Payment Card Industry Data Security Standard (PCI DSS) v4.0
The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard. It's administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. PCI DSS applies to entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). This includes, but isn't limited to, merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.
ProwlerRun this compliance with Prowler
Run in Prowler Cloudprowler azure --compliance pci_4.0_azureRequirements (1669)
1.2.5: Network security controls (NSCs) are configured and maintained. 1710
1.2.5.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.5.2Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure CDN
1.2.5.3Checks if Azure Front Door and Azure CDN profiles are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. The rule is NON_COMPLIANT if the minimum TLS version configured is below TLS 1.2.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure CDN
1.2.5.4Checks if Azure Front Door and Azure CDN profiles are using a custom SSL certificate and are configured to use SNI (Server Name Indication) to serve HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method is using a dedicated IP address instead of SNI.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure CDN
1.2.5.5Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure CDN
1.2.5.6Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure CDN
1.2.5.7Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure AI Search
1.2.5.8Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Load Balancer
1.2.5.9Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.5.10Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.5.11Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure HDInsight
1.2.5.12Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure AI Search
1.2.5.13Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure AI Search
1.2.5.14Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.0
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Synapse Analytics
1.2.5.15Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Blob Storage
1.2.5.16Checks if an Azure Storage Account with SFTP enabled allows unencrypted FTP connections. The rule is NON_COMPLIANT if the storage account permits FTP instead of requiring SFTP or FTPS for secure endpoint connections.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Storage
1.2.5.17Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
1.2.5: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8: Network security controls (NSCs) are configured and maintained. 4721
1.2.8.1Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure API Management
1.2.8.2Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure API Management
1.2.8.3Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure API Management
1.2.8.4Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Front Door
1.2.8.5Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Content Delivery Network
1.2.8.6Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure DevOps
1.2.8.7Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Database Migration Service
1.2.8.8Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Cosmos DB
1.2.8.9Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure VPN
1.2.8.10Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Automation State Configuration
1.2.8.11Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Virtual WAN
1.2.8.12Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Kubernetes Service
1.2.8.13Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Cognitive Search
1.2.8.14Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.15Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Aplication Gateway
1.2.8.16Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure HDInsight
1.2.8.17Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.18Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Virtual Network
1.2.8.19Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Functions
1.2.8.20Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Functions
1.2.8.21Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.22Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.23Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.24Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.25Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Virtual Network
1.2.8.26Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Cognitive Search
1.2.8.27Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Database
1.2.8.28Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Database
1.2.8.29Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Synapse Analytics
1.2.8.30Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Storage
1.2.8.31Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Storage
1.2.8.32Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Storage
1.2.8.33Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Storage
1.2.8.34Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Storage
1.2.8.35Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Storage
1.2.8.36Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Machine Learning
1.2.8.37Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Machine Learning
1.2.8.38Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.39Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.40Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.41Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.42Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.43Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.44Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.45Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.46Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.2.8.47Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
1.2.8: Network security controls (NSCs) are configured and maintained.
- Service
Azure Network
1.3.1: Network access to and from the cardholder data environment is restricted. 5221
1.3.1.1Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.1.2Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.1.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.1.4Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.1.5Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Front Door
1.3.1.6Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Content Delivery Network
1.3.1.7Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure DevOps
1.3.1.8Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Database Migration Service
1.3.1.9Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cosmos DB
1.3.1.10Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure VPN
1.3.1.11Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Automation State Configuration
1.3.1.12Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Virtual WAN
1.3.1.13Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Kubernetes Service
1.3.1.14Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cache for Redis
1.3.1.15Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cognitive Search
1.3.1.16Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.17Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Aplication Gateway
1.3.1.18Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure HDInsight
1.3.1.19Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.20For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.21Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Virtual Network
1.3.1.22Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Functions
1.3.1.23Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Functions
1.3.1.24Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.25Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.26Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.27Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.28Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Virtual Network
1.3.1.29Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cognitive Search
1.3.1.30Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Database
1.3.1.31Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Database
1.3.1.32Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Synapse Analytics
1.3.1.33Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Synapse Analytics
1.3.1.34Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Blob Storage
1.3.1.35Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.1.36Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.1.37Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.1.38Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.1.39Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.1.40Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Machine Learning
1.3.1.41Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Machine Learning
1.3.1.42Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.43Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.44Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.45Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.46Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.47Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.48Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.49Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.50Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.51Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.1.52Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
1.3.1: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2: Network access to and from the cardholder data environment is restricted. 5221
1.3.2.1Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.2.2Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.2.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.2.4Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure API Management
1.3.2.5Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Front Door
1.3.2.6Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Content Delivery Network
1.3.2.7Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure DevOps
1.3.2.8Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Database Migration Service
1.3.2.9Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cosmos DB
1.3.2.10Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure VPN
1.3.2.11Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Automation State Configuration
1.3.2.12Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Virtual WAN
1.3.2.13Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Kubernetes Service
1.3.2.14Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cache for Redis
1.3.2.15Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cognitive Search
1.3.2.16Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.17Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Aplication Gateway
1.3.2.18Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure HDInsight
1.3.2.19Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.20For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.21Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Virtual Network
1.3.2.22Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Functions
1.3.2.23Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Functions
1.3.2.24Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.25Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.26Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.27Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.28Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Virtual Network
1.3.2.29Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Cognitive Search
1.3.2.30Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Database
1.3.2.31Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Database
1.3.2.32Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Synapse Analytics
1.3.2.33Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Synapse Analytics
1.3.2.34Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Blob Storage
1.3.2.35Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.2.36Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.2.37Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.2.38Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.2.39Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Storage
1.3.2.40Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Machine Learning
1.3.2.41Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Machine Learning
1.3.2.42Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.43Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.44Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.45Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.46Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.47Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.48Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.49Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.50Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.51Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.3.2.52Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
1.3.2: Network access to and from the cardholder data environment is restricted.
- Service
Azure Network
1.4.1: Network connections between trusted and untrusted networks are controlled. 102
1.4.1.1Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.1.2Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.1.3Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Cache for Redis
1.4.1.4For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.1.5Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual Network
1.4.1.6Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual Network
1.4.1.7Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Synapse Analytics
1.4.1.8Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Machine Learning
1.4.1.9Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.1.10Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.0
Attributes
- Section
1.4.1: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2: Network connections between trusted and untrusted networks are controlled. 5021
1.4.2.1Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.2.2Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.2.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.2.4Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.2.5Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Front Door
1.4.2.6Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Content Delivery Network
1.4.2.7Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure DevOps
1.4.2.8Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Database Migration Service
1.4.2.9Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Cosmos DB
1.4.2.10Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure VPN
1.4.2.11Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Automation State Configuration
1.4.2.12Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual WAN
1.4.2.13Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Kubernetes Service
1.4.2.14Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Cognitive Search
1.4.2.15Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.16Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Aplication Gateway
1.4.2.17Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure HDInsight
1.4.2.18Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.19Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual Network
1.4.2.20Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Functions
1.4.2.21Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Functions
1.4.2.22Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.23Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.24Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.25Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.26Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual Network
1.4.2.27Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Cognitive Search
1.4.2.28Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Database
1.4.2.29Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Database
1.4.2.30Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Synapse Analytics
1.4.2.31Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Synapse Analytics
1.4.2.32Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Blob Storage
1.4.2.33Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Storage
1.4.2.34Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Storage
1.4.2.35Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Storage
1.4.2.36Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Storage
1.4.2.37Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Storage
1.4.2.38Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Machine Learning
1.4.2.39Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Machine Learning
1.4.2.40Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.41Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.42Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.43Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.44Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.45Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.46Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.47Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.48Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.49Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.2.50Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
1.4.2: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.3: Network connections between trusted and untrusted networks are controlled. 30
1.4.3.1Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.0
Attributes
- Section
1.4.3: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.3.2Checks if an Azure Firewall policy is configured with a user-defined default stateless action for full packets. This rule is NON_COMPLIANT if the default stateless action for full packets does not match the user-defined default stateless action.0
Attributes
- Section
1.4.3: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.3.3Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.0
Attributes
- Section
1.4.3: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.4: Network connections between trusted and untrusted networks are controlled. 102
1.4.4.1Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.4.2Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure API Management
1.4.4.3Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Cache for Redis
1.4.4.4For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.4.5Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual Network
1.4.4.6Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual Network
1.4.4.7Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Synapse Analytics
1.4.4.8Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Machine Learning
1.4.4.9Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.4.10Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.0
Attributes
- Section
1.4.4: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Network
1.4.5: Network connections between trusted and untrusted networks are controlled. 20
1.4.5.1Checks if Azure Virtual Machine Scale Sets (VMSS) and Azure Virtual Machines (VMs) network configurations are set to assign public IP addresses to their network interfaces. The rule is NON_COMPLIANT if the default configuration of a VM or VMSS has at least one network interface with public IP assignment enabled.0
Attributes
- Section
1.4.5: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Virtual Machine
1.4.5.2Checks if Azure Container Instances (ACI) or Azure Kubernetes Service (AKS) pod definitions are configured to share a hosts process namespace with their containers. The rule is NON_COMPLIANT if the process namespace sharing setting is enabled, allowing containers to access and modify host-level processes.0
Attributes
- Section
1.4.5: Network connections between trusted and untrusted networks are controlled.
