storage Lifecycle Management. Retention rules should be set based on the needs of your organization and security or compliance frameworks. Please visit https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/migrate-to-azure-storage-lifecycle-policy?tabs=portal for detail on migrating your retention rules. Microsoft has provided the following deprecation timeline: March 31, 2023 – The Diagnostic Settings Storage Retention feature will no longer be available to configure new retention rules for log data. This includes using the portal, CLI PowerShell, and ARM and Bicep templates. If you have configured retention settings, you'll still be able to see and change them in the portal. March 31, 2024 – You will no longer be able to use the API (CLI, Powershell, or templates), or Azure portal to configure retention setting unless you're changing them to 0. Existing retention rules will still be respected. September 30, 2025 – All retention functionality for the Diagnostic Settings Storage Retention feature will be disabled across all environments.

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Network Security Group Flow Logs are Captured and Sent to Log Analytics

By default Network Security Group logs are not sent to Log Analytics.

Audit from Azure Portal 1. Navigate to Network Watcher. 1. Under Logs, select Flow logs. 1. Click Add filter. 1. From the Filter drop-down, select Flow log type. 1. Review existing Network security group flow logs, if any remain, to ensure they are enabled and configured to send logs to a Log Analytics Workspace. 1. Review Virtual network flow logs for new or migrated coverage. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 27960feb-a23c-4577-8d36-ef8b5f35e0be - Name: 'All flow log resources should be in enabled state' - Policy ID: c251913d-7d24-4958-af87-478ed3b9ba41 - Name: 'Flow logs should be configured for every network security group' - Policy ID: 4c3c6c5f-0d47-4402-99b8-aa543dd8bcee - Name: 'Flow logs should be configured for every virtual network'

The impact of configuring NSG Flow logs is primarily one of cost and configuration. If deployed, it will create storage accounts that hold minimal amounts of data on a 5-day lifecycle before feeding to Log Analytics Workspace. This will increase the amount of data stored and used by Azure Monitor.

Manual

Network Flow Logs provide valuable insight into the flow of traffic around your network and feed into both Azure Monitor and Azure Sentinel (if in use), permitting the generation of visual flow diagrams to aid with analyzing for lateral movement, etc.

Remediate from Azure Portal Existing NSG flow logs can still be reviewed under Network Watcher > Flow logs. If you already have NSG flow logs configured, ensure they remain enabled and that Traffic Analytics sends data to a Log Analytics Workspace until migration is complete. Azure no longer allows creation of new NSG flow logs after June 30, 2025. For new or migrated deployments, create Virtual network flow logs instead: 1. Navigate to Network Watcher. 1. Under Logs, select Flow logs. 1. Select + Create. 1. Select the desired Subscription. 1. For Flow log type, select Virtual network. 1. Select + Select target resource. 1. Select Virtual network. 1. Select a virtual network. 1. Click Confirm selection. 1. Select or create a new Storage Account. 1. If using a v2 storage account, input the retention in days to retain the log. 1. Click Next. 1. Under Analytics, for Flow log version, select Version 2. 1. Check the box next to Enable traffic analytics. 1. Select a processing interval. 1. Select a Log Analytics Workspace. 1. Select Next. 1. Optionally add Tags. 1. Select Review + create. 1. Select Create.

On September 30, 2027, NSG flow logs will be retired, and creating new NSG flow logs has not been possible since June 30, 2025. Azure recommends migrating to virtual network flow logs, which address NSG flow log limitations. After retirement, traffic analytics using NSG flow logs will no longer be supported, and existing NSG flow log resources will be deleted. Previously collected NSG flow log records will remain available per their retention policies. For details, see the official announcement: https://azure.microsoft.com/en-gb/updates?id=Azure-NSG-flow-logs-Retirement.

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Virtual Network Flow Logs are Captured and Sent to Log Analytics

Audit from Azure Portal 1. Go to Network Watcher. 1. Under Logs, select Flow logs. 1. Click Add filter. 1. From the Filter drop-down menu, select Flow log type. 1. From the Value drop-down menu, check Virtual network only. 1. Click Apply. 1. Ensure that at least one virtual network flow log is listed and is configured to send logs to a Log Analytics Workspace. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 2f080164-9f4d-497e-9db6-416dc9f7b48a - Name: 'Network Watcher flow logs should have traffic analytics enabled' - Policy ID: 4c3c6c5f-0d47-4402-99b8-aa543dd8bcee - Name: 'Audit flow logs configuration for every virtual network'

• Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription. * If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates. * The storage of logs is charged separately.

Manual

Virtual network flow logs provide critical visibility into traffic patterns. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.

Remediate from Azure Portal 1. Go to Network Watcher. 1. Under Logs, click Flow logs. 1. Click + Create. 1. Select a subscription. 1. Next to Flow log type, select Virtual network. 1. Click + Select target resource. 1. Select Virtual network. 1. Select a virtual network. 1. Click Confirm selection. 1. Select a storage account, or create a new storage account. 1. Set the retention in days for the storage account. 1. Click Next. 1. Under Analytics, for Flow logs version, select Version 2. 1. Check the box next to Enable traffic analytics. 1. Select a processing interval. 1. Select a Log Analytics Workspace. 1. Click Next. 1. Optionally, add Tags. 1. Click Review + create. 1. Click Create. 1. Repeat steps 1-20 for each subscription or virtual network requiring remediation.

On September 30, 2027, NSG flow logs will be retired, and creating new NSG flow logs will no longer be possible after June 30, 2025. Azure recommends migrating to virtual network flow logs, which address NSG flow log limitations. After retirement, traffic analytics using NSG flow logs will no longer be supported, and existing NSG flow log resources will be deleted. Previously collected NSG flow log records will remain available per their retention policies. For details, see the official announcement: https://azure.microsoft.com/en-gb/updates?id=Azure-NSG-flow-logs-Retirement.

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Graph Activity Logs to an Appropriate Destination

By default, Microsoft Entra diagnostic settings do not exist.

Audit from Azure Portal 1. Go to Microsoft Entra ID. 1. Under Monitoring, click Diagnostic settings. 1. Next to each diagnostic setting, click Edit setting, and review the selected log categories and destination details. 1. Ensure that at least one diagnostic setting is configured to send MicrosoftGraphActivityLogs to an appropriate destination.

A Microsoft Entra ID P1 or P2 tenant license is required to access the Microsoft Graph activity logs. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size and the applications in your tenant that interact with the Microsoft Graph APIs. See the following pricing calculations for respective services: - Log Analytics: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs#pricing-model. - Azure Storage: https://azure.microsoft.com/en-gb/pricing/details/storage/blobs/. - Event Hubs: https://azure.microsoft.com/en-gb/pricing/details/event-hubs/

Manual

Microsoft Graph activity logs provide visibility into HTTP requests made to the Microsoft Graph service, helping detect unauthorized access, suspicious activity, and security threats. Configuring diagnostic settings in Microsoft Entra ensures these logs are collected and sent to an appropriate destination for monitoring, analysis, and retention.

Remediate from Azure Portal 1. Go to Microsoft Entra ID. 1. Under Monitoring, click Diagnostic settings. 1. Click + Add diagnostic setting. 1. Provide a Diagnostic setting name. 1. Under Logs > Categories, check the box next to MicrosoftGraphActivityLogs. 1. Configure an appropriate destination for the logs. 1. Click Save.

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Entra Activity Logs to an Appropriate Destination

By default, Microsoft Entra diagnostic settings do not exist.

Audit from Azure Portal 1. Go to Microsoft Entra ID. 1. Under Monitoring, click Diagnostic settings. 1. Next to each diagnostic setting, click Edit setting, and review the selected log categories and destination details. 1. Ensure that at least one diagnostic setting is configured to send the following logs to an appropriate destination: - AuditLogs - SignInLogs - NonInteractiveUserSignInLogs - ServicePrincipalSignInLogs - ManagedIdentitySignInLogs - ProvisioningLogs - ADFSSignInLogs - RiskyUsers - UserRiskEvents - NetworkAccessTrafficLogs - RiskyServicePrincipals - ServicePrincipalRiskEvents - EnrichedOffice365AuditLogs - MicrosoftGraphActivityLogs - RemoteNetworkHealthLogs - NetworkAccessAlerts

To export sign-in data, your organization needs an Azure AD P1 or P2 license. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size. See the following pricing calculations for respective services: - Log Analytics: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs#pricing-model. - Azure Storage: https://azure.microsoft.com/en-gb/pricing/details/storage/blobs/. - Event Hubs: https://azure.microsoft.com/en-gb/pricing/details/event-hubs/

Manual

Microsoft Entra activity logs enables you to assess many aspects of your Microsoft Entra tenant. Configuring diagnostic settings in Microsoft Entra ensures these logs are collected and sent to an appropriate destination for monitoring, analysis, and retention.

Remediate from Azure Portal 1. Go to Microsoft Entra ID. 1. Under Monitoring, click Diagnostic settings. 1. Click + Add diagnostic setting. 1. Provide a Diagnostic setting name. 1. Under Logs > Categories, check the box next to each of the following logs: - AuditLogs - SignInLogs - NonInteractiveUserSignInLogs - ServicePrincipalSignInLogs - ManagedIdentitySignInLogs - ProvisioningLogs - ADFSSignInLogs - RiskyUsers - UserRiskEvents - NetworkAccessTrafficLogs - RiskyServicePrincipals - ServicePrincipalRiskEvents - EnrichedOffice365AuditLogs - MicrosoftGraphActivityLogs - RemoteNetworkHealthLogs - NetworkAccessAlerts 1. Configure an appropriate destination for the logs. 1. Click Save.

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Intune Logs are Captured and Sent to Log Analytics

By default, Intune diagnostic settings do not exist.

Audit from Azure Portal 1. Go to Intune. 1. Click Reports. 1. Under Azure monitor, click Diagnostic settings. 1. Next to each diagnostic setting, click Edit setting, and review the selected log categories and destination details. 1. Ensure that at least one diagnostic setting is configured to send the following logs to a Log Analytics workspace: - AuditLogs - OperationalLogs - DeviceComplianceOrg - Devices - Windows365AuditLogs

A Microsoft Intune plan is required to access Intune: https://www.microsoft.com/en-gb/security/business/microsoft-intune-pricing. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size. For information on Log Analytics workspace costs, visit: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs.

Manual

Intune includes built-in logs that provide information about your environments. Sending logs to a Log Analytics workspace enables centralized analysis, correlation, and alerting for faster threat detection and response.

Remediate from Azure Portal 1. Go to Intune. 1. Click Reports. 1. Under Azure monitor, click Diagnostic settings. 1. Click + Add diagnostic setting. 1. Provide a Diagnostic setting name. 1. Under Logs > Categories, check the box next to each of the following logs: - AuditLogs - OperationalLogs - DeviceComplianceOrg - Devices - Windows365AuditLogs 1. Under Destination details, check the box next to Send to Log Analytics workspace. 1. Select a Subscription. 1. Select a Log Analytics workspace. 1. Click Save.

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Create Policy Assignment

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Authorization/policyAssignments/write. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Create policy assignment' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Authorization/policyAssignments/write in the output. If it's missing, generate a finding. Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Authorization/policyAssignments/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf If the output is empty, an alert rule for Create Policy Assignments is not configured. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: c5447c04-a4d7-4ba8-a263-c9ee321a6858 - Name: 'An activity log alert should exist for specific Policy operations'

Alert rules incur minimal costs.

Automated

Monitoring for create policy assignment events gives insight into changes done in Azure policy - assignments and can reduce the time it takes to detect unsolicited changes.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Create policy assignment (Policy assignment). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription ID> --action-group <action group ID> Remediate from PowerShell Create the conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Authorization/policyAssignments/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Get the Action Group information and store it in a variable, then create a new Action object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope variable. $scope = /subscriptions/<subscription ID> Create the Activity Log Alert Rule for Microsoft.Authorization/policyAssignments/write New-AzActivityLogAlert -Name <activity alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert exists for Delete Policy Assignment

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Authorization/policyAssignments/delete. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete policy assignment' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Authorization/policyAssignments/delete in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Authorization/policyAssignments/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: c5447c04-a4d7-4ba8-a263-c9ee321a6858 - Name: 'An activity log alert should exist for specific Policy operations'

Alert rules incur minimal costs.

Automated

Monitoring for delete policy assignment events gives insight into changes done in azure policy - assignments and can reduce the time it takes to detect unsolicited changes.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Delete policy assignment (Policy assignment). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the conditions object $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Authorization/policyAssignments/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Action object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope variable. $scope = /subscriptions/<subscription id> Create the Activity Log Alert Rule for Microsoft.Authorization/policyAssignments/delete. New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

This log alert also applies for Azure Blueprints.

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Create or Update Network Security Group

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Network/networkSecurityGroups/write. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Create or Update Network Security Group' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Network/networkSecurityGroups/write in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/networkSecurityGroups/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: b954148f-4c11-4c38-8221-be76711e194a - Name: 'An activity log alert should exist for specific Administrative operations'

Alert rules incur minimal costs.

Automated

Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Create or Update Network Security Group (Network Security Group). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/write and level=verbose --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/networkSecurityGroups/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription id> Create the Activity Log Alert Rule for Microsoft.Network/networkSecurityGroups/write New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Delete Network Security Group

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Network/networkSecurityGroups/delete. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete Network Security Group' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription ID> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Network/networkSecurityGroups/delete in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/networkSecurityGroups/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: b954148f-4c11-4c38-8221-be76711e194a - Name: 'An activity log alert should exist for specific Administrative operations'

Alert rules incur minimal costs.

Automated

Monitoring for Delete Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Delete Network Security Group (Network Security Group). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/networkSecurityGroups/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription id> Create the Activity Log Alert Rule for Microsoft.Network/networkSecurityGroups/delete New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Create or Update Security Solution

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Security/securitySolutions/write. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Create or Update Security Solutions' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Security/securitySolutions/write in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Security/securitySolutions/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: b954148f-4c11-4c38-8221-be76711e194a - Name: 'An activity log alert should exist for specific Administrative operations'

Alert rules incur minimal costs.

Automated

Monitoring for Create or Update Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Create or Update Security Solutions (Security Solutions). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Security/securitySolutions/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription ID> Create the Activity Log Alert Rule for Microsoft.Security/securitySolutions/write New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Delete Security Solution

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Security/securitySolutions/delete. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete Security Solutions' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Security/securitySolutions/delete in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Security/securitySolutions/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: b954148f-4c11-4c38-8221-be76711e194a - Name: 'An activity log alert should exist for specific Administrative operations'

Alert rules incur minimal costs.

Automated

Monitoring for Delete Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Delete Security Solutions (Security Solutions). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Security/securitySolutions/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription ID> Create the Activity Log Alert Rule for Microsoft.Security/securitySolutions/delete New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Create or Update SQL Server Firewall Rule

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Sql/servers/firewallRules/write. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Create/Update server firewall rule' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Sql/servers/firewallRules/write in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Sql/servers/firewallRules/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: b954148f-4c11-4c38-8221-be76711e194a - Name: 'An activity log alert should exist for specific Administrative operations'

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Automated

Monitoring for Create or Update SQL Server Firewall Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Create/Update server firewall rule (Server Firewall Rule). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Sql/servers/firewallRules/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription ID> Create the Activity Log Alert Rule for Microsoft.Sql/servers/firewallRules/write New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Delete SQL Server Firewall Rule

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Sql/servers/firewallRules/delete. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete server firewall rule' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Sql/servers/firewallRules/delete in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Sql/servers/firewallRules/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: b954148f-4c11-4c38-8221-be76711e194a - Name: 'An activity log alert should exist for specific Administrative operations'

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Automated

Monitoring for Delete SQL Server Firewall Rule events gives insight into SQL network access changes and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Delete server firewall rule (Server Firewall Rule). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Sql/servers/firewallRules/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription ID> Create the Activity Log Alert Rule for Microsoft.Sql/servers/firewallRules/delete New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Create or Update Public IP Address rule

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Network/publicIPAddresses/write. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Create or Update Public Ip Address' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Network/publicIPAddresses/write in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/publicIPAddresses/write}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 1513498c-3091-461a-b321-e9b433218d28 - Name: 'Enable logging by category group for Public IP addresses (microsoft.network/publicipaddresses) to Log Analytics'

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Automated

Monitoring for Create or Update Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Create or Update Public Ip Address (Public Ip Address). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/publicIPAddresses/write -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription ID> Create the Activity Log Alert Rule for Microsoft.Network/publicIPAddresses/write New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Activity Log Alert Exists for Delete Public IP Address rule

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Navigate to the Monitor blade. 1. Click on Alerts. 1. In the Alerts window, click on Alert rules. 1. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Network/publicIPAddresses/delete. 1. Click on the Alert Name associated with the previous step. 1. Ensure the Condition panel displays the text Whenever the Activity Log has an event with Category='Administrative', Operation name='Delete Public Ip Address' and does not filter on Level, Status or Caller. 1. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization. Audit from Azure CLI az monitor activity-log alert list --subscription <subscription Id> --query [].{Name:name,Enabled:enabled,Condition:condition.allOf,Actions:actions} Look for Microsoft.Network/publicIPAddresses/delete in the output Audit from PowerShell Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match Microsoft.Network/publicIPAddresses/delete}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 1513498c-3091-461a-b321-e9b433218d28 - Name: 'Enable logging by category group for Public IP addresses (microsoft.network/publicipaddresses) to Log Analytics'

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Automated

Monitoring for Delete Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Remediate from Azure Portal 1. Navigate to the Monitor blade. 1. Select Alerts. 1. Select Create. 1. Select Alert rule. 1. Choose a subscription. 1. Select Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Delete Public Ip Address (Public Ip Address). 1. Click Apply. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. Remediate from Azure CLI az monitor activity-log alert create --resource-group <resource group name> --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/delete and level=<verbose | information | warning | error | critical> --scope /subscriptions/<subscription ID> --name <activity log rule name> --subscription <subscription id> --action-group <action group ID> Remediate from PowerShell Create the Conditions object. $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/publicIPAddresses/delete -Field operationName $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level Retrieve the Action Group information and store in a variable, then create the Actions object. $actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name> $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object $scope = /subscriptions/<subscription ID> Create the Activity Log Alert Rule for Microsoft.Network/publicIPAddresses/delete New-AzActivityLogAlert -Name <activity log alert rule name> -ResourceGroupName <resource group name> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that an Activity Log Alert Exists for Service Health

By default, no monitoring alerts are created.

Audit from Azure Portal 1. Go to Monitor. 1. Click Alerts. 1. Click Alert rules. 1. Ensure an alert rule exists for a subscription with Condition set to Service names=All, Event types=All and Target resource type set to Subscription. 1. If an alert rule is found for step 4, click the name of the alert rule. 1. Ensure the Actions panel displays an action group configured to notify appropriate personnel. 1. Repeat steps 1-6 for each subscription. Audit from Azure CLI Run the following command to list activity log alerts: az monitor activity-log alert list --subscription <subscription-id> For each activity log alert, run the following command: az monitor activity-log alert show --subscription <subscription-id> --resource-group <resource-group> --activity-log-alert-name <activity-log-alert> Ensure an alert exists for ServiceHealth with scopes set to a subscription ID. Repeat for each subscription. Audit from PowerShell Run the following command to locate ServiceHealth alert rules for a subscription: Get-AzActivityLogAlert -SubscriptionId <subscription-id> | where-object {$_.ConditionAllOf.Equal -match ServiceHealth} | select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf Ensure that at least one ServiceHealth alert rule is returned. Repeat for each subscription.

There is no charge for creating activity log alert rules.

Automated

Monitoring for Service Health events provides insight into service issues, planned maintenance, security advisories, and other changes that may affect the Azure services and regions in use.