- Service
Azure Kubernetes Service
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. 4621
1.5.1.1Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure API Management
1.5.1.2Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure API Management
1.5.1.3Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure API Management
1.5.1.4Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Front Door
1.5.1.5Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Content Delivery Network
1.5.1.6Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure DevOps
1.5.1.7Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Database Migration Service
1.5.1.8Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Cosmos DB
1.5.1.9Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure VPN
1.5.1.10Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Automation State Configuration
1.5.1.11Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Virtual WAN
1.5.1.12Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Kubernetes Service
1.5.1.13Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Cognitive Search
1.5.1.14Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.15Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Aplication Gateway
1.5.1.16Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure HDInsight
1.5.1.17Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.18Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Virtual Network
1.5.1.19Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Functions
1.5.1.20Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Functions
1.5.1.21Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.22Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.23Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.24Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.25Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Virtual Network
1.5.1.26Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Cognitive Search
1.5.1.27Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Database
1.5.1.28Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Database
1.5.1.29Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Synapse Analytics
1.5.1.30Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Blob Storage
1.5.1.31Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Storage
1.5.1.32Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Storage
1.5.1.33Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Storage
1.5.1.34Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Storage
1.5.1.35Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Storage
1.5.1.36Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Machine Learning
1.5.1.37Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Machine Learning
1.5.1.38Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.39Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.40Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.41Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.42Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.43Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.44Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.45Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
1.5.1.46Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
- Service
Azure Network
2.2.5: System components are configured and managed securely. 1710
2.2.5.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Network
2.2.5.2Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure CDN
2.2.5.3Checks if Azure Front Door and Azure CDN profiles are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. The rule is NON_COMPLIANT if the minimum TLS version configured is below TLS 1.2.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure CDN
2.2.5.4Checks if Azure Front Door and Azure CDN profiles are using a custom SSL certificate and are configured to use SNI (Server Name Indication) to serve HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method is using a dedicated IP address instead of SNI.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure CDN
2.2.5.5Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure CDN
2.2.5.6Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure CDN
2.2.5.7Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure AI Search
2.2.5.8Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Load Balancer
2.2.5.9Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Network
2.2.5.10Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Network
2.2.5.11Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure HDInsight
2.2.5.12Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure AI Search
2.2.5.13Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure AI Search
2.2.5.14Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.0
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Synapse Analytics
2.2.5.15Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Blob Storage
2.2.5.16Checks if an Azure Storage Account with SFTP enabled allows unencrypted FTP connections. The rule is NON_COMPLIANT if the storage account permits FTP instead of requiring SFTP or FTPS for secure endpoint connections.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Storage
2.2.5.17Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
2.2.5: System components are configured and managed securely.
- Service
Azure Network
2.2.7: System components are configured and managed securely. 198
2.2.7.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Network
2.2.7.2Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure CDN
2.2.7.3Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure CDN
2.2.7.4Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure CDN
2.2.7.5Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Cosmos DB
2.2.7.6Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Database Migration Service
2.2.7.7Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Database Migration Service
2.2.7.8Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Cache
2.2.7.9Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure AI Search
2.2.7.10Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Aplication Gateway
2.2.7.11Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Load Balancer
2.2.7.12Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Network
2.2.7.13Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Network
2.2.7.14Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure HDInsight
2.2.7.15Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Events Hub
2.2.7.16Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure AI Search
2.2.7.17Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure AI Search
2.2.7.18Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.0
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Synapse Analytics
2.2.7.19Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.1
Attributes
- Section
2.2.7: System components are configured and managed securely.
- Service
Azure Blob Storage
3.2.1: Storage of account data is kept to a minimum. 91
3.2.1.1Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Backup
3.2.1.2Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Backup
3.2.1.3Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Monitor
3.2.1.4Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Cosmos DB
3.2.1.5Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Cosmos DB
3.2.1.6Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.1
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Managed Disks
3.2.1.7Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Container Registry
3.2.1.8Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Storage
3.2.1.9Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.0
Attributes
- Section
3.2.1: Storage of account data is kept to a minimum.
- Service
Azure Storage
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. 91
3.3.1.1.1Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.1.1.2Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.1.1.3Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Monitor
3.3.1.1.4Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.1.1.5Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.1.1.6Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.1
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Managed Disks
3.3.1.1.7Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Container Registry
3.3.1.1.8Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.3.1.1.9Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.0
Attributes
- Section
3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. 91
3.3.1.3.1Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.1.3.2Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.1.3.3Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Monitor
3.3.1.3.4Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.1.3.5Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.1.3.6Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.1
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Managed Disks
3.3.1.3.7Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Container Registry
3.3.1.3.8Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.3.1.3.9Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.0
Attributes
- Section
3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.3.2: Sensitive authentication data (SAD) is not stored after authorization. 91
3.3.2.1Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.2.2Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.2.3Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Monitor
3.3.2.4Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.2.5Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.2.6Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.1
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Managed Disks
3.3.2.7Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Container Registry
3.3.2.8Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.3.2.9Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.0
Attributes
- Section
3.3.2: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.3.3: Sensitive authentication data (SAD) is not stored after authorization. 91
3.3.3.1Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.3.2Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Backup
3.3.3.3Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Monitor
3.3.3.4Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.3.5Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Cosmos DB
3.3.3.6Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.1
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Managed Disks
3.3.3.7Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Container Registry
3.3.3.8Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.3.3.9Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.0
Attributes
- Section
3.3.3: Sensitive authentication data (SAD) is not stored after authorization.
- Service
Azure Storage
3.5.1: Primary account number (PAN) is secured wherever it is stored. 3513
3.5.1.1Checks if all methods in Azure API Management API operations have caching enabled and encryption applied. The rule is NON_COMPLIANT if any API operation in an Azure API Management instance is not configured with caching or the cache is not encrypted.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure API Management
3.5.1.2Checks if an Azure Synapse Analytics workspace is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for an Azure Synapse workspace.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Synapse Analytics
3.5.1.3Checks if an Azure Backup recovery point is encrypted. The rule is NON_COMPLIANT if the recovery point is not encrypted.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Backup
3.5.1.4Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Monitor
3.5.1.5Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Monitor
3.5.1.6Checks if an Azure DevOps Pipeline project has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if encryption is disabled for any primary or secondary artifact configurations0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure DevOps
3.5.1.7Checks if the Azure DevOps project contains environment variables AZURE_CLIENT_ID and AZURE_CLIENT_SECRET. The rule is NON_COMPLIANT if the project environment variables contain plaintext credentials.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure DevOps
3.5.1.8Checks if an Azure DevOps Pipeline configured with Azure Blob Storage Logs has encryption enabled for its logs. The rule is NON_COMPLIANT if encryption is disabled in the logging configuration of an Azure DevOps Pipeline.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure DevOps
3.5.1.9Checks if Azure Cache for Redis clusters have encryption enabled. The rule is NON_COMPLIANT if an Azure Cache for Redis cluster is not encrypted.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cache
3.5.1.10Checks if storage encryption is enabled for your Azure Cosmos DB for MongoDB API clusters. The rule is NON_COMPLIANT if storage encryption is not enabled.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cosmos DB
3.5.1.11Checks if Azure Cosmos DB tables are encrypted with Azure Key Vault Managed HSM. The rule is NON_COMPLIANT if an Azure Cosmos DB table is not encrypted with Azure Key Vault. The rule is also NON_COMPLIANT if the encrypted Azure Key Vault key is not present in the specified key input parameter.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cosmos DB
3.5.1.12Checks if Azure Cosmos DB tables are encrypted and verifies their status. The rule is COMPLIANT if the status is enabled or enabling.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cosmos DB
3.5.1.13Checks if Azure Managed Disks encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.14Checks if secrets are passed as container environment variables in Azure Container Instances or Azure Kubernetes Service (AKS). The rule is NON_COMPLIANT if one or more environment variable keys match a key listed in the secretKeys parameter, excluding secrets stored in Azure Key Vault or other secure locations.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Container
3.5.1.15Checks if Azure Files is configured to encrypt the file data using Azure Key Vault Managed Keys. The rule is NON_COMPLIANT if encryption is not enabled or if the encryption key does not match the specified Key Vault Key.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Files
3.5.1.16Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Kubernetes Service
3.5.1.17Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Kubernetes Service
3.5.1.18Checks if Azure Cache for Redis replication groups have encryption-at-rest enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if encryption-at-rest is not enabled or if the Key Vault key does not match the approved Key Vault key specified.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cache
3.5.1.19Checks if Azure Cognitive Search (previously called Azure Search) services have encryption at rest enabled. The rule is NON_COMPLIANT if the encryptionWithCustomerManagedKey field is not enabled.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cognitive Search
3.5.1.20Checks if attached Azure Managed Disks are encrypted and optionally encrypted with a specified customer-managed key (CMK). The rule is NON_COMPLIANT if attached Managed Disks are unencrypted or are encrypted with a key not in the supplied parameters.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.21Checks if Azure Event Hubs or Azure Stream Analytics streams are encrypted at rest with server-side encryption. The rule is NON_COMPLIANT if encryption is not enabled for the stream.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Stream Analytics
3.5.1.22Checks if storage encryption is enabled for your Azure Cosmos DB or Azure SQL Database instances. The rule is NON_COMPLIANT if storage encryption is not enabled.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cosmos DB
3.5.1.23Checks if an Azure Cosmos DB cluster has automatic backups encrypted. The rule is NON_COMPLIANT if the Azure Cosmos DB cluster does not have automatic backups encrypted.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cosmos DB
3.5.1.24Checks if Azure Cognitive Search service has encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest option is not enabled for the Azure Cognitive Search domain.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cognitive Search
3.5.1.25Checks if an Azure SQL Database or Azure SQL Managed Instance is encrypted at rest. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance is not encrypted at rest.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Database
3.5.1.26Checks if Azure SQL Database or Azure SQL Managed Instance backups are encrypted. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance backups are not encrypted.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Database
3.5.1.27Checks if storage encryption is enabled for your Azure SQL Database or Azure SQL Managed Instance. The rule is NON_COMPLIANT if storage encryption is not enabled.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Database
3.5.1.28Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Synapse Analytics
3.5.1.29Checks if Azure Synapse Analytics (formerly Azure SQL Data Warehouse) clusters are using a specified Azure Key Vault key for encryption. The rule is COMPLIANT if encryption is enabled and the cluster is encrypted with the key provided in the keyVaultKeyId parameter. The rule is NON_COMPLIANT if the cluster is not encrypted or encrypted with another key.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Synapse Analytics
3.5.1.30Checks if your Azure Blob Storage container either has Azure Storage Service Encryption (SSE) enabled by default or that the container policy explicitly denies put-object requests without server-side encryption that uses AES-256 or Azure Key Vault. The rule is NON_COMPLIANT if your Azure Blob Storage container is not encrypted by default.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.31Checks if the Azure Blob Storage containers are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if the Azure Blob Storage container is not encrypted with an Azure Key Vault key.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.32Checks if an Azure Key Vault key is configured for an Azure Machine Learning endpoint configuration. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning endpoint configuration.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.33Checks if an Azure Key Vault key is configured for an Azure Machine Learning notebook instance. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning notebook instance.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.34Checks if all secrets in Azure Key Vault are encrypted using the Azure managed key or a customer-managed key that was created in Azure Key Vault. The rule is COMPLIANT if a secret is encrypted using a customer-managed key. This rule is NON_COMPLIANT if a secret is encrypted using the Azure managed key.1
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.35Checks if Azure Service Bus topics are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if a Service Bus topic is not encrypted with Azure Key Vault. Optionally, specify the key Azure Key Vault references or the key names for the rule to check.0
Attributes
- Section
3.5.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Service Bus
3.5.1.1: Primary account number (PAN) is secured wherever it is stored. 95
3.5.1.1.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.1.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.1.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure API Management
3.5.1.1.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Content Delivery Network
3.5.1.1.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Network
3.5.1.1.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Aplication Gateway
3.5.1.1.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure AD
3.5.1.1.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure AD
3.5.1.1.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.3: Primary account number (PAN) is secured wherever it is stored. 3117
3.5.1.3.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.3.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.3.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure API Management
3.5.1.3.4Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Backup
3.5.1.3.5Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Content Delivery Network
3.5.1.3.6Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Database Migration Service
3.5.1.3.7Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cosmos DB
3.5.1.3.8Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Managed Disks
3.5.1.3.9Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Kubernetes Service
3.5.1.3.10Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Files
3.5.1.3.11Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Files
3.5.1.3.12Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Network
3.5.1.3.13Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Aplication Gateway
3.5.1.3.14Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure HDInsight
3.5.1.3.15Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure AD
3.5.1.3.16Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure AD
3.5.1.3.17Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Key Vault
3.5.1.3.18Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Functions
3.5.1.3.19Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Cosmos DB
3.5.1.3.20Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Database
3.5.1.3.21Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Database
3.5.1.3.22Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Synapse Analytics
3.5.1.3.23Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Blob Storage
3.5.1.3.24Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.3.25Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.3.26Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.3.27Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.3.28Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.3.29Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Storage
3.5.1.3.30Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Machine Learning
3.5.1.3.31Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.0
Attributes
- Section
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- Service
Azure Automations
3.6.1: Cryptographic keys used to protect stored account data are secured. 95
3.6.1.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure API Management
3.6.1.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Content Delivery Network
3.6.1.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Network
3.6.1.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Aplication Gateway
3.6.1.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.6.1: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.2: Cryptographic keys used to protect stored account data are secured. 95
3.6.1.2.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.2.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.2.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure API Management
3.6.1.2.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Content Delivery Network
3.6.1.2.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Network
3.6.1.2.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Aplication Gateway
3.6.1.2.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.2.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.2.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.3: Cryptographic keys used to protect stored account data are secured. 95
3.6.1.3.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.3.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.3.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure API Management
3.6.1.3.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Content Delivery Network
3.6.1.3.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Network
3.6.1.3.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Aplication Gateway
3.6.1.3.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.3.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.3.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.4: Cryptographic keys used to protect stored account data are secured. 95
3.6.1.4.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.4.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.6.1.4.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure API Management
3.6.1.4.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Content Delivery Network
3.6.1.4.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Network
3.6.1.4.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Aplication Gateway
3.6.1.4.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.4.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure AD
3.6.1.4.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- Service
Azure Key Vault
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 105
3.7.1.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.1.2Checks if RSA certificates managed by Azure Key Vault have a key length of at least 2048 bits. The rule is NON_COMPLIANT if the minimum key length is less than 2048 bits.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.1.3Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.1.4Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure API Management
3.7.1.5Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Content Delivery Network
3.7.1.6Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Network
3.7.1.7Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Aplication Gateway
3.7.1.8Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.1.9Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.1.10Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 95
3.7.2.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.2.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.2.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure API Management
3.7.2.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Content Delivery Network
3.7.2.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Network
3.7.2.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Aplication Gateway
3.7.2.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.2.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.2.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 106
3.7.4.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.4.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.4.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure API Management
3.7.4.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Content Delivery Network
3.7.4.5Checks if automatic key rotation is enabled for each key and matches the key ID of the customer-managed key in Azure Key Vault. The rule is NON_COMPLIANT if the Azure Policy assignment does not enforce key rotation or if the necessary permissions to manage the key rotation settings are missing.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.4.6Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Network
3.7.4.7Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Aplication Gateway
3.7.4.8Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.4.9Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.4.10Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 22
3.7.5.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.5.2Checks if automatic key rotation is enabled for each key and matches the key ID of the customer-managed key in Azure Key Vault. The rule is NON_COMPLIANT if the Azure Policy assignment does not enforce key rotation or if the necessary permissions to manage the key rotation settings are missing.1
Attributes
- Section
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 95
3.7.6.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.6.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.6.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure API Management
3.7.6.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Content Delivery Network
3.7.6.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Network
3.7.6.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Aplication Gateway
3.7.6.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.6.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.6.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. 95
3.7.7.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.7.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
3.7.7.3Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure API Management
3.7.7.4Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Content Delivery Network
3.7.7.5Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Network
3.7.7.6Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Aplication Gateway
3.7.7.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.7.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure AD
3.7.7.9Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- Service
Azure Key Vault
4.2.1: PAN is protected with strong cryptography during transmission. 198
4.2.1.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Network
4.2.1.2Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure CDN
4.2.1.3Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure CDN
4.2.1.4Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure CDN
4.2.1.5Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Cosmos DB
4.2.1.6Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Database Migration Service
4.2.1.7Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Database Migration Service
4.2.1.8Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Cache
4.2.1.9Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AI Search
4.2.1.10Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Aplication Gateway
4.2.1.11Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Load Balancer
4.2.1.12Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Network
4.2.1.13Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Network
4.2.1.14Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure HDInsight
4.2.1.15Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Events Hub
4.2.1.16Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AI Search
4.2.1.17Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AI Search
4.2.1.18Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.0
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Synapse Analytics
4.2.1.19Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.1
Attributes
- Section
4.2.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Blob Storage
4.2.1.1: PAN is protected with strong cryptography during transmission. 2712
4.2.1.1.1Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Key Vault
4.2.1.1.2Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Key Vault
4.2.1.1.3Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Network
4.2.1.1.4Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure API Management
4.2.1.1.5Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Content Delivery Network
4.2.1.1.6Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure CDN
4.2.1.1.7Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure CDN
4.2.1.1.8Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure CDN
4.2.1.1.9Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Cosmos DB
4.2.1.1.10Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Database Migration Service
4.2.1.1.11Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Database Migration Service
4.2.1.1.12Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Cache
4.2.1.1.13Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AI Search
4.2.1.1.14Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Network
4.2.1.1.15Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Aplication Gateway
4.2.1.1.16Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Load Balancer
4.2.1.1.17Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Network
4.2.1.1.18Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Network
4.2.1.1.19Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure HDInsight
4.2.1.1.20Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AD
4.2.1.1.21Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AD
4.2.1.1.22Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Key Vault
4.2.1.1.23Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Events Hub
4.2.1.1.24Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AI Search
4.2.1.1.25Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure AI Search
4.2.1.1.26Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.0
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Synapse Analytics
4.2.1.1.27Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.1
Attributes
- Section
4.2.1.1: PAN is protected with strong cryptography during transmission.
- Service
Azure Blob Storage
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. 3616
5.3.4.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure API Management
5.3.4.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure API Management
5.3.4.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure API Management
5.3.4.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure API Management
5.3.4.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Load Balances
5.3.4.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Front Door
5.3.4.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
5.3.4.8Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
5.3.4.9For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
5.3.4.10Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure DevOps
5.3.4.11Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
5.3.4.12Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
5.3.4.13Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Cosmos DB
5.3.4.14Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure VPN Gateway
5.3.4.15Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Container Instances
5.3.4.16Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Kubernetes Service
5.3.4.17Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is COMPLIANT if logging is enabled for an Azure Cognitive Search instance. This rule is NON_COMPLIANT if logging is not configured.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Cognitive Search
5.3.4.18Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure App
5.3.4.19Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Load Balancer
5.3.4.20Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Service Bus
5.3.4.21Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Service Bus
5.3.4.22For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
5.3.4.23Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azrure Cosmos DB
5.3.4.24Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Network
5.3.4.25Checks if Azure Cognitive Search services have audit logging enabled. The rule is NON_COMPLIANT if an Azure Cognitive Search service does not have audit logging enabled.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Cognitive Search
5.3.4.26Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not configured.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Cognitive Search
5.3.4.27Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Database
5.3.4.28Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure SQL Database
5.3.4.29Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Synapse Analytics
5.3.4.30Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Synapse Analytics
5.3.4.31Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure DNS
5.3.4.32Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Storage
5.3.4.33Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Logic Apps
5.3.4.34Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Virtual Network
5.3.4.35Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
5.3.4.36Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if logging is not enabled.0
Attributes
- Section
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
- Service
Azure Monitor
6.3.3: Security vulnerabilities are identified and addressed. 112
6.3.3.1Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Virtual Machine
6.3.3.2Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Update Management
6.3.3.3Checks if Azure Container Instances (ACI) are set to the latest platform version. The rule is NON_COMPLIANT if the platform version for the container instance is not set to the latest available version.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Container Instances
6.3.3.4Checks if an Azure Kubernetes Service (AKS) cluster is running the oldest supported version. The rule is NON_COMPLIANT if an AKS cluster is running an outdated version that is no longer supported (equal to the parameter oldestVersionSupported).0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Kubernetes Service
6.3.3.5Checks if an Azure Kubernetes Service (AKS) cluster is running a supported Kubernetes version. This rule is NON_COMPLIANT if an AKS cluster is running an unsupported version (less than the parameter oldestVersionSupported).1
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Kubernetes Service
6.3.3.6Checks if Azure Cache for Redis clusters have auto minor version upgrades enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis cluster if AutoMinorVersionUpgrade is not set to true.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Cache
6.3.3.7Checks if managed platform updates in an Azure App Service environment are enabled. The rule is COMPLIANT if the value for ManagedActionsEnabled is set to true. The rule is NON_COMPLIANT if the value for ManagedActionsEnabled is set to false, or if a parameter is provided and its value does not match the existing configurations.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure App
6.3.3.8Checks if the Azure Function App settings for runtime, role, timeout, and memory size match the expected values. The rule ignores functions with the Container package type and functions with runtime set to OS-only Runtime. The rule is NON_COMPLIANT if the Function App settings do not match the expected values.1
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Function
6.3.3.9Checks if Azure Cognitive Search service version updates are available but not installed. The rule is NON_COMPLIANT for an Azure Cognitive Search instance if the latest software updates are not installed.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Cognitive Search
6.3.3.10Checks if Azure SQL Database instances are configured for automatic minor version upgrades. The rule is NON_COMPLIANT if the value of autoMinorVersionUpgrade is false.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Database
6.3.3.11Checks if Azure Synapse Analytics (formerly Azure SQL Data Warehouse) clusters have the specified maintenance settings. The rule is NON_COMPLIANT if automatic upgrades to the major version are disabled.0
Attributes
- Section
6.3.3: Security vulnerabilities are identified and addressed.