Remediate from Azure Portal 1. Go to Monitor. 1. Click Alerts. 1. Click + Create. 1. Select Alert rule from the drop-down menu. 1. Choose a subscription. 1. Click Apply. 1. Select the Condition tab. 1. Click See all signals. 1. Select Service health. 1. Click Apply. 1. Open the drop-down menu next to Event types. 1. Check the box next to Select all. 1. Select the Actions tab. 1. Click Select action groups to select an existing action group, or Create action group to create a new action group. 1. Follow the prompts to choose or create an action group. 1. Select the Details tab. 1. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 1. Click Review + create. 1. Click Create. 1. Repeat steps 1-19 for each subscription requiring remediation. Remediate from Azure CLI For each subscription requiring remediation, run the following command to create a ServiceHealth alert rule for a subscription: az monitor activity-log alert create --subscription <subscription-id> --resource-group <resource-group> --name <alert-rule> --condition category=ServiceHealth and properties.incidentType=Incident --scope /subscriptions/<subscription-id> --action-group <action-group> Remediate from PowerShell Create the Conditions object: $conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Field category -Equal ServiceHealth $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Field properties.incidentType -Equal Incident Retrieve the Action Group information and store in a variable: $actionGroup = Get-AzActionGroup -ResourceGroupName <resource-group> -Name <action-group> Create the Actions object: $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id Create the Scope object: $scope = /subscriptions/<subscription-id> Create the activity log alert rule: New-AzActivityLogAlert -Name <alert-rule> -ResourceGroupName <resource-group> -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription-id> -Enabled $true Repeat for each subscription requiring remediation.

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure Application Insights are Configured

Application Insights are not enabled by default.

Audit from Azure Portal 1. Navigate to Application Insights. 2. Ensure an Application Insights service is configured and exists. Audit from Azure CLI az monitor app-insights component show --query [].{ID:appId, Name:name, Tenant:tenantId, Location:location, Provisioning_State:provisioningState} Ensure the above command produces output, otherwise Application Insights has not been configured. Audit from PowerShell Get-AzApplicationInsights|select location,name,appid,provisioningState,tenantid

Because Application Insights relies on a Log Analytics Workspace, an organization will incur additional expenses when using this service.

Automated

Configuring Application Insights provides additional data not found elsewhere within Azure as part of a much larger logging and monitoring program within an organization's Information Security practice. The types and contents of these logs will act as both a potential cost saving measure (application performance) and a means to potentially confirm the source of a potential incident (trace logging). Metrics and Telemetry data provide organizations with a proactive approach to cost savings by monitoring an application's performance, while the trace logging data provides necessary details in a reactive incident response scenario by helping organizations identify the potential source of an incident within their application.

Remediate from Azure Portal 1. Navigate to Application Insights. 2. Under the Basics tab within the PROJECT DETAILS section, select the Subscription. 3. Select the Resource group. 4. Within the INSTANCE DETAILS, enter a Name. 5. Select a Region. 6. Next to Resource Mode, select Workspace-based. 7. Within the WORKSPACE DETAILS, select the Subscription for the log analytics workspace. 8. Select the appropriate Log Analytics Workspace. 9. Click Next:Tags >. 10. Enter the appropriate Tags as Name, Value pairs. 11. Click Next:Review+Create. 12. Click Create. Remediate from Azure CLI az monitor app-insights component create --app <app name> --resource-group <resource group name> --location <location> --kind web --retention-time <INT days to retain logs> --workspace <log analytics workspace ID> --subscription <subscription ID> Remediate from PowerShell New-AzApplicationInsights -Kind web -ResourceGroupName <resource group name> -Name <app insights name> -location <location> -RetentionInDays <INT days to retain logs> -SubscriptionID <subscription ID> -WorkspaceResourceId <log analytics workspace ID>

Level 1

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it

By default, Azure Monitor Resource Logs are 'Disabled' for all resources.

Audit from Azure Portal The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are: 1. Go to the resource 2. Click on Diagnostic settings 3. In the blade that appears, click Add diagnostic setting 4. Configure the diagnostic settings 5. Click on Save Audit from Azure CLI List all resources for a subscription az resource list --subscription <subscription id> For each resource run the following az monitor diagnostic-settings list --resource <resource ID> An empty result means a diagnostic settings is not configured for that resource. An error message means a diagnostic settings is not supported for that resource. Audit from PowerShell Get a list of resources in a subscription context and store in a variable $resources = Get-AzResource Loop through each resource to determine if a diagnostic setting is configured or not. foreach ($resource in $resources) {$diagnosticSetting = Get-AzDiagnosticSetting -ResourceId $resource.id -ErrorAction SilentlyContinue; if ([string]::IsNullOrEmpty($diagnosticSetting)) {$message = Diagnostic Settings not configured for resource: + $resource.Name;Write-Output $message}else{$diagnosticSetting}} A result of Diagnostic Settings not configured for resource: <resource name> means a diagnostic settings is not configured for that resource. Otherwise, the output of the above command will show configured Diagnostic Settings for a resource. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: cf820ca0-f99e-4f3e-84fb-66e913812d21 - Name: 'Resource logs in Key Vault should be enabled' - Policy ID: 91a78b24-f231-4a8a-8da9-02c35b2b6510 - Name: 'App Service apps should have resource logs enabled' - Policy ID: 428256e6-1fac-4f48-a757-df34c2b3336d - Name: 'Resource logs in Batch accounts should be enabled' - Policy ID: 057ef27e-665e-4328-8ea3-04b3122bd9fb - Name: 'Resource logs in Azure Data Lake Store should be enabled' - Policy ID: c95c74d9-38fe-4f0d-af86-0c7d626a315c - Name: 'Resource logs in Data Lake Analytics should be enabled' - Policy ID: 83a214f7-d01a-484b-91a9-ed54470c9a6a - Name: 'Resource logs in Event Hub should be enabled' - Policy ID: 383856f8-de7f-44a2-81fc-e5135b5c2aa4 - Name: 'Resource logs in IoT Hub should be enabled' - Policy ID: 34f95f76-5386-4de7-b824-0d8478470c9d - Name: 'Resource logs in Logic Apps should be enabled' - Policy ID: b4330a05-a843-4bc8-bf9a-cacce50c67f4 - Name: 'Resource logs in Search services should be enabled' - Policy ID: f8d36e2f-389b-4ee4-898d-21aeb69a0f45 - Name: 'Resource logs in Service Bus should be enabled' - Policy ID: f9be5368-9bf5-4b84-9e0a-7850da98bb46 - Name: 'Resource logs in Azure Stream Analytics should be enabled'

Costs for monitoring varies with Log Volume. Not every resource needs to have logging enabled. It is important to determine the security classification of the data being processed by the given resource and adjust the logging based on which events need to be tracked. This is typically determined by governance and compliance requirements.

Manual

A lack of monitoring reduces the visibility into the data plane, and therefore an organization's ability to detect reconnaissance, authorization attempts or other malicious activity. Unlike Activity Logs, Resource Logs are not enabled by default. Specifically, without monitoring it would be impossible to tell which entities had accessed a data store that was breached. In addition, alerts for failed attempts to access APIs for Web Services or Databases are only possible when logging is enabled.

Azure Subscriptions should log every access and operation for all resources. Logs should be sent to Storage and a Log Analytics Workspace or equivalent third-party system. Logs should be kept in readily-accessible storage for a minimum of one year, and then moved to inexpensive cold storage for a duration of time as necessary. If retention policies are set but storing logs in a Storage Account is disabled (for example, if only Event Hubs or Log Analytics options are selected), the retention policies have no effect. Enable all monitoring at first, and then be more aggressive moving data to cold storage if the volume of data becomes a cost concern. Remediate from Azure Portal The specific steps for configuring resources within the Azure console vary depending on resource, but typically the steps are: 1. Go to the resource 2. Click on Diagnostic settings 3. In the blade that appears, click Add diagnostic setting 4. Configure the diagnostic settings 5. Click on Save Remediate from Azure CLI For each resource, run the following making sure to use a resource appropriate JSON encoded category for the --logs option. az monitor diagnostic-settings create --name <diagnostic settings name> --resource <resource ID> --logs [{category:<resource specific category>,enabled:true,rentention-policy:{enabled:true,days:180}}] --metrics [{category:AllMetrics,enabled:true,retention-policy:{enabled:true,days:180}}] <[--event-hub <event hub ID> --event-hub-rule <event hub auth rule ID> | --storage-account <storage account ID> |--workspace <log analytics workspace ID> | --marketplace-partner-id <full resource ID of third-party solution>]> Remediate from PowerShell Create the log settings object $logSettings = @() $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -RetentionPolicyDay 180 -RetentionPolicyEnabled $true -Category <resource specific category> $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -RetentionPolicyDay 180 -RetentionPolicyEnabled $true -Category <resource specific category number 2> Create the metric settings object $metricSettings = @() $metricSettings += New-AzDiagnosticSettingMetricSettingsObject -Enabled $true -RetentionPolicyDay 180 -RetentionPolicyEnabled $true -Category AllMetrics Create the diagnostic setting for a specific resource New-AzDiagnosticSetting -Name <diagnostic settings name> -ResourceId <resource ID> -Log $logSettings -Metric $metricSettings

For an up-to-date list of Azure resources which support Azure Monitor, refer to the Supported Log Categories reference.

Level 2

6 Management and Governance Services

6.1 Logging and Monitoring

Ensure Basic, Free, and Consumption SKUs are not used on Production artifacts requiring monitoring and SLA

Policy should enforce standard SKUs for the following artifacts: - Public IP Addresses - Network Load Balancers - REDIS Cache - SQL PaaS Databases - VPN Gateways

This needs to be audited by Azure Policy (one for each resource type) and denied for each artifact that is production. Audit from Azure Portal 1. Open Azure Resource Graph Explorer 1. Click New query 1. Paste the following into the query window: Resources | where sku contains 'Basic' or sku contains 'consumption' | order by type 4. Click Run query then evaluate the results in the results window. 5. Ensure that no production artifacts are returned. Audit from Azure CLI az graph query -q Resources | where sku contains 'Basic' or sku contains 'consumption' | order by type Alternatively, to filter on a specific resource group: az graph query -q Resources | where resourceGroup == '<resourceGroupName>' | where sku contains 'Basic' or sku contains 'consumption' | order by type Ensure that no production artifacts are returned. Audit from PowerShell Get-AzResource | ?{ $_.Sku -EQ Basic} Ensure that no production artifacts are returned.

The impact of enforcing Standard SKU's is twofold 1) There will be a cost increase 2) The monitoring and service level agreements will be available and will support the production service. All resources should be either tagged or in separate Management Groups/Subscriptions

Manual

Typically, production workloads need to be monitored and should have an SLA with Microsoft, using Basic SKUs for any deployed product will mean that that these capabilities do not exist. The following resource types should use standard SKUs as a minimum. - Public IP Addresses - Network Load Balancers - REDIS Cache - SQL PaaS Databases - VPN Gateways

Each resource has its own process for upgrading from basic to standard SKUs that should be followed if required. - Public IP Address: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-upgrade. - Basic Load Balancer: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-basic-upgrade-guidance. - Azure Cache for Redis: https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-scale. - Azure SQL Database: https://learn.microsoft.com/en-us/azure/azure-sql/database/scale-resources. - VPN Gateway: https://learn.microsoft.com/en-us/azure/vpn-gateway/gateway-sku-resize.

Level 2

6 Management and Governance Services

Ensure that Resource Locks are set for Mission-Critical Azure Resources

By default, no locks are set.

Audit from Azure Portal 1. Navigate to the specific Azure Resource or Resource Group. 2. Click on Locks. 3. Ensure the lock is defined with name and description, with type Read-only or Delete as appropriate. Audit from Azure CLI Review the list of all locks set currently: az lock list --resource-group <resourcegroupname> --resource-name <resourcename> --namespace <Namespace> --resource-type <type> --parent Audit from PowerShell Run the following command to list all resources. Get-AzResource For each resource, run the following command to check for Resource Locks. Get-AzResourceLock -ResourceName <Resource Name> -ResourceType <Resource Type> -ResourceGroupName <Resource Group Name> Review the output of the Properties setting. Compliant settings will have the CanNotDelete or ReadOnly value.

There can be unintended outcomes of locking a resource. Applying a lock to a parent service will cause it to be inherited by all resources within. Conversely, applying a lock to a resource may not apply to connected storage, leaving it unlocked. Please see the documentation for further information.

Manual

As an administrator, it may be necessary to lock a subscription, resource group, or resource to prevent other users in the organization from accidentally deleting or modifying critical resources. The lock level can be set to to CanNotDelete or ReadOnly to achieve this purpose. - CanNotDelete means authorized users can still read and modify a resource, but they cannot delete the resource. - ReadOnly means authorized users can read a resource, but they cannot delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.

Remediate from Azure Portal 1. Navigate to the specific Azure Resource or Resource Group. 2. For each mission critical resource, click on Locks. 3. Click Add. 4. Give the lock a name and a description, then select the type, Read-only or Delete as appropriate. 5. Click OK. Remediate from Azure CLI To lock a resource, provide the name of the resource, its resource type, and its resource group name. az lock create --name <LockName> --lock-type <CanNotDelete/Read-only> --resource-group <resourceGroupName> --resource-name <resourceName> --resource-type <resourceType> Remediate from PowerShell Get-AzResourceLock -ResourceName <Resource Name> -ResourceType <Resource Type> -ResourceGroupName <Resource Group Name> -Locktype <CanNotDelete/Read-only>

Level 1

7 Networking Services

Ensure that RDP Access from the Internet is Evaluated and Restricted

By default, RDP access from internet is not enabled.

Audit from Azure Portal 1. Go to Network security groups. 1. Under Settings, click Inbound security rules. 1. Ensure that no inbound security rule exists that matches the following: - Port: 3389 or range including 3389 - Protocol: TCP or Any - Source: 0.0.0.0/0, Internet, or Any - Action: Allow 1. Repeat steps 1-3 for each network security group. To audit from Azure Resource Graph: 1. Go to Resource Graph Explorer. 1. Click New query. 1. Paste the following into the query window: resources | where type =~ microsoft.network/networksecuritygroups | project id, name, securityRule = properties.securityRules | mv-expand securityRule | extend access = securityRule.properties.access, direction = securityRule.properties.direction, protocol = securityRule.properties.protocol, destinationPort = case(isempty(securityRule.properties.destinationPortRange), securityRule.properties.destinationPortRanges, securityRule.properties.destinationPortRange), sourceAddress = case(isempty(securityRule.properties.sourceAddressPrefix), securityRule.properties.sourceAddressPrefixes, securityRule.properties.sourceAddressPrefix) | where access =~ Allow and direction =~ Inbound and protocol in~ (tcp, ) | mv-expand destinationPort | mv-expand sourceAddress | extend destinationPortMin = toint(split(destinationPort, -)[0]), destinationPortMax = toint(split(destinationPort, -)[-1]) | where (destinationPortMin <= 3389 and destinationPortMax >= 3389) or destinationPort == | where sourceAddress in~ (*, 0.0.0.0, internet, any) or sourceAddress endswith /0 1. Click Run query. 1. Ensure that no results are returned. Audit from Azure CLI List network security groups with non-default security rules: az network nsg list --query [*].[name,securityRules] Ensure that no network security group has an inbound security rule that matches the following: access : Allow destinationPortRange : 3389, *, or <range-including-3389> direction : Inbound protocol : TCP or * sourceAddressPrefix : 0.0.0.0/0, Internet, or * Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 22730e10-96f6-4aac-ad84-9383d35b5917 - Name: 'Management ports should be closed on your virtual machines'

Restricting RDP access may require alternative methods for remote administration such as VPN or Azure Bastion.

Automated

The potential security problem with using RDP over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use a virtual machine as a launch point for compromising other machines on an Azure Virtual Network or even attack networked devices outside of Azure.

Remediate from Azure Portal 1. Go to Network security groups. 1. Under Settings, click Inbound security rules. 1. Check the box next to any inbound security rule matching: - Port: 3389 or range including 3389 - Protocol: TCP or Any - Source: 0.0.0.0/0, Internet, or Any - Action: Allow 1. Click Delete. 1. Click Yes. Remediate from Azure CLI For each network security group rule requiring remediation, run the following command to delete a rule: az network nsg rule delete --resource-group <resource-group> --nsg-name <network-security-group> --name <rule>

Level 1

7 Networking Services

Ensure that SSH Access from the Internet is Evaluated and Restricted

By default, SSH access from internet is not enabled.

Audit from Azure Portal 1. Open the Networking blade for the specific Virtual machine in Azure portal 2. Verify that the INBOUND PORT RULES does not have a rule for SSH such as - port = 22, - protocol = TCP OR ANY, - Source = Any OR Internet Audit from Azure CLI List Network security groups with corresponding non-default Security rules: az network nsg list --query [*].[name,securityRules] Ensure that none of the NSGs have security rule as below access : Allow destinationPortRange : 22 or * or [port range containing 22] direction : Inbound protocol : TCP or * sourceAddressPrefix : * or 0.0.0.0 or <nw>/0 or /0 or internet or any Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 22730e10-96f6-4aac-ad84-9383d35b5917 - Name: 'Management ports should be closed on your virtual machines'

Restricting SSH access may require alternative methods for remote administration such as VPN or Azure Bastion.

Automated

The potential security problem with using SSH over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use a virtual machine as a launch point for compromising other machines on the Azure Virtual Network or even attack networked devices outside of Azure.

Where SSH is not explicitly required and narrowly configured for resources attached to the Network Security Group, Internet-level access to your Azure resources should be restricted or eliminated. For internal access to relevant resources, configure an encrypted network tunnel such as: ExpressRoute Site-to-site VPN Point-to-site VPN

Level 1

7 Networking Services

Ensure that UDP Port Access from the Internet is Evaluated and Restricted

By default, UDP access from internet is not enabled.

Audit from Azure Portal 1. Open the Networking blade for the specific Virtual machine in Azure portal 2. Verify that the INBOUND PORT RULES does not have a rule for UDP such as - protocol = UDP, - Source = Any OR Internet Audit from Azure CLI List Network security groups with corresponding non-default Security rules: az network nsg list --query [*].[name,securityRules] Ensure that none of the NSGs have security rule as below access : Allow destinationPortRange : * or [port range containing 53, 123, 161, 389, 1900, or other vulnerable UDP-based services] direction : Inbound protocol : UDP sourceAddressPrefix : * or 0.0.0.0 or <nw>/0 or /0 or internet or any

Restricting UDP access may impact services that legitimately require UDP traffic.

Automated

The potential security problem with broadly exposing UDP services over the Internet is that attackers can use DDoS amplification techniques to reflect spoofed UDP traffic from Azure Virtual Machines. The most common types of these attacks use exposed DNS, NTP, SSDP, SNMP, CLDAP and other UDP-based services as amplification sources for disrupting services of other machines on the Azure Virtual Network or even attack networked devices outside of Azure.

Where UDP is not explicitly required and narrowly configured for resources attached to the Network Security Group, Internet-level access to your Azure resources should be restricted or eliminated. For internal access to relevant resources, configure an encrypted network tunnel such as: ExpressRoute Site-to-site VPN Point-to-site VPN

Level 1

7 Networking Services

Express Route: https://docs.microsoft.com/en-us/azure/expressroute/:Site-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal:Point-to-Site VPN: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal:https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-1-establish-network-segmentation-boundaries

Ensure that HTTP(S) Access from the Internet is Evaluated and Restricted

Audit from Azure Portal 1. For each VM, open the Networking blade 2. Verify that the INBOUND PORT RULES does not have a rule for HTTP(S) such as - port = 80/ 443, - protocol = TCP, - Source = Any OR Internet Audit from Azure CLI List Network security groups with corresponding non-default Security rules: az network nsg list --query [*].[name,securityRules] Ensure that none of the NSGs have security rule as below access : Allow destinationPortRange : 80/443 or * or [port range containing 80/443] direction : Inbound protocol : TCP sourceAddressPrefix : * or 0.0.0.0 or <nw>/0 or /0 or internet or any

Restricting HTTP(S) access may require proper configuration of web application firewalls and load balancers.

Automated

The potential security problem with using HTTP(S) over the Internet is that attackers can use various brute force techniques to gain access to Azure resources. Once the attackers gain access, they can use the resource as a launch point for compromising other resources within the Azure tenant.

Remediate from Azure Portal 1. Go to Virtual machines. 2. For each VM, open the Networking blade. 3. Click on Inbound port rules. 4. Delete the rule with: * Port = 80/443 OR [port range containing 80/443] * Protocol = TCP OR Any * Source = Any (*) OR IP Addresses(0.0.0.0/0) OR Service Tag(Internet) * Action = Allow Remediate from Azure CLI 1. Run below command to list network security groups: az network nsg list --subscription <subscription-id> --output table 2. For each network security group, run below command to list the rules associated with the specified port: az network nsg rule list --resource-group <resource-group> --nsg-name <nsg-name> --query [?destinationPortRange=='80 or 443'] 3. Run the below command to delete the rule with: * Port = 80/443 OR [port range containing 80/443] * Protocol = TCP OR * * Source = Any (*) OR IP Addresses(0.0.0.0/0) OR Service Tag(Internet) * Action = Allow az network nsg rule delete --resource-group <resource-group> --nsg-name <nsg-name> --name <rule-name>

Level 2

7 Networking Services

Ensure that Network Security Group Flow Log Retention Days is Set to Greater than or equal to 90

When a virtual network flow log is created using the Azure CLI, retention days is set to 0 by default. When creating via the Azure Portal, retention days must be specified by the creator.