- Service
Azure Synapse
6.4.1: Public-facing web applications are protected against attacks. 140
6.4.1.1Checks if Azure Web Application Firewall (WAF) is enabled on Azure Application Gateways. The rule is NON_COMPLIANT if waf.enabled is set to false.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.2Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure API Management
6.4.1.3Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure API Management
6.4.1.4Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Front Door
6.4.1.5Checks if the Web Application Firewall (WAF) policy is associated with an Azure Application Gateway, Azure API Management, or Azure Front Door. The rule is NON_COMPLIANT if the specified WAF policy is not associated with the relevant resource.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.6Checks if the rule groups are associated with the Web Application Firewall (WAF) policy in the correct priority order. The correct priority is determined by the rank of the rule groups specified in the ruleGroups parameter. When Azure Firewall Manager creates this rule, it assigns the highest priority as 0, followed by 1, 2, and so on. The Firewall Manager policy owner specifies the ruleGroups rank in the policy and can optionally enable remediation.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.7Checks if Azure Web Application Firewall (WAF) v2 rule groups contain rules. The rule is NON_COMPLIANT if there are no rules present in a WAF v2 rule group.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.8Checks if an Azure Web Application Firewall (WAF) v2 Web ACL contains any WAF rules or WAF rule groups. The rule is NON_COMPLIANT if a Web ACL does not contain any WAF rules or WAF rule groups.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.9Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.10Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.11Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.12Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.13Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.1.14Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
6.4.1: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2: Public-facing web applications are protected against attacks. 140
6.4.2.1Checks if Azure Web Application Firewall (WAF) is enabled on Azure Application Gateways. The rule is NON_COMPLIANT if waf.enabled is set to false.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.2Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure API Management
6.4.2.3Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure API Management
6.4.2.4Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Front Door
6.4.2.5Checks if the Web Application Firewall (WAF) policy is associated with an Azure Application Gateway, Azure API Management, or Azure Front Door. The rule is NON_COMPLIANT if the specified WAF policy is not associated with the relevant resource.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.6Checks if the rule groups are associated with the Web Application Firewall (WAF) policy in the correct priority order. The correct priority is determined by the rank of the rule groups specified in the ruleGroups parameter. When Azure Firewall Manager creates this rule, it assigns the highest priority as 0, followed by 1, 2, and so on. The Firewall Manager policy owner specifies the ruleGroups rank in the policy and can optionally enable remediation.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.7Checks if Azure Web Application Firewall (WAF) v2 rule groups contain rules. The rule is NON_COMPLIANT if there are no rules present in a WAF v2 rule group.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.8Checks if an Azure Web Application Firewall (WAF) v2 Web ACL contains any WAF rules or WAF rule groups. The rule is NON_COMPLIANT if a Web ACL does not contain any WAF rules or WAF rule groups.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.9Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.10Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.11Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.12Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.13Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.4.2.14Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
6.4.2: Public-facing web applications are protected against attacks.
- Service
Azure Network
6.5.5: Changes to all system components are managed securely. 20
6.5.5.1Checks if the deployment group for Azure Functions Compute Platform is not using the default deployment configuration. The rule is NON_COMPLIANT if the deployment group is using the deployment configuration CodeDeployDefault.LambdaAllAtOnce.0
Attributes
- Section
6.5.5: Changes to all system components are managed securely.
- Service
Azure Functions
6.5.5.2Checks if the first deployment stage of Azure DevOps Pipelines performs more than one deployment. Optionally checks if each of the subsequent remaining stages deploy to more than the specified number of deployments (deploymentLimit).0
Attributes
- Section
6.5.5: Changes to all system components are managed securely.
- Service
Azure DevOps
6.5.6: Changes to all system components are managed securely. 20
6.5.6.1Checks if the deployment group for Azure Functions Compute Platform is not using the default deployment configuration. The rule is NON_COMPLIANT if the deployment group is using the deployment configuration CodeDeployDefault.LambdaAllAtOnce.0
Attributes
- Section
6.5.6: Changes to all system components are managed securely.
- Service
Azure Functions
6.5.6.2Checks if the first deployment stage of Azure DevOps Pipelines performs more than one deployment. Optionally checks if each of the subsequent remaining stages deploy to more than the specified number of deployments (deploymentLimit).0
Attributes
- Section
6.5.6: Changes to all system components are managed securely.
- Service
Azure DevOps
7.2.1: Access to system components and data is appropriately defined and assigned. 2913
7.2.1.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Backup
7.2.1.3Checks if an Azure DevOps pipeline environment has privileged mode enabled. The rule is NON_COMPLIANT for a pipeline if privilegedMode is set to true.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure DevOps
7.2.1.4Checks if custom Azure Event Grid schema registries have a resource policy attached. The rule is NON_COMPLIANT for custom schema registries without a resource policy attached.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Event Grid
7.2.1.5Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure VIrtual Machine
7.2.1.6Checks if the privileged mode in the container definition of Azure Kubernetes Service (AKS) pod specifications is set to true. The rule is NON_COMPLIANT if the privileged parameter is true.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.1.7Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.1.8Checks if Azure Kubernetes Service (AKS) pods specify a user for container execution. The rule is NON_COMPLIANT if the user parameter is not present or set to root.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.1.9Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.10Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.11Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.12Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.13Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.14Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.15Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.16Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.17Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.1.18Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Active Directory
7.2.1.19Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Active Directory
7.2.1.20Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.1.21Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Cognitive Search
7.2.1.22Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.1.23Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.1.24Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.1.25Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.1.26Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.1.27Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.1.28Checks if the Azure Machine Learning Compute Instance has administrator access enabled. The rule is NON_COMPLIANT if the administrator access setting is set to Enabled for an Azure Machine Learning Compute Instance.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Machine Learning
7.2.1.29Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
7.2.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2: Access to system components and data is appropriately defined and assigned. 2913
7.2.2.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Backup
7.2.2.3Checks if an Azure DevOps pipeline environment has privileged mode enabled. The rule is NON_COMPLIANT for a pipeline if privilegedMode is set to true.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure DevOps
7.2.2.4Checks if custom Azure Event Grid schema registries have a resource policy attached. The rule is NON_COMPLIANT for custom schema registries without a resource policy attached.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Event Grid
7.2.2.5Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure VIrtual Machine
7.2.2.6Checks if the privileged mode in the container definition of Azure Kubernetes Service (AKS) pod specifications is set to true. The rule is NON_COMPLIANT if the privileged parameter is true.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.2.7Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.2.8Checks if Azure Kubernetes Service (AKS) pods specify a user for container execution. The rule is NON_COMPLIANT if the user parameter is not present or set to root.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.2.9Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.10Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.11Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.12Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.13Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.14Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.15Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.16Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.17Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.2.18Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Active Directory
7.2.2.19Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Active Directory
7.2.2.20Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.2.21Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Cognitive Search
7.2.2.22Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.2.23Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.2.24Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.2.25Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.2.26Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.2.27Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.2.28Checks if the Azure Machine Learning Compute Instance has administrator access enabled. The rule is NON_COMPLIANT if the administrator access setting is set to Enabled for an Azure Machine Learning Compute Instance.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure Machine Learning
7.2.2.29Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
7.2.2: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.3: Access to system components and data is appropriately defined and assigned. 92
7.2.3.1Checks if an Azure DevOps pipeline environment has privileged mode enabled. The rule is NON_COMPLIANT for a pipeline if privilegedMode is set to true.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure DevOps
7.2.3.2Checks if custom Azure Event Grid schema registries have a resource policy attached. The rule is NON_COMPLIANT for custom schema registries without a resource policy attached.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure Event Grid
7.2.3.3Checks if the privileged mode in the container definition of Azure Kubernetes Service (AKS) pod specifications is set to true. The rule is NON_COMPLIANT if the privileged parameter is true.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.3.4Checks if Azure Kubernetes Service (AKS) pods specify a user for container execution. The rule is NON_COMPLIANT if the user parameter is not present or set to root.1
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure Kubernetes Service
7.2.3.5Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.3.6Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.3.7Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.3.8Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.3.9Checks if the Azure Machine Learning Compute Instance has administrator access enabled. The rule is NON_COMPLIANT if the administrator access setting is set to Enabled for an Azure Machine Learning Compute Instance.0
Attributes
- Section
7.2.3: Access to system components and data is appropriately defined and assigned.