Audit from Azure Portal 1. Go to Network Watcher. 1. Under Logs, select Flow logs. 1. Click Add filter. 1. From the Filter drop-down menu, select Flow log type. 1. From the Value drop-down menu, check Virtual network only. 1. Click Apply. 1. Click the name of a virtual network flow log. 1. Under Storage Account, ensure that Retention days is set to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log. Audit from Azure CLI Run the following command to list network watchers: az network watcher list Run the following command to list the name and retention policy of flow logs in a network watcher: az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy] For each flow log, ensure that days is set to 0, 90, or a number greater than 90. If days is set to 0, the logs are retained indefinitely with no retention policy. Repeat for each network watcher.

• Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription. * If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates. * The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.

Automated

Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.

Remediate from Azure Portal 1. Go to Network Watcher. 1. Under Logs, select Flow logs. 1. Click Add filter. 1. From the Filter drop-down menu, select Flow log type. 1. From the Value drop-down menu, check Virtual network only. 1. Click Apply. 1. Click the name of a virtual network flow log. 1. Under Storage Account, set Retention days to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log requiring remediation. Remediate from Azure CLI Run the following command update the retention policy for a flow log in a network watcher, setting retention to 0, 90, or a number greater than 90: az network watcher flow-log update --location <location> --name <flow-log> --retention <number-of-days> Repeat for each virtual network flow log requiring remediation.

As network security group flow logs are on the retirement path, Azure recommends migrating to virtual network flow logs.

Level 2

7 Networking Services

Ensure that Network Watcher is 'Enabled' for Azure Regions That are in Use

Network Watcher is automatically enabled. When you create or update a virtual network in your subscription, Network Watcher will be enabled automatically in your Virtual Network's region. There is no impact to your resources or associated charge for automatically enabling Network Watcher.

Audit from Azure Portal 1. Use the Search bar to search for and click on the Network Watcher service. 1. From the Overview menu item, review each Network Watcher listed, and ensure that a network watcher is listed for each region in use by the subscription. Audit from Azure CLI az network watcher list --query [].{Location:location,State:provisioningState} -o table This will list all network watchers and their provisioning state. Ensure provisioningState is Succeeded for each network watcher. az account list-locations --query [?metadata.regionType=='Physical'].{Name:name,DisplayName:regionalDisplayName} -o table This will list all physical regions that exist in the subscription. Compare this list to the previous one to ensure that for each region in use, a network watcher exists with provisioningState set to Succeeded. Audit from PowerShell Get a list of Network Watchers Get-AzNetworkWatcher Make sure each watcher is set with the ProvisioningState setting set to Succeeded and all Locations that are in use by the subscription are using a watcher. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: b6e2945c-0b7b-40f5-9233-7a5323b5cdc6 - Name: 'Network Watcher should be enabled'

There are additional costs per transaction to run and store network data. For high-volume networks these charges will add up quickly.

Automated

Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.

Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support. To manually enable Network Watcher in each region where you want to use Network Watcher capabilities, follow the steps below. Remediate from Azure Portal 1. Use the Search bar to search for and click on the Network Watcher service. 1. Click Create. 1. Select a Region from the drop-down menu. 1. Click Add. Remediate from Azure CLI az network watcher configure --locations <region> --enabled true --resource-group <resource_group>

Level 1

7 Networking Services

Ensure that Public IP Addresses are Evaluated on a Periodic Basis

During Virtual Machine and Application creation, a setting may create and attach a public IP.

Audit from Azure Portal 1. Open the All Resources blade 2. Click on Add Filter 3. In the Add Filter window, select the following: Filter: Type Operator: Equals Value: Public IP address 4. Click the Apply button 5. For each Public IP address in the list, use Overview (or Properties) to review the Associated to: field and determine if the associated resource is still relevant to your tenant environment. If the associated resource is relevant, ensure that additional controls exist to mitigate risk (e.g. Firewalls, VPNs, Traffic Filtering, Virtual Gateway Appliances, Web Application Firewalls, etc.) on all subsequently attached resources. Audit from Azure CLI List all Public IP addresses: az network public-ip list For each Public IP address in the output, review the name property and determine if the associated resource is still relevant to your tenant environment. If the associated resource is relevant, ensure that additional controls exist to mitigate risk (e.g. Firewalls, VPNs, Traffic Filtering, Virtual Gateway Appliances, Web Application Firewalls, etc.) on all subsequently attached resources.

Regular reviews require administrative effort.

Manual

Public IP Addresses allocated to the tenant should be periodically reviewed for necessity. Public IP Addresses that are not intentionally assigned and controlled present a publicly facing vector for threat actors and significant risk to the tenant.

Remediation will vary significantly depending on your organization's security requirements for the resources attached to each individual Public IP address.

Level 2

7 Networking Services

Ensure that Virtual Network Flow Log Retention Days is Set to Greater than or Equal to 90

When a virtual network flow log is created using the Azure CLI, retention days is set to 0 by default. When creating via the Azure Portal, retention days must be specified by the creator.

Audit from Azure Portal 1. Go to Network Watcher. 1. Under Logs, select Flow logs. 1. Click Add filter. 1. From the Filter drop-down menu, select Flow log type. 1. From the Value drop-down menu, check Virtual network only. 1. Click Apply. 1. Click the name of a virtual network flow log. 1. Under Storage Account, ensure that Retention days is set to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log. Audit from Azure CLI Run the following command to list network watchers: az network watcher list Run the following command to list the name and retention policy of flow logs in a network watcher: az network watcher flow-log list --location <location> --query [*].[name,retentionPolicy] For each flow log, ensure that days is set to 0, 90, or a number greater than 90. If days is set to 0, the logs are retained indefinitely with no retention policy. Repeat for each network watcher.

• Virtual network flow logs are charged per gigabyte of network flow logs collected and come with a free tier of 5 GB/month per subscription. * If traffic analytics is enabled with virtual network flow logs, traffic analytics pricing applies at per gigabyte processing rates. * The storage of logs is charged separately, and the cost will depend on the amount of logs and the retention period.

Automated

Virtual network flow logs provide critical visibility into traffic patterns. Logs can be used to check for anomalies and give insight into suspected breaches.

Remediate from Azure Portal 1. Go to Network Watcher. 1. Under Logs, select Flow logs. 1. Click Add filter. 1. From the Filter drop-down menu, select Flow log type. 1. From the Value drop-down menu, check Virtual network only. 1. Click Apply. 1. Click the name of a virtual network flow log. 1. Under Storage Account, set Retention days to 0, 90, or a number greater than 90. If Retention days is set to 0, the logs are retained indefinitely with no retention policy. 1. Repeat steps 7 and 8 for each virtual network flow log requiring remediation. Remediate from Azure CLI Run the following command update the retention policy for a flow log in a network watcher, setting retention to 0, 90, or a number greater than 90: az network watcher flow-log update --location <location> --name <flow-log> --retention <number-of-days> Repeat for each virtual network flow log requiring remediation.

As network security group flow logs are on the retirement path, Azure recommends migrating to virtual network flow logs.

Level 2

7 Networking Services

Ensure 'Authentication type' is Set to 'Azure Active Directory' only for Azure VPN Gateway Point-to-Site Configuration

'Authentication type' is selected during creation of point-to-site configuration.

Audit from Azure Portal 1. Go to Virtual network gateways. 2. Under VPN gateway, click VPN gateways. 3. Click the name of a VPN gateway. 4. Under Settings, click Point-to-site configuration. 5. Ensure Authentication type is set to Azure Active Directory only. 6. Repeat steps 1-5 for each VPN gateway. Audit from Azure Policy - Policy ID: 21a6bc25-125e-4d13-b82d-2e19b7208ab7 - Name: 'VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users'

Azure VPN Gateways incur hourly charges, with additional costs for point-to-site connections and data transfer. Pricing varies by SKU and usage. Refer to https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/ for details.

Automated

Microsoft Entra ID authentication provides strong security and centralized identity management, and reduces risks associated with static credentials and certificate management.

Remediate from Azure Portal 1. Go to Virtual network gateways. 2. Under VPN gateway, click VPN gateways. 3. Click the name of a VPN gateway. 4. Under Settings, click Point-to-site configuration. 5. Ensure Authentication type click to expand the drop-down menu. 6. Check the box next to Azure Active Directory, and uncheck the boxes next to Azure certificate and RADIUS authentication. 7. Provide a Tenant, Audience, and Issuer for the Azure Active Directory configuration. 8. Click Save. 9. Repeat steps 1-8 for each VPN gateway requiring remediation.

Level 2

7 Networking Services

Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Application Gateway

Azure Web Application Firewall is enabled by default for the WAF V2 tier of Azure Application Gateway. It is not available in the Basic tier. Application gateways deployed using the Standard V2 tier can be upgraded to the WAF V2 tier to enable Azure Web Application Firewall.

Audit from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. In the Overview, under Essentials, ensure Tier is set to WAF V2. 4. Repeat steps 1-3 for each application gateway. Audit from Azure CLI Run the following command to list application gateways: az network application-gateway list For each application gateway, run the following command to get the firewall policy id: az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id Ensure a firewall policy id is returned. Audit from Azure Policy - Policy ID: 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 - Name: 'Web Application Firewall (WAF) should be enabled for Application Gateway'

The WAF V2 tier for Azure Application Gateways costs more than the Basic and Standard V2 tiers. Pricing includes a fixed hourly charge plus a charge per capacity-unit hour. Refer to https://azure.microsoft.com/en-gb/pricing/details/application-gateway/ for details.

Automated

Using Azure Web Application Firewall with Azure Application Gateway reduces exposure to external threats by mitigating attacks on public facing applications.

Note: Basic tier application gateways cannot be upgraded to the WAF V2 tier. Create a new WAF V2 tier application gateway to replace a Basic tier application gateway. Remediate from Azure Portal To remediate a Standard V2 tier application gateway: 1. Go to Application gateways. 2. Click Add filter. 3. From the Filter drop-down menu, select SKU size. 4. Check the box next to Standard_v2 only. 5. Click Apply. 6. Click the name of an application gateway. 7. Under Settings, click Web application firewall. 8. Under Configure, next to Tier, click WAF V2. 9. Select an existing or create a new WAF policy. 10. Click Save. 11. Repeat steps 1-10 for each Standard V2 tier application gateway requiring remediation.

Level 1

7 Networking Services

Ensure Subnets Are Associated with Network Security Groups

By default, a subnet is not associated with a network security group.

Audit from Azure Portal 1. Go to Virtual networks. 2. Click the name of a virtual network. 3. Under Settings, click Subnets. 4. Click the name of a subnet. 5. Under Security, ensure Network security group is not set to None. 6. Repeat steps 1-5 for each virtual network and subnet. Audit from Azure CLI Run the following command to list virtual networks: az network vnet list For each virtual network, run the following command to list subnets: az network vnet show --resource-group <resource-group> --name <virtual-network> --query subnets For each subnet, run the following command to get the network security group id: az network vnet subnet show --resource-group <resource-group> --vnet-name <virtual-network> --name <subnet> --query networkSecurityGroup.id Ensure a network security group id is returned. Audit from Azure Policy - Policy ID: e71308d3-144b-4262-b144-efdc3cc90517 - Name: 'Subnets should be associated with a Network Security Group'

Minor administrative effort is required to ensure subnets are associated with network security groups. There is no cost to create or use network security groups.

Automated

Unprotected subnets can expose resources to unauthorized access.

Remediate from Azure Portal 1. Go to Virtual networks. 2. Click the name of a virtual network. 3. Under Settings, click Subnets. 4. Click the name of a subnet. 5. Under Security, next to Network security group, click None to display the drop-down menu. 6. Select a network security group. 7. Click Save. 8. Repeat steps 1-7 for each virtual network and subnet requiring remediation. Remediate from Azure CLI For each subnet requiring remediation, run the following command to associate it with a network security group: az network vnet subnet update --resource-group <resource-group> --vnet-name <virtual-network> --name <subnet> --network-security-group <network-security-group>

Level 1

7 Networking Services

Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_2' or Higher on Azure Application Gateway

Min protocol version is set to TLSv1_2 by default.

Audit from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Listeners. 4. Under SSL Policy, ensure Min protocol version is set to TLSv1_2 or higher. 5. Repeat steps 1-4 for each application gateway. Audit from Azure CLI Run the following command to list application gateways: az network application-gateway list For each application gateway, run the following command to get the SSL policy: az network application-gateway ssl-policy show --resource-group <resource-group> --gateway-name <application-gateway> For each SSL policy, run the following command to get the minProtocolVersion: az network application-gateway ssl-policy predefined show --name <ssl-policy> --query minProtocolVersion Ensure TLSv1_2 or higher is returned.

Using the latest TLS version may affect compatibility with clients and backend services.

Automated

TLS 1.0 and 1.1 are outdated and vulnerable to security risks. Since TLS 1.2 and TLS 1.3 provide enhanced security and improved performance, it is highly recommended to use TLS 1.2 or higher whenever possible.

Remediate from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Listeners. 4. Under SSL Policy, next to the Selected SSL Policy name, click change. 5. Select an appropriate SSL policy with a Min protocol version of TLSv1_2 or higher. 6. Click Save. 7. Repeat steps 1-6 for each application gateway requiring remediation. Remediate from Azure CLI Run the following command to list available SSL policy options: az network application-gateway ssl-policy list-options Run the following command to list available predefined SSL policies: az network application-gateway ssl-policy predefined list For each application gateway requiring remediation, run the following command to set a predefined SSL policy: az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --name <ssl-policy> --policy-type Predefined Alternatively, run the following command to set a custom SSL policy: az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --policy-type Custom --min-protocol-version <min-protocol-version> --cipher-suites <cipher-suites>

Level 1

7 Networking Services

Ensure 'HTTP2' is Set to 'Enabled' on Azure Application Gateway

HTTP2 is enabled by default.

Audit from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Configuration. 4. Ensure HTTP2 is set to Enabled. 5. Repeat steps 1-4 for each application gateway. Audit from Azure CLI Run the following command to list application gateways: az network application-gateway list For each application gateway, run the following command to get the HTTP2 setting: az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query enableHttp2 Ensure true is returned. Audit from PowerShell Run the following command to list application gateways: Get-AzApplicationGateway Run the following command to get the application gateway in a resource group with a given name: $gateway = Get-AzApplicationGateway -ResourceGroupName <resource-group> -Name <application-gateway> Run the following command to get the HTTP2 setting: $gateway.EnableHttp2 Ensure that True is returned. Repeat for each application gateway.

Clients and backend services that do not support HTTP/2 will fall back to HTTP/1.1.

Automated

Enabling HTTP/2 supports use of modern encrypted connections.

Remediate from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Configuration. 4. Under HTTP2, click Enabled. 5. Click Save. 6. Repeat steps 1-5 for each application gateway requiring remediation. Remediate from Azure CLI For each application gateway requiring remediation, run the following command to enable HTTP2: az network application-gateway update --resource-group <resource-group> --name <application-gateway> --http2 Enabled Remediate from PowerShell Run the following command to get the application gateway in a resource group with a given name: $gateway = Get-AzApplicationGateway -ResourceGroupName <resource-group> -Name <application-gateway> Run the following command to enable HTTP2: $gateway.EnableHttp2 = $true Run the following command to apply the update: Set-AzApplicationGateway -ApplicationGateway $gateway Repeat for each application gateway requiring remediation.

Level 2

7 Networking Services

Ensure Request Body Inspection is Enabled in Azure Web Application Firewall policy on Azure Application Gateway

Request body inspection is enabled by default on Azure Application Gateways with Web Application Firewall.

Audit from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Web application firewall. 4. Under Associated web application firewall policy, click the policy name. 5. Under Settings, click Policy settings. 6. Ensure the box next to Enforce request body inspection is checked. 7. Repeat steps 1-6 for each application gateway. Audit from Azure CLI Run the following command to list application gateways: az network application-gateway list For each application gateway, run the following command to get the firewall policy id: az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id For each firewall policy, run the following command to get the request body inspection setting: az network application-gateway waf-policy show --ids <firewall-policy> --query policySettings.requestBodyCheck Ensure true is returned. Audit from Azure Policy - Policy ID: ca85ef9a-741d-461d-8b7a-18c2da82c666 - Name: 'Azure Web Application Firewall on Azure Application Gateway should have request body inspection enabled'

Minor performance impact on the Web Application Firewall. Additional effort may be required to monitor findings.

Automated

Enabling request body inspection strengthens security by allowing the Web Application Firewall to detect common attacks, such as SQL injection and cross-site scripting.

Remediate from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Web application firewall. 4. Under Associated web application firewall policy, click the policy name. 5. Under Settings, click Policy settings. 6. Check the box next to Enforce request body inspection. 7. Click Save. 8. Repeat steps 1-7 for each application gateway and firewall policy requiring remediation. Remediate from Azure CLI For each firewall policy requiring remediation, run the following command to enable request body inspection: az network application-gateway waf-policy update --ids <firewall-policy> --policy-settings request-body-check=true

Level 2

7 Networking Services

Ensure Bot Protection is Enabled in Azure Web Application Firewall Policy on Azure Application Gateway

Bot protection is disabled by default on Azure Application Gateways with Web Application Firewall.

Audit from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Web application firewall. 4. Under Associated web application firewall policy, click the policy name. 5. Under Settings, click Managed rules. 6. Ensure a Rule Id containing Microsoft_BotManagerRuleSet is listed. 7. Click the > to expand the row. 8. Ensure the Status for Malicious Bots is set to Enabled. 9. Repeat steps 1-8 for each application gateway. Audit from Azure CLI Run the following command to list application gateways: az network application-gateway list For each application gateway, run the following command to get the firewall policy id: az network application-gateway show --resource-group <resource-group> --name <application-gateway> --query firewallPolicy.id For each firewall policy, run the following command to get the managed rule sets: az network application-gateway waf-policy show --ids <firewall-policy> --query managedRules.managedRuleSets Ensure a managed rule set with ruleSetType of Microsoft_BotManagerRuleSet is returned, and that no ruleGroupOverrides for ruleGroupName KnownBadBots with state Disabled are returned. Audit from Azure Policy - Policy ID: ebea0d86-7fbd-42e3-8a46-27e7568c2525 - Name: 'Bot Protection should be enabled for Azure Application Gateway WAF'

May require monitoring to identify false positives.

Automated

Internet traffic from bots can scrape, scan, and search for application vulnerabilities. Enabling bot protection stops requests from known malicious IP addresses and enhances the overall security of your application by reducing exposure to automated attacks.

Remediate from Azure Portal 1. Go to Application gateways. 2. Click the name of an application gateway. 3. Under Settings, click Web application firewall. 4. Under Associated web application firewall policy, click the policy name. 5. Under Settings, click Managed rules. 6. Click Assign. 7. Under Bot Management ruleset, click to display the drop-down menu. 8. Select a Microsoft_BotManagerRuleSet. 9. Click Save. 10. Click X to close the panel. 11. Repeat steps 1-10 for each application gateway and firewall policy requiring remediation. Remediate from Azure CLI For each firewall policy requiring remediation, run the following command to enable bot protection: az network application-gateway waf-policy managed-rule rule-set add --resource-group <resource-group> --policy-name <firewall-policy> --type Microsoft_BotManagerRuleSet --version <0.1|1.0|1.1>

Level 2

7 Networking Services

Ensure Azure Network Security Perimeter is Used to Secure Azure Platform-as-a-service Resources

PaaS resources are not associated with a network security perimeter by default.