- Service
Azure Machine Learning
7.2.4: Access to system components and data is appropriately defined and assigned. 31
7.2.4.1Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
7.2.4: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.4.2Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.0
Attributes
- Section
7.2.4: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.4.3Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.1
Attributes
- Section
7.2.4: Access to system components and data is appropriately defined and assigned.
- Service
Azure Key Vault
7.2.5: Access to system components and data is appropriately defined and assigned. 2212
7.2.5.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Backup
7.2.5.3Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure VIrtual Machine
7.2.5.4Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Backup
7.2.5.5Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.6Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.7Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.8Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.9Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.10Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.11Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.12Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.13Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Active Directory
7.2.5.14Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.5.15Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Cognitive Search
7.2.5.16Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.5.17Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Database
7.2.5.18Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.5.19Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.5.20Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.5.21Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.5.22Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
7.2.5: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.1: Access to system components and data is appropriately defined and assigned. 31
7.2.5.1.1Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
7.2.5.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.1.2Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.0
Attributes
- Section
7.2.5.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure AD
7.2.5.1.3Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.1
Attributes
- Section
7.2.5.1: Access to system components and data is appropriately defined and assigned.
- Service
Azure Key Vault
7.2.6: Access to system components and data is appropriately defined and assigned. 53
7.2.6.1Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Azure Backup
7.2.6.2Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Azure Active Directory
7.2.6.3Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Azure Cognitive Search
7.2.6.4Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.2.6.5Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
7.2.6: Access to system components and data is appropriately defined and assigned.
- Service
Azure Storage
7.3.1: Access to system components and data is managed via an access control system(s). 2212
7.3.1.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Backup
7.3.1.3Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure VIrtual Machine
7.3.1.4Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Backup
7.3.1.5Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.6Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.7Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.8Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.9Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.10Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.11Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.12Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.1.13Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Active Directory
7.3.1.14Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.1.15Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Cognitive Search
7.3.1.16Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.1.17Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.1.18Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.1.19Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.1.20Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.1.21Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.1.22Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
7.3.1: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2: Access to system components and data is managed via an access control system(s). 2212
7.3.2.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Backup
7.3.2.3Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure VIrtual Machine
7.3.2.4Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Backup
7.3.2.5Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.6Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.7Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.8Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.9Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.10Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.11Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.12Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.2.13Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Active Directory
7.3.2.14Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.2.15Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Cognitive Search
7.3.2.16Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.2.17Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.2.18Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.2.19Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.2.20Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.2.21Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.2.22Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
7.3.2: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3: Access to system components and data is managed via an access control system(s). 2212
7.3.3.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Backup
7.3.3.3Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure VIrtual Machine
7.3.3.4Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Backup
7.3.3.5Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.6Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.7Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.8Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.9Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.10Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.11Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.12Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.13Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
7.3.3.14Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.3.15Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Cognitive Search
7.3.3.16Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.3.17Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Database
7.3.3.18Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.3.19Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.3.20Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.3.21Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure Storage
7.3.3.22Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
7.3.3: Access to system components and data is managed via an access control system(s).
- Service
Azure AD
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 50
8.2.1.1Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Virtual Machines
8.2.1.2Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.1.3Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.1.4Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.1.5Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Active Directory
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 114
8.2.2.1Checks if the Azure DevOps project contains environment variables AZURE_CLIENT_ID and AZURE_CLIENT_SECRET. The rule is NON_COMPLIANT if the project environment variables contain plaintext credentials.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure DevOps
8.2.2.2Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Virtual Machines
8.2.2.3Checks if secrets are passed as container environment variables in Azure Container Instances or Azure Kubernetes Service (AKS). The rule is NON_COMPLIANT if one or more environment variable keys match a key listed in the secretKeys parameter, excluding secrets stored in Azure Key Vault or other secure locations.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Container
8.2.2.4Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.2.5Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.2.6Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.2.7Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Active Directory
8.2.2.8Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.1
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Key Vault
8.2.2.9Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.1
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Key Vault
8.2.2.10Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.1
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Key Vault
8.2.2.11Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.1
Attributes
- Section
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Key Vault
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 50
8.2.4.1Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Virtual Machines
8.2.4.2Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.4.3Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.4.4Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.4.5Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Active Directory
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 50
8.2.5.1Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Virtual Machines
8.2.5.2Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.5.3Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.5.4Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.5.5Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Active Directory
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 31
8.2.6.1Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.6.2Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.0
Attributes
- Section
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.6.3Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.1
Attributes
- Section
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Key Vault
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 2212
8.2.7.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Backup
8.2.7.3Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure VIrtual Machine
8.2.7.4Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Kubernetes Service
8.2.7.5Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.6Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.7Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.8Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.9Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.10Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.11Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.12Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.7.13Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Active Directory
8.2.7.14Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Database
8.2.7.15Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Cognitive Search
8.2.7.16Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Database
8.2.7.17Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Database
8.2.7.18Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.7.19Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.7.20Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.7.21Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.7.22Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. 2412
8.2.8.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.2Checks whether only Azure Instance Metadata Service (IMDS) v2 is enabled. The rule is NON_COMPLIANT if the Metadata version is not included in the launch configuration or if both IMDS v1 and v2 are enabled.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Instance Metadata Service
8.2.8.3Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Backup
8.2.8.4Checks if your Azure Virtual Machines metadata service is configured with Instance Metadata Service Version 2 (IMDSv2). The rule is NON_COMPLIANT if the HttpTokens setting is set to optional.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure VIrtual Machine
8.2.8.5Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure VIrtual Machine
8.2.8.6Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Kubernetes Service
8.2.8.7Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.8Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.9Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.10Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.11Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.12Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.13Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.14Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.2.8.15Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Active Directory
8.2.8.16Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Database
8.2.8.17Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Cognitive Search
8.2.8.18Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Database
8.2.8.19Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Database
8.2.8.20Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.8.21Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.8.22Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.8.23Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure Storage
8.2.8.24Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
- Service
Azure AD
8.3.2: Strong authentication for users and administrators is established and managed. 5421
8.3.2.1Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Network
8.3.2.2Checks if all methods in Azure API Management API operations have caching enabled and encryption applied. The rule is NON_COMPLIANT if any API operation in an Azure API Management instance is not configured with caching or the cache is not encrypted.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure API Management
8.3.2.3Checks if an Azure Synapse Analytics workspace is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for an Azure Synapse workspace.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Synapse Analytics
8.3.2.4Checks if a Azure Backup recovery point is encrypted. The rule is NON_COMPLIANT if the recovery point is not encrypted using Azure Storage Service Encryption (SSE) or Customer-Managed Keys (CMK) in Azure Key Vault.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Backup
8.3.2.5Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure CDN
8.3.2.6Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure CDN
8.3.2.7Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure CDN
8.3.2.8Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Monitor
8.3.2.9Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Monitor
8.3.2.10Checks if an Azure DevOps Pipeline project has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if encryption is disabled for any primary or secondary artifact configurations0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure DevOps
8.3.2.11Checks if the Azure DevOps project contains environment variables AZURE_CLIENT_ID and AZURE_CLIENT_SECRET. The rule is NON_COMPLIANT if the project environment variables contain plaintext credentials.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure DevOps
8.3.2.12Checks if an Azure DevOps Pipeline configured with Azure Blob Storage Logs has encryption enabled for its logs. The rule is NON_COMPLIANT if encryption is disabled in the logging configuration of an Azure DevOps Pipeline.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure DevOps
8.3.2.13Checks if Azure Cache for Redis clusters have encryption enabled. The rule is NON_COMPLIANT if an Azure Cache for Redis cluster is not encrypted.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cache
8.3.2.14Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cosmos DB
8.3.2.15Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Database Migration Service
8.3.2.16Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Database Migration Service
8.3.2.17Checks if storage encryption is enabled for your Azure Cosmos DB for MongoDB API clusters. The rule is NON_COMPLIANT if storage encryption is not enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cosmos DB
8.3.2.18Checks if Azure Cosmos DB tables are encrypted with Azure Key Vault Managed HSM. The rule is NON_COMPLIANT if an Azure Cosmos DB table is not encrypted with Azure Key Vault. The rule is also NON_COMPLIANT if the encrypted Azure Key Vault key is not present in the specified key input parameter.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cosmos DB
8.3.2.19Checks if Azure Cosmos DB tables are encrypted and verifies their status. The rule is COMPLIANT if the status is enabled or enabling.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cosmos DB
8.3.2.20Checks if Azure Managed Disks encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.2.21Checks if secrets are passed as container environment variables in Azure Container Instances or Azure Kubernetes Service (AKS). The rule is NON_COMPLIANT if one or more environment variable keys match a key listed in the secretKeys parameter, excluding secrets stored in Azure Key Vault or other secure locations.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Container
8.3.2.22Checks if Azure Files is configured to encrypt the file data using Azure Key Vault Managed Keys. The rule is NON_COMPLIANT if encryption is not enabled or if the encryption key does not match the specified Key Vault Key.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Files
8.3.2.23Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Kubernetes Service
8.3.2.24Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Kubernetes Service
8.3.2.25Checks if Azure Cache for Redis replication groups have encryption-at-rest enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if encryption-at-rest is not enabled or if the Key Vault key does not match the approved Key Vault key specified.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cache
8.3.2.26Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cache
8.3.2.27Checks if Azure Cognitive Search (previously called Azure Search) services have encryption at rest enabled. The rule is NON_COMPLIANT if the encryptionWithCustomerManagedKey field is not enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cognitive Search
8.3.2.28Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure AI Search
8.3.2.29Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Aplication Gateway
8.3.2.30Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Load Balancer
8.3.2.31Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Network
8.3.2.32Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Network
8.3.2.33Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure HDInsight
8.3.2.34Checks if attached Azure Managed Disks are encrypted and optionally encrypted with a specified customer-managed key (CMK). The rule is NON_COMPLIANT if attached Managed Disks are unencrypted or are encrypted with a key not in the supplied parameters.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.2.35Checks if Azure Event Hubs or Azure Stream Analytics streams are encrypted at rest with server-side encryption. The rule is NON_COMPLIANT if encryption is not enabled for the stream.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Stream Analytics
8.3.2.36Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Events Hub
8.3.2.37Checks if storage encryption is enabled for your Azure Cosmos DB or Azure SQL Database instances. The rule is NON_COMPLIANT if storage encryption is not enabled.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cosmos DB
8.3.2.38Checks if an Azure Cosmos DB cluster has automatic backups encrypted. The rule is NON_COMPLIANT if the Azure Cosmos DB cluster does not have automatic backups encrypted.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cosmos DB
8.3.2.39Checks if Azure Cognitive Search service has encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest option is not enabled for the Azure Cognitive Search domain.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Cognitive Search
8.3.2.40Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure AI Search
8.3.2.41Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure AI Search
8.3.2.42Checks if an Azure SQL Database or Azure SQL Managed Instance is encrypted at rest. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance is not encrypted at rest.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Database
8.3.2.43Checks if Azure SQL Database or Azure SQL Managed Instance backups are encrypted. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance backups are not encrypted.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Database
8.3.2.44Checks if storage encryption is enabled for your Azure SQL Database or Azure SQL Managed Instance. The rule is NON_COMPLIANT if storage encryption is not enabled.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Database
8.3.2.45Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Synapse Analytics
8.3.2.46Checks if Azure Synapse Analytics (formerly Azure SQL Data Warehouse) clusters are using a specified Azure Key Vault key for encryption. The rule is COMPLIANT if encryption is enabled and the cluster is encrypted with the key provided in the keyVaultKeyId parameter. The rule is NON_COMPLIANT if the cluster is not encrypted or encrypted with another key.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Synapse Analytics
8.3.2.47Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Synapse Analytics
8.3.2.48Checks if your Azure Blob Storage container either has Azure Storage Service Encryption (SSE) enabled by default or that the container policy explicitly denies put-object requests without server-side encryption that uses AES-256 or Azure Key Vault. The rule is NON_COMPLIANT if your Azure Blob Storage container is not encrypted by default.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.2.49Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.2.50Checks if the Azure Blob Storage containers are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if the Azure Blob Storage container is not encrypted with an Azure Key Vault key.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.2.51Checks if an Azure Key Vault key is configured for an Azure Machine Learning endpoint configuration. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning endpoint configuration.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.2.52Checks if an Azure Key Vault key is configured for an Azure Machine Learning notebook instance. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning notebook instance.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.2.53Checks if all secrets in Azure Key Vault are encrypted using the Azure managed key or a customer-managed key that was created in Azure Key Vault. The rule is COMPLIANT if a secret is encrypted using a customer-managed key. This rule is NON_COMPLIANT if a secret is encrypted using the Azure managed key.1
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.2.54Checks if Azure Service Bus topics are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if a Service Bus topic is not encrypted with Azure Key Vault. Optionally, specify the key Azure Key Vault references or the key names for the rule to check.0
Attributes
- Section
8.3.2: Strong authentication for users and administrators is established and managed.
- Service
Azure Service Bus
8.3.4: Strong authentication for users and administrators is established and managed. 2212
8.3.4.1Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.2Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Backup
8.3.4.3Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure VIrtual Machine
8.3.4.4Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Kubernetes Service
8.3.4.5Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.6Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.7Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.8Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.9Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.10Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes "Actions": ["*"] over "AssignableScopes": ["/"].0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.11Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.12Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.4.13Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Active Directory
8.3.4.14Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Database
8.3.4.15Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Cognitive Search
8.3.4.16Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Database
8.3.4.17Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Database
8.3.4.18Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.4.19Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.4.20Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.4.21Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure Storage
8.3.4.22Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.0
Attributes
- Section
8.3.4: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.5: Strong authentication for users and administrators is established and managed. 44
8.3.5.1Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.1
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.5.2Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.1
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.5.3Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.1
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.5.4Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.1
Attributes
- Section
8.3.5: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.6: Strong authentication for users and administrators is established and managed. 10
8.3.6.1Checks if the Azure Active Directory (Azure AD) password policy for users meets the specified requirements indicated in the parameters. The rule is NON_COMPLIANT if the account password policy does not meet the specified requirements.0
Attributes
- Section
8.3.6: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.7: Strong authentication for users and administrators is established and managed. 44
8.3.7.1Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.1
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.7.2Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.1
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.7.3Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.1
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.7.4Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.1
Attributes
- Section
8.3.7: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.9: Strong authentication for users and administrators is established and managed. 44
8.3.9.1Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.1
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.9.2Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.1
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.9.3Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.1
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.9.4Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.1
Attributes
- Section
8.3.9: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.10.1: Strong authentication for users and administrators is established and managed. 44
8.3.10.1.1Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.1
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.10.1.2Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.1
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.10.1.3Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.1
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.10.1.4Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.1
Attributes
- Section
8.3.10.1: Strong authentication for users and administrators is established and managed.
- Service
Azure Key Vault
8.3.11: Strong authentication for users and administrators is established and managed. 50
8.3.11.1Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Azure Virtual Machines
8.3.11.2Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.11.3Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.11.4Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Azure AD
8.3.11.5Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
8.3.11: Strong authentication for users and administrators is established and managed.
- Service
Azure Active Directory
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. 55
8.4.1.1Checks if Azure Active Directory (Azure AD) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one Azure AD user.1
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.1.2Checks if Azure multi-factor authentication (MFA) is enabled for all Azure Active Directory (Azure AD) users that use a console password. The rule is COMPLIANT if MFA is enabled.1
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.1.3Checks if your Azure account is enabled to use multi-factor authentication (MFA) hardware device to sign in with global administrator credentials. The rule is NON_COMPLIANT if any virtual MFA devices are permitted for signing in with global administrator credentials.1
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.1.4Checks if the global administrator account of your Azure Active Directory (AAD) requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the global administrator account does not have multi-factor authentication (MFA) enabled.1
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.1.5Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.1
Attributes
- Section
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure Storage
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. 55
8.4.2.1Checks if Azure Active Directory (Azure AD) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one Azure AD user.1
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.2.2Checks if Azure multi-factor authentication (MFA) is enabled for all Azure Active Directory (Azure AD) users that use a console password. The rule is COMPLIANT if MFA is enabled.1
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.2.3Checks if your Azure account is enabled to use multi-factor authentication (MFA) hardware device to sign in with global administrator credentials. The rule is NON_COMPLIANT if any virtual MFA devices are permitted for signing in with global administrator credentials.1
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.2.4Checks if the global administrator account of your Azure Active Directory (AAD) requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the global administrator account does not have multi-factor authentication (MFA) enabled.1
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.2.5Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.1
Attributes
- Section
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure Storage
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. 55
8.4.3.1Checks if Azure Active Directory (Azure AD) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one Azure AD user.1
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.3.2Checks if Azure multi-factor authentication (MFA) is enabled for all Azure Active Directory (Azure AD) users that use a console password. The rule is COMPLIANT if MFA is enabled.1
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.3.3Checks if your Azure account is enabled to use multi-factor authentication (MFA) hardware device to sign in with global administrator credentials. The rule is NON_COMPLIANT if any virtual MFA devices are permitted for signing in with global administrator credentials.1
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.3.4Checks if the global administrator account of your Azure Active Directory (AAD) requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the global administrator account does not have multi-factor authentication (MFA) enabled.1
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure AD
8.4.3.5Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.1
Attributes
- Section
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
- Service
Azure Storage
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. 54
8.6.3.1Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.1
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Azure AD
8.6.3.2Checks if the Azure Active Directory (Azure AD) password policy for users meets the specified requirements indicated in the parameters. The rule is NON_COMPLIANT if the account password policy does not meet the specified requirements.0
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Azure AD
8.6.3.3Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.1
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Azure Key Vault
8.6.3.4Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.1
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Azure Key Vault
8.6.3.5Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.1
Attributes
- Section
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
- Service
Azure Key Vault
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.1.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3719
10.2.1.1.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.1.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.1.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.1.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.1.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.1.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.1.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.1.8Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.1.9Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.1.10For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.1.11Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.1.12Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.1.13Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.1.14Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.1.15Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Machines
10.2.1.1.16Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.1.17Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.1.18Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.1.19Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.1.20Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.1.21Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.1.22For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.1.23Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.1.24Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.1.25Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.1.26Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.1.27Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.1.28Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.1.29Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.1.30Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.1.31Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Security Center
10.2.1.1.32Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.1.33Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.1.34Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.1.35Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.1.36Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.1.37Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.1.2.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.2.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.2.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.2.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.2.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.2.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.2.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.2.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.2.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.2.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.2.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.2.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.2.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.2.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.2.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.2.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.2.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.2.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.2.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.2.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.2.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.2.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.2.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.2.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.2.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.2.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.2.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.2.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.2.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.2.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.2.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.1.3.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.3.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.3.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.3.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.3.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.3.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.3.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.3.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.3.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.3.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.3.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.3.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.3.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.3.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.3.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.3.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.3.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.3.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.3.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.3.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.3.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.3.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.3.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.3.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.3.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.3.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.3.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.3.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.3.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.3.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.3.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.1.4.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.4.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.4.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.4.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.4.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.4.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.4.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.4.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.4.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.4.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.4.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.4.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.4.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.4.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.4.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.4.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.4.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.4.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.4.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.4.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.4.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.4.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.4.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.4.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.4.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.4.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.4.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.4.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.4.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.4.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.4.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.1.5.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.5.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.5.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.5.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.5.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.5.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.5.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.5.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.5.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.5.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.5.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.5.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.5.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.5.