Audit from Azure Portal 1. Go to Resource groups. 2. Click the name of a resource group. 3. Take note of PaaS resources. 4. Go to Network Security Perimeters. 5. Click the name of a network security perimeter. 6. Under Settings, click Associated resources. 7. Take note of the associated resources. 8. Repeat steps 1-7 and ensure each PaaS resource is associated with a network security perimeter. Audit from Azure CLI Run the following command to list resource groups: az group list For each resource group, run the following command to list resources: az resource list --resource-group <resource-group> Take note of PaaS resources. For each resource group, run the following command to list network security perimeters: az network perimeter list --resource-group <resource-group> For each network security perimeter, run the following command to list resources: az network perimeter association list --resource-group <resource-group> --perimeter-name <network-security-perimeter> Ensure each PaaS resource is associated with a network security perimeter.

Implementation requires administrative effort to configure and maintain network security perimeter profiles and resource assignments. Azure does not list any additional charges for using network security perimeters.

Manual

Network security perimeter denies public access to PaaS resources, reducing exposure and mitigating data exfiltration risks.

Remediate from Azure Portal Create and associate PaaS resources with a new network security perimeter: 1. Go to Network Security Perimeters. 2. Click + Create. 3. Select a Subscription and Resource group, provide a Name, select a Region, and provide a Profile name. 4. Click Next. 5. Click + Add. 6. Check the box next to a PaaS resource to associate it with the network security perimeter. 7. Click Select. 8. Click Next. 9. Configure appropriate Inbound access rules for your organization. 10. Click Next. 11. Configure appropriate Outbound access rules for your organization. 12. Click Review + create. 13. Click Create. Remediate from Azure CLI Use az network perimeter profile list or az network perimeter profile create to list existing or create a new network security perimeter profile. For each PaaS resource requiring association with a network security perimeter, run the following command: az network perimeter association create --resource-group <resource-group> --perimeter-name <network-security-perimeter> --association-name <association> --private-link-resource "{id:<paas-resource-id>}" --profile "{<profile-id>}"

The current list of resources that can be associated with a network security perimeter are as follows: Azure Monitor, Azure AI Search, Cosmos DB, Event Hubs, Key Vault, SQL DB, Storage, Azure OpenAI Service. While network security perimeter is generally available, Cosmos DB, SQL DB, and Azure OpenAI Service are in public preview.

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure Microsoft Defender CSPM is Set to 'On'

Defender CSPM is disabled by default.

Audit from Azure Portal 1. Go to Microsoft Defender for Cloud. 2. Under Management, click Environment settings. 3. Click the name of a subscription. 4. Select the Defender plans blade. 5. Under Cloud Security Posture Management (CSPM), in the row for Defender CSPM, ensure Status is set to On. Audit from Azure CLI Run the following command to get the CloudPosture plan pricing tier: az security pricing show --name CloudPosture --query pricingTier Ensure Standard is returned. Audit from PowerShell Run the following command to get the CloudPosture plan pricing tier: Get-AzSecurityPricing -Name CloudPosture | Select-Object PricingTier Ensure Standard is returned. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 1f90fc71-a595-4066-8974-d4d0802e8ef0 - Name: 'Microsoft Defender CSPM should be enabled'

Enabling Microsoft Defender CSPM incurs hourly charges for each billable compute, database, and storage resource. This can lead to significant costs in larger environments. Careful planning and cost analysis are recommended before enabling the service. Refer to https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/#pricing for pricing information.

Automated

Microsoft Defender CSPM provides detailed visibility into the security state of assets and workloads and offers hardening guidance to help improve security posture.

Remediate from Azure Portal 1. Go to Microsoft Defender for Cloud. 2. Under Management, click Environment settings. 3. Click the name of a subscription. 4. Select the Defender plans blade. 5. Under Cloud Security Posture Management (CSPM), in the row for Defender CSPM, set the toggle switch for Status to On. 6. Click Save. Remediate from Azure CLI Run the following command to enable Defender CSPM: az security pricing create --name CloudPosture --tier Standard --extensions name=ApiPosture isEnabled=true Remediate from PowerShell Run the following command to enable Defender CSPM: Set-AzSecurityPricing -Name CloudPosture -PricingTier Standard -Extension '[{"name":"ApiPosture","isEnabled":"True"}]'

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure Microsoft Defender for APIs is Set to 'On'

By default, Microsoft Defender plan is off.

Audit from Azure Portal 1. Go to Microsoft Defender for Cloud 2. Under Management, select Environment Settings 3. Click on the subscription name 4. Select Defender plans 5. Ensure Status is On for App Service Audit from Azure CLI Run the following command: az security pricing show -n AppServices Ensure -PricingTier is set to Standard Audit from PowerShell Run the following command: Get-AzSecurityPricing -Name 'AppServices' |Select-Object Name,PricingTier Ensure the -PricingTier is set to Standard Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 2913021d-f2fd-4f3d-b958-22354e2bdbcb - Name: 'Azure Defender for App Service should be enabled'

Turning on Microsoft Defender for App Service incurs an additional cost per resource.

Automated

Enabling Microsoft Defender for App Service allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

Remediate from Azure Portal 1. Go to Microsoft Defender for Cloud 2. Under Management, select Environment Settings 3. Click on the subscription name 4. Select Defender plans 5. Set App Service Status to On 6. Select Save Remediate from Azure CLI Run the following command: az security pricing create -n Appservices --tier 'standard' Remediate from PowerShell Run the following command: Set-AzSecurityPricing -Name AppServices -PricingTier Standard

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure that Defender for Servers is Set to 'On'

By default, the Defender for Servers plan is disabled.

Audit from Azure Portal 1. Go to Microsoft Defender for Cloud. 1. Under Management, select Environment settings. 1. Click on a subscription name. 1. Select Defender plans in the left pane. 1. Under Cloud Workload Protection (CWP), locate Servers in the Plan column, ensure Status is set to On. 1. Repeat steps 1-5 for each subscription. Audit from Azure CLI Run the following command: az security pricing show -n VirtualMachines --query pricingTier If the tenant is licensed and enabled, the output will indicate Standard. Audit from PowerShell Run the following command: Get-AzSecurityPricing -Name 'VirtualMachines' |Select-Object Name,PricingTier If the tenant is licensed and enabled, the -PricingTier parameter will indicate Standard. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 4da35fc9-c9e7-4960-aec9-797fe7d9051d - Name: 'Azure Defender for servers should be enabled'

Enabling Defender for Servers in Microsoft Defender for Cloud incurs an additional cost per resource. Refer to https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs. - Plan 1: Subscription only - Plan 2: Subscription and workspace

Automated

Enabling Defender for Servers allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

Remediate from Azure Portal 1. Go to Microsoft Defender for Cloud. 1. Under Management, select Environment settings. 1. Click on a subscription name. 1. Click Defender plans in the left pane. 1. Under Cloud Workload Protection (CWP), locate Servers in the Plan column, set Status to On. 1. Select Save. 1. Repeat steps 1-6 for each subscription requiring remediation. Remediate from Azure CLI Run the following command: az security pricing create -n VirtualMachines --tier 'standard' Remediate from PowerShell Run the following command: Set-AzSecurityPricing -Name 'VirtualMachines' -PricingTier 'Standard'

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure that 'Vulnerability assessment for machines' Component Status is set to 'On'

By default, Automatic provisioning of monitoring agent is set to Off.

Audit from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Defender for Cloud 1. Under Management, select Environment Settings 1. Select a subscription 1. Click on Settings & monitoring 1. Ensure that Vulnerability assessment for machines is set to On Repeat the above for any additional subscriptions.

Microsoft Defender for Servers plan 2 licensing is required, and configuration of Azure Arc introduces complexity beyond this recommendation.

Manual

Vulnerability assessment for machines scans for various security-related configurations and events such as system updates, OS vulnerabilities, and endpoint protection, then produces alerts on threat and vulnerability findings.

Remediate from Azure Portal 1. From Azure Home select the Portal Menu 1. Select Microsoft Defender for Cloud 1. Under Management, select Environment Settings 1. Select a subscription 1. Click on Settings & Monitoring 1. Set the Status of Vulnerability assessment for machines to On 1. Click Continue Repeat the above for any additional subscriptions.

While this feature is generally available as of publication, it is not yet available for Azure Government tenants.

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure that 'Endpoint protection' Component Status is set to 'On'

By default, Endpoint protection is off.

Audit from Azure Portal 1. From Azure Home select the Portal Menu. 1. Select Microsoft Defender for Cloud. 1. Under Management, select Environment Settings. 1. Click on the subscription name. 1. Click Settings & monitoring. 1. Ensure the Status for Endpoint protection is set to On. Audit from Azure CLI Ensure the output of the below command is True az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X GET -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/<subscriptionID>/providers/Microsoft.Security/settings?api-version=2021-06-01' | jq '.|.value[] | select(.name==WDATP)'|jq '.properties.enabled' Audit from PowerShell Run the following commands to login and audit this check Connect-AzAccount Set-AzContext -Subscription <subscriptionID> Get-AzSecuritySetting | Select-Object name,enabled |where-object {$_.name -eq WDATP} PowerShell Output - Non-Compliant Name Enabled ---- ------- WDATP False PowerShell Output - Compliant Name Enabled ---- ------- WDATP True

Endpoint protection requires licensing and is included in these plans: - Defender for Servers plan 1 - Defender for Servers plan 2

Automated

Microsoft Defender for Endpoint integration brings comprehensive Endpoint Detection and Response (EDR) capabilities within Microsoft Defender for Cloud. This integration helps to spot abnormalities, as well as detect and respond to advanced attacks on endpoints monitored by Microsoft Defender for Cloud. MDE works only with Standard Tier subscriptions.

Remediate from Azure Portal 1. From Azure Home select the Portal Menu. 1. Go to Microsoft Defender for Cloud. 1. Under Management, select Environment Settings. 1. Click on the subscription name. 1. Click Settings & monitoring. 1. Set the Status for Endpoint protection to On. 1. Click Continue. Remediate from Azure CLI Use the below command to enable Standard pricing tier for Storage Accounts az account get-access-token --query {subscription:subscription,accessToken:accessToken} --out tsv | xargs -L1 bash -c 'curl -X PUT -H Authorization: Bearer $1 -H Content-Type: application/json https://management.azure.com/subscriptions/<subscriptionID>/providers/Microsoft.Security/settings/WDATP?api-version=2021-06-01 -d@input.json' Where input.json contains the Request body json data as mentioned below. { id: /subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/settings/WDATP, kind: DataExportSettings, type: Microsoft.Security/settings, properties: { enabled: true } }

IMPORTANT: When enabling integration between DfE & DfC it needs to be taken into account that this will have some side effects that may be undesirable. 1. For server 2019 & above if defender is installed (default for these server SKUs) this will trigger a deployment of the new unified agent and link to any of the extended configuration in the Defender portal. 1. If the new unified agent is required for server SKUs of Win 2016 or Linux and lower there is additional integration that needs to be switched on and agents need to be aligned. NOTE: Microsoft Defender for Endpoint (MDE) was formerly known as Windows Defender Advanced Threat Protection (WDATP). There are a number of places (e.g. Azure CLI) where the WDATP acronym is still used within Azure.