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.5.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.5.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.5.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.5.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.5.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.5.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.5.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.5.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.5.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.5.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.5.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.5.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.5.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.5.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.5.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.5.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.5.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.1.6.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.6.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.6.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.6.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.6.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.6.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.6.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.6.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.6.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.6.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.6.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.6.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.6.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.6.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.6.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.6.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.6.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.6.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.6.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.6.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.6.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.6.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.6.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.6.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.6.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.6.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.6.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.6.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.6.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.6.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.6.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.1.7.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.7.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.7.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.7.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.1.7.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.1.7.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.1.7.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.7.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.7.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.1.7.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.7.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.1.7.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.1.7.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.1.7.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.1.7.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.1.7.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.1.7.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.7.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.1.7.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.7.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.1.7.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.1.7.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.1.7.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.1.7.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.7.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.1.7.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.1.7.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.1.7.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.1.7.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.1.7.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.1.7.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 3115
10.2.2.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.2.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.2.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.2.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure API Management
10.2.2.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balances
10.2.2.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Front Door
10.2.2.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.2.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.2.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DevOps
10.2.2.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.2.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Cosmos DB
10.2.2.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure VPN Gateway
10.2.2.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Container Instances
10.2.2.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Kubernetes Service
10.2.2.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure App
10.2.2.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Load Balancer
10.2.2.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.2.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Service Bus
10.2.2.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.2.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azrure Cosmos DB
10.2.2.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.2.2.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Database
10.2.2.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure SQL Database
10.2.2.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.2.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Synapse Analytics
10.2.2.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure DNS
10.2.2.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Storage
10.2.2.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Logic Apps
10.2.2.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Virtual Network
10.2.2.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Monitor
10.2.2.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- Service
Azure Network
10.3.1: Audit logs are protected from destruction and unauthorized modifications. 3114
10.3.1.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure API Management
10.3.1.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure API Management
10.3.1.3Checks if Azure Application Insights tracing is enabled on Azure API Management REST APIs. The rule is COMPLIANT if Application Insights tracing is enabled and NON_COMPLIANT otherwise.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Application Insights
10.3.1.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure API Management
10.3.1.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Load Balances
10.3.1.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Front Door
10.3.1.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.1.8For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.1.9Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure DevOps
10.3.1.10Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.1.11Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Cosmos DB
10.3.1.12Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure VPN Gateway
10.3.1.13Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Container Instances
10.3.1.14Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Kubernetes Service
10.3.1.15Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure App
10.3.1.16Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Load Balancer
10.3.1.17Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Service Bus
10.3.1.18Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Service Bus
10.3.1.19For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.1.20Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azrure Cosmos DB
10.3.1.21Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Network
10.3.1.22Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Database
10.3.1.23Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure SQL Database
10.3.1.24Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Synapse Analytics
10.3.1.25Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Synapse Analytics
10.3.1.26Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure DNS
10.3.1.27Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.1.28Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Logic Apps
10.3.1.29Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Virtual Network
10.3.1.30Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.1.31Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.0
Attributes
- Section
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Network
10.3.2: Audit logs are protected from destruction and unauthorized modifications. 2614
10.3.2.1Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Backup
10.3.2.2Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.2.3Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.2.4Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.2.5Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.2.6Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Database Migration Service
10.3.2.7Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Cosmos DB
10.3.2.8Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Managed Disks
10.3.2.9Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Kubernetes Service
10.3.2.10Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Files
10.3.2.11Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Files
10.3.2.12Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure HDInsight
10.3.2.13Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Functions
10.3.2.14Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Cosmos DB
10.3.2.15Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Database
10.3.2.16Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Database
10.3.2.17Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Synapse Analytics
10.3.2.18Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Blob Storage
10.3.2.19Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.2.20Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.2.21Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.2.22Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.2.23Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.2.24Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.2.25Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Machine Learning
10.3.2.26Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.0
Attributes
- Section
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Automations
10.3.3: Audit logs are protected from destruction and unauthorized modifications. 243
10.3.3.1Checks if Azure SQL Database clusters are protected by an automatic backup policy. The rule is NON_COMPLIANT if the Azure SQL Database cluster is not protected by an automatic backup policy.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Database
10.3.3.2Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Backup
10.3.3.3Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Backup
10.3.3.4Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.3.5Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.3.6Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.3.7Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.3.8Checks if Azure SQL Database instances have backups enabled. Optionally, the rule checks the backup retention period and the backup window.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure SQL Database
10.3.3.9Checks whether Azure Cosmos DB tables are present in Azure Backup Plans. The rule is NON_COMPLIANT if Azure Cosmos DB tables are not included in any Azure Backup Plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Cosmos DB
10.3.3.10Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Cosmos DB
10.3.3.11Checks if Azure Cosmos DB tables are protected by a backup plan. The rule is NON_COMPLIANT if the Cosmos DB Table is not covered by a backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Cosmos DB
10.3.3.12Checks if Azure Managed Disks are included in an Azure Backup policy. The rule is NON_COMPLIANT if Azure Managed Disks are not covered by a backup policy in Azure Backup.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Managed Disks
10.3.3.13Checks if Azure Managed Disks are protected by a backup policy. The rule is NON_COMPLIANT if the Azure Managed Disk is not covered by a backup policy in Azure Backup.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Managed Disks
10.3.3.14Checks if Azure Virtual Machines are protected by a backup policy. The rule is NON_COMPLIANT if the Azure Virtual Machine is not covered by a backup policy in Azure Backup.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Virtual Machines
10.3.3.15Checks if Azure Files file shares are included in an Azure Backup policy. The rule is NON_COMPLIANT if Azure Files shares are not covered by an Azure Backup policy.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Files
10.3.3.16Checks if Azure Files file shares are protected by an Azure Backup policy. The rule is NON_COMPLIANT if the Azure Files share is not covered by a backup policy.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Files
10.3.3.17Checks if Azure Cache for Redis has automatic backup enabled. The rule is NON_COMPLIANT if the backup retention period for the Redis cache is less than the required retention period.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Cache
10.3.3.18Checks if Azure Files or Azure NetApp Files are protected by a backup plan. The rule is NON_COMPLIANT if the Azure File Share or NetApp File System is not covered by a backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Files
10.3.3.19Checks if Azure Files or Azure NetApp Files are protected by a backup plan. The rule is NON_COMPLIANT if the Azure File Share or NetApp File System is not covered by a backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Files
10.3.3.20Checks if Azure SQL databases are included in an Azure Backup policy. The rule is NON_COMPLIANT if Azure SQL databases are not part of any Azure Backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure SQL Database
10.3.3.21Checks if Azure SQL Managed Instances are protected by an Azure Backup policy. The rule is NON_COMPLIANT if the Azure SQL Managed Instance is not included in an Azure Backup plan.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure SQL Database
10.3.3.22Checks if Azure Synapse Analytics dedicated SQL pools have automated snapshots enabled. The rule is NON_COMPLIANT if the retention period for automated snapshots is greater than the maximum allowed retention period, less than the minimum retention period, or set to 0.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Synapse Analytics
10.3.3.23Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.3.24Checks if Azure Blob Storage containers are protected by a backup policy. The rule is NON_COMPLIANT if the Azure Blob Storage container is not covered by a backup policy.0
Attributes
- Section
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.4: Audit logs are protected from destruction and unauthorized modifications. 93
10.3.4.1Checks if Azure Content Delivery Network (CDN) with Azure Blob Storage origin has managed identity authentication configured. The rule is NON_COMPLIANT if the Azure CDN endpoint is backed by Azure Blob Storage and does not have managed identity authentication configured, or if the origin is not a Blob Storage container.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Content Delivery Network
10.3.4.2Checks if an Azure Content Delivery Network (CDN) profile with an Azure Blob Storage origin has managed identity authentication enabled. The rule is NON_COMPLIANT for Azure CDN profiles with Blob Storage origins that do not have managed identity authentication enabled.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Content Delivery Network
10.3.4.3Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.1
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.4.4Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.4.5Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.1
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.4.6Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Monitor
10.3.4.7Checks if the Azure Blob Storage container has immutable blob storage enabled by default. The rule is NON_COMPLIANT if immutable blob storage is not enabled.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.4.8Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.3.4.9Checks if versioning is enabled for your Azure Blob Storage containers. Optionally, the rule checks if immutable storage with versioning is enabled for your containers. The rule is NON_COMPLIANT if versioning is not enabled.0
Attributes
- Section
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
- Service
Azure Storage
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. 64
10.4.1.1Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure API Management
10.4.1.2Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Monitor
10.4.1.3Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Virtual Machines
10.4.1.4Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Security Center
10.4.1.5Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Service Bus
10.4.1.6Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Network
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. 75
10.4.1.1.1Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure API Management
10.4.1.1.2Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Monitor
10.4.1.1.3Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Monitor
10.4.1.1.4Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Virtual Machines
10.4.1.1.5Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Security Center
10.4.1.1.6Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Service Bus
10.4.1.1.7Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Network
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. 75
10.4.2.1Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure API Management
10.4.2.2Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Monitor
10.4.2.3Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Monitor
10.4.2.4Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Virtual Machines
10.4.2.5Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Security Center
10.4.2.6Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Service Bus
10.4.2.7Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Network
10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity. 11
10.4.3.1Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.
- Service
Azure Monitor
10.5.1: Audit log history is retained and available for analysis. 132
10.5.1.1Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Backup
10.5.1.2Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Backup
10.5.1.3Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.1
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Monitor
10.5.1.4Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Monitor
10.5.1.5Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Cosmos DB
10.5.1.6Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Cosmos DB
10.5.1.7Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.1
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Managed Disks
10.5.1.8Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Container Registry
10.5.1.9Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is COMPLIANT if logging is enabled for an Azure Cognitive Search instance. This rule is NON_COMPLIANT if logging is not configured.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Cognitive Search
10.5.1.10Checks if Azure Cognitive Search services have audit logging enabled. The rule is NON_COMPLIANT if an Azure Cognitive Search service does not have audit logging enabled.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Cognitive Search
10.5.1.11Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not configured.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Cognitive Search
10.5.1.12Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Storage
10.5.1.13Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.0
Attributes
- Section
10.5.1: Audit log history is retained and available for analysis.
- Service
Azure Storage
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. 4222
10.6.3.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure API Management
10.6.3.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure API Management
10.6.3.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure API Management
10.6.3.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure API Management
10.6.3.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Load Balances
10.6.3.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Front Door
10.6.3.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.6.3.8Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.6.3.9Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.6.3.10For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.6.3.11Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure DevOps
10.6.3.12Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.6.3.13Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Cosmos DB
10.6.3.14Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure VPN Gateway
10.6.3.15Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Virtual Machines
10.6.3.16Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Backup
10.6.3.17Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Container Instances
10.6.3.18Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Kubernetes Service
10.6.3.19Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure App
10.6.3.20Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Load Balancer
10.6.3.21Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Active Directory
10.6.3.22Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Service Bus
10.6.3.23Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Service Bus
10.6.3.24For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.6.3.25Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azrure Cosmos DB
10.6.3.26Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Network
10.6.3.27Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Cognitive Search
10.6.3.28Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Database
10.6.3.29Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure SQL Database
10.6.3.30Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Synapse Analytics
10.6.3.31Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Synapse Analytics
10.6.3.32Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure DNS
10.6.3.33Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Storage
10.6.3.34Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Storage
10.6.3.35Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Storage
10.6.3.36Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Security Center
10.6.3.37Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Service Bus
10.6.3.38Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Logic Apps
10.6.3.39Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Virtual Network
10.6.3.40Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.6.3.41Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Network
10.6.3.42Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if logging is not enabled.0
Attributes
- Section
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
- Service
Azure Monitor
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. 85
10.7.1.1Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure API Management
10.7.1.2Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Resource Manager
10.7.1.3Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Monitor
10.7.1.4Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Monitor
10.7.1.5Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Virtual Machines
10.7.1.6Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Security Center
10.7.1.7Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Service Bus
10.7.1.8Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Network
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. 85
10.7.2.1Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure API Management
10.7.2.2Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Resource Manager
10.7.2.3Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Monitor
10.7.2.4Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Monitor
10.7.2.5Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Virtual Machines
10.7.2.6Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Security Center
10.7.2.7Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Service Bus
10.7.2.8Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- Service
Azure Network
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 31
11.3.1.1Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.0
Attributes
- Section
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Virtual Machine
11.3.1.2Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Update Management
11.3.1.3Checks if a private Azure Container Registry (ACR) repository has image scanning enabled. The rule is NON_COMPLIANT if the private Azure ACR repositorys scan frequency is not set to “scan on push” or “continuous scan.”1
Attributes
- Section
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Container Registry
11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 20
11.3.1.1.1Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.0
Attributes
- Section
11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Virtual Machine
11.3.1.1.2Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Update Management
11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 11
11.3.1.2.1Checks if a private Azure Container Registry (ACR) repository has image scanning enabled. The rule is NON_COMPLIANT if the private Azure ACR repositorys scan frequency is not set to “scan on push” or “continuous scan.”1
Attributes
- Section
11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Container Registry
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. 31
11.3.1.3.1Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.0
Attributes
- Section
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Virtual Machine
11.3.1.3.2Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.0
Attributes
- Section
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Update Management
11.3.1.3.3Checks if a private Azure Container Registry (ACR) repository has image scanning enabled. The rule is NON_COMPLIANT if the private Azure ACR repositorys scan frequency is not set to “scan on push” or “continuous scan.”1
Attributes
- Section
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
- Service
Azure Container Registry
11.5.1: Network intrusions and unexpected file changes are detected and responded to. 21
11.5.1.1Checks whether an Azure Application Gateway, Azure Front Door, Azure Load Balancer, or Azure Public IP has Azure DDoS Protection enabled. It also checks if they have a Web Application Firewall (WAF) policy associated for Azure Application Gateway and Azure Front Door.0
Attributes
- Section
11.5.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Network
11.5.1.2Checks if Microsoft Defender for Cloud is enabled in your Azure subscription and region. If you provide a central security management account, the rule evaluates the Defender for Cloud settings in the centralized account. The rule is COMPLIANT when Defender for Cloud is enabled.1
Attributes
- Section
11.5.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Microsoft Defender
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. 21
11.5.1.1.1Checks whether an Azure Application Gateway, Azure Front Door, Azure Load Balancer, or Azure Public IP has Azure DDoS Protection enabled. It also checks if they have a Web Application Firewall (WAF) policy associated for Azure Application Gateway and Azure Front Door.0
Attributes
- Section
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Network
11.5.1.1.2Checks if Microsoft Defender for Cloud is enabled in your Azure subscription and region. If you provide a central security management account, the rule evaluates the Defender for Cloud settings in the centralized account. The rule is COMPLIANT when Defender for Cloud is enabled.1
Attributes
- Section
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.
- Service
Microsoft Defender
11.5.2: Network intrusions and unexpected file changes are detected and responded to. 63
11.5.2.1Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.0
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Resource Manager
11.5.2.2Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Monitor
11.5.2.3Checks whether Azure Monitor alerts with the given metric name have the specified settings.0
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Monitor
11.5.2.4Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.1
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Monitor
11.5.2.5Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.1
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Storage
11.5.2.6Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
- Service
Azure Service Bus
11.6.1: Unauthorized changes on payment pages are detected and responded to. 63
11.6.1.1Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Azure Resource Manager
11.6.1.2Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Azure Monitor
11.6.1.3Checks whether Azure Monitor alerts with the given metric name have the specified settings.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Azure Monitor
11.6.1.4Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.1
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Azure Monitor
11.6.1.5Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.1
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Azure Storage
11.6.1.6Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
11.6.1: Unauthorized changes on payment pages are detected and responded to.
- Service
Azure Service Bus
12.4.2.1: PCI DSS compliance is managed. 10
12.4.2.1.1Checks if Azure Service Catalog shares portfolios with an Azure Management Group when integration is enabled with Azure Management Groups. The rule is NON_COMPLIANT if the Type value of a share is Subscription.0
Attributes
- Section
12.4.2.1: PCI DSS compliance is managed.
- Service
Azure Service Catalog
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. 63
12.10.5.1Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.0
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Azure Resource Manager
12.10.5.2Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Azure Monitor
12.10.5.3Checks whether Azure Monitor alerts with the given metric name have the specified settings.0
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Azure Monitor
12.10.5.4Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.1
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Azure Monitor
12.10.5.5Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.1
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Azure Storage
12.10.5.6Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
- Service
Azure Service Bus
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. 2212
A1.1.2.1Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Backup
A1.1.2.2Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Database Migration Service
A1.1.2.3Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Cosmos DB
A1.1.2.4Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Managed Disks
A1.1.2.5Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Backup
A1.1.2.6Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Files
A1.1.2.7Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Files
A1.1.2.8Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure HDInsight
A1.1.2.9Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Functions
A1.1.2.10Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Cosmos DB
A1.1.2.11Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Database
A1.1.2.12Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Database
A1.1.2.13Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Synapse Analytics
A1.1.2.14Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Blob Storage
A1.1.2.15Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.2.16Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.2.17Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.2.18Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.2.19Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.2.20Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.2.21Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Machine Learning
A1.1.2.22Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.0
Attributes
- Section
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Automations
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. 4621
A1.1.3.1Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure API Management
A1.1.3.2Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure API Management
A1.1.3.3Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure API Management
A1.1.3.4Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Front Door
A1.1.3.5Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Content Delivery Network
A1.1.3.6Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure DevOps
A1.1.3.7Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Database Migration Service
A1.1.3.8Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Cosmos DB
A1.1.3.9Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure VPN
A1.1.3.10Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Automation State Configuration
A1.1.3.11Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Virtual WAN
A1.1.3.12Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Kubernetes Service
A1.1.3.13Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Cognitive Search
A1.1.3.14Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.15Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Aplication Gateway
A1.1.3.16Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure HDInsight
A1.1.3.17Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.18Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Virtual Network
A1.1.3.19Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Functions
A1.1.3.20Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Functions
A1.1.3.21Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.22Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.23Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.24Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.25Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Virtual Network
A1.1.3.26Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Cognitive Search
A1.1.3.27Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Database
A1.1.3.28Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Database
A1.1.3.29Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Synapse Analytics
A1.1.3.30Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Blob Storage
A1.1.3.31Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.3.32Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.3.33Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.3.34Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.3.35Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Storage
A1.1.3.36Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Machine Learning
A1.1.3.37Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Machine Learning
A1.1.3.38Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.39Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.40Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.1
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.41Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.42Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.43Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.44Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.45Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.1.3.46Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.0
Attributes
- Section
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- Service
Azure Network
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. 3618
A1.2.1.1Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure API Management
A1.2.1.2Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure API Management
A1.2.1.3Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure API Management
A1.2.1.4Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure API Management
A1.2.1.5Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Load Balances
A1.2.1.6Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Front Door
A1.2.1.7Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.8Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.9Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.10For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.11Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.12Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.13Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure DevOps
A1.2.1.14Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.15Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Cosmos DB
A1.2.1.16Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure VPN Gateway
A1.2.1.17Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Container Instances
A1.2.1.18Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Kubernetes Service
A1.2.1.19Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure App
A1.2.1.20Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Load Balancer
A1.2.1.21Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Service Bus
A1.2.1.22Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Service Bus
A1.2.1.23For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.24Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azrure Cosmos DB
A1.2.1.25Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Network
A1.2.1.26Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Database
A1.2.1.27Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure SQL Database
A1.2.1.28Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Synapse Analytics
A1.2.1.29Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Synapse Analytics
A1.2.1.30Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure DNS
A1.2.1.31Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Storage
A1.2.1.32Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Storage
A1.2.1.33Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Logic Apps
A1.2.1.34Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.1
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Virtual Network
A1.2.1.35Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.1.36Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if logging is not enabled.0
Attributes
- Section
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure Monitor
A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers. 11
A1.2.3.1Checks if you have provided security contact information for your Azure account. The rule is NON_COMPLIANT if security contact information within the account is not provided.1
Attributes
- Section