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure that 'Agentless scanning for machines' Component Status is Set to 'On'

By default, Agentless scanning for machines is off.

Audit from Azure Portal 1. From the Azure Portal Home page, select Microsoft Defender for Cloud 1. Under Management select Environment Settings 1. Select a subscription 1. Under Settings > Defender Plans, click Settings & monitoring 1. Under the Component column, locate the row for Agentless scanning for machines 1. Ensure that On is selected Repeat the above for any additional subscriptions.

Agentless scanning for machines requires licensing and is included in these plans: - Defender CSPM - Defender for Servers plan 2

Manual

The Microsoft Defender for Cloud agentless machine scanner provides threat detection, vulnerability detection, and discovery of sensitive information.

Audit from Azure Portal 1. From the Azure Portal Home page, select Microsoft Defender for Cloud 1. Under Management select Environment Settings 1. Select a subscription 1. Under Settings > Defender Plans, click Settings & monitoring 1. Under the Component column, locate the row for Agentless scanning for machines 1. Select On 1. Click Continue in the top left Repeat the above for any additional subscriptions.

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure that 'File Integrity Monitoring' Component Status is Set to 'On'

By default, File Integrity Monitoring is Off.

Audit from Azure Portal 1. From the Azure Portal Home page, select Microsoft Defender for Cloud 1. Under Management select Environment Settings 1. Select a subscription 1. Under Settings > Defender Plans, click Settings & monitoring 1. Under the Component column, locate the row for File Integrity Monitoring 1. Ensure that On is selected Repeat the above for any additional subscriptions.

File Integrity Monitoring requires licensing and is included in these plans: - Defender for Servers plan 2

Manual

FIM provides a detection mechanism for compromised files. When FIM is enabled, critical system files are monitored for changes that might indicate a threat actor is attempting to modify system files for lateral compromise within a host operating system.

Audit from Azure Portal 1. From the Azure Portal Home page, select Microsoft Defender for Cloud 1. Under Management select Environment Settings 1. Select a subscription 1. Under Settings > Defender Plans, click Settings & monitoring 1. Under the Component column, locate the row for File Integrity Monitoring 1. Select On 1. Click Continue in the top left Repeat the above for any additional subscriptions.

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure That Microsoft Defender for Containers Is Set To 'On'

The Microsoft Defender for Containers plan is disabled by default.

Audit from Azure Portal 1. Go to Microsoft Defender for Cloud. 1. Under Management, click Environment settings. 1. Click the name of a subscription. 1. Under Settings, click Defender plans. 1. Under Cloud Workload Protection (CWP), in the row for Containers, ensure that the Status is set to On and Monitoring coverage displays Full. 1. Repeat steps 1-5 for each subscription. Audit from Azure CLI For Microsoft Defender for Container Registries (deprecated), run the following command: az security pricing show --name ContainerRegistry --query pricingTier Ensure that the command returns Standard. For Microsoft Defender for Containers, run the following command: az security pricing show --name Containers --query [pricingTier,extensions[*].[name,isEnabled]] Ensure that the command returns Standard, and that each of the extensions (ContainerRegistriesVulnerabilityAssessments, AgentlessDiscoveryForKubernetes, AgentlessVmScanning, ContainerSensor) returns True. Repeat for each subscription. Audit from PowerShell For Microsoft Defender for Container Registries (deprecated), run the following command: Get-AzSecurityPricing -Name 'ContainerRegistry' | Select-Object Name,PricingTier Ensure the command returns PricingTier Standard. For Microsoft Defender for Containers, run the following command: Get-AzSecurityPricing -Name 'Containers' Ensure that PricingTier is set to Standard, and that each of the extensions (ContainerRegistriesVulnerabilityAssessments, AgentlessDiscoveryForKubernetes, AgentlessVmScanning, ContainerSensor) has isEnabled set to True. Repeat for each subscription. Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 1c988dd6-ade4-430f-a608-2a3e5b0a6d38 - Name: 'Microsoft Defender for Containers should be enabled'

Microsoft Defender for Containers incurs a charge per vCore. Refer to https://azure.microsoft.com/en-us/pricing/details/defender-for-cloud/ and https://azure.microsoft.com/en-us/pricing/calculator/ to estimate potential costs.

Automated

Enabling Microsoft Defender for Containers enhances defense-in-depth by providing advanced threat detection, vulnerability assessment, and security monitoring for containerized environments, leveraging insights from the Microsoft Security Response Center (MSRC).

Remediate from Azure Portal 1. Go to Microsoft Defender for Cloud. 1. Under Management, click Environment settings. 1. Click the name of a subscription. 1. Under Settings, click Defender plans. 1. Under Cloud Workload Protection (CWP), in the row for Containers, click On in the Status column. 1. If Monitoring coverage displays Partial, click Settings under Partial. 1. Set the status of each of the components to On. 1. Click Continue. 1. Click Save. 1. Repeat steps 1-9 for each subscription. Remediate from Azure CLI Note: Microsoft Defender for Container Registries ('ContainerRegistry') is deprecated and has been replaced by Microsoft Defender for Containers ('Containers'). Run the below command to enable the Microsoft Defender for Containers plan and its components: az security pricing create -n 'Containers' --tier 'standard' --extensions name=ContainerRegistriesVulnerabilityAssessments isEnabled=True --extensions name=AgentlessDiscoveryForKubernetes isEnabled=True --extensions name=AgentlessVmScanning isEnabled=True --extensions name=ContainerSensor isEnabled=True Remediate from PowerShell Note: Microsoft Defender for Container Registries ('ContainerRegistry') is deprecated and has been replaced by Microsoft Defender for Containers ('Containers'). Run the below command to enable the Microsoft Defender for Containers plan and its components: Set-AzSecurityPricing -Name 'Containers' -PricingTier 'Standard' -Extension '[{name:ContainerRegistriesVulnerabilityAssessments,isEnabled:True},{name:AgentlessDiscoveryForKubernetes,isEnabled:True},{name:AgentlessVmScanning,isEnabled:True},{name:ContainerSensor,isEnabled:True}]'

The Azure Policy 'Microsoft Defender for Containers should be enabled' checks only that the pricingTier for Containers is set to Standard. It does not check the status of the plan's components.

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure That Microsoft Defender for Storage Is Set To 'On'

By default, Microsoft Defender plan is off.

Audit from Azure Portal 1. Go to Microsoft Defender for Cloud. 2. Under Management, select Environment Settings. 3. Click on the subscription name. 4. Select the Defender plans blade. 5. Ensure Status is set to On for Storage. Audit from Azure CLI Ensure the output of the below command is Standard az security pricing show -n StorageAccounts Audit from PowerShell Get-AzSecurityPricing -Name 'StorageAccounts' | Select-Object Name,PricingTier Ensure output for Name PricingTier is StorageAccounts Standard Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: 640d2586-54d2-465f-877f-9ffc1d2109f4 - Name: 'Microsoft Defender for Storage should be enabled'

Turning on Microsoft Defender for Storage incurs an additional cost per resource.

Automated

Enabling Microsoft Defender for Storage allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

Remediate from Azure Portal 1. Go to Microsoft Defender for Cloud. 2. Under Management, select Environment Settings. 3. Click on the subscription name. 4. Select the Defender plans blade. 5. Set Status to On for Storage. 6. Select Save. Remediate from Azure CLI Ensure the output of the below command is Standard az security pricing create -n StorageAccounts --tier 'standard' Remediate from PowerShell Set-AzSecurityPricing -Name 'StorageAccounts' -PricingTier 'Standard'

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure Advanced Threat Protection Alerts for Storage Accounts Are Monitored

By default, continuous export is off.

Audit from Azure Portal 1. Go to Microsoft Defender for Cloud. 2. Under Management, click Environment Settings. 3. Expand the Tenant Root Group(s) to reveal subscriptions. For each subscription listed: 1. Click the subscription name to open the Defender Plans settings 2. In the settings on the left, click Continuous Export Ensure that Export enabled is set to On and delivering at least Security Alerts (Medium and High) to an Event Hub or Log Analytics Workspace which is tied to a SIEM that is configured to monitor and alert for security alerts.

Requires integration effort with SIEM or alerting tools and a defined incident response process. The amount of data logged and, thus, the cost incurred can vary significantly depending on the tenant size and the applications in your tenant that interact with the Microsoft Graph APIs. See pricing: Log Analytics (https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs#pricing-model), Azure Storage (https://azure.microsoft.com/en-us/pricing/details/storage/blobs/), Event Hubs (https://azure.microsoft.com/en-us/pricing/details/event-hubs/).

Manual

Enabling Microsoft Defender for Storage without a monitoring process limits its value. Continuous monitoring and alert triage ensure that detected threats are acted upon quickly, reducing risk exposure.

Connect Microsoft Defender for Cloud to a SIEM such as Microsoft Sentinel or another log analytics solution. Remediate from Azure Portal 1. Go to Microsoft Defender for Cloud. 2. Under Management, click Environment Settings. 3. Expand the Tenant Root Group(s) to reveal subscriptions. For each subscription listed: 1. Click the subscription name to open the Defender Plans settings 2. In the settings on the left, click Continuous Export 3. Select either Event Hub, Log Analytics Workspace, or both depending on your environment. 4. Set Export enabled to On 5. Under Exported data types, ensure that at least Security Alerts (Medium and High) is checked. 6. Under Export target, set the target Event Hub or Log Analytics Workspace which is tied to a SIEM that is configured to monitor and alert for security alerts. Ensure security alerts are included in the security operations workflow and incident response plan.

Level 2

8 Security Services

8.1 Microsoft Defender for Cloud

Ensure That Microsoft Defender for App Services Is Set To 'On'

By default, Microsoft Defender plan is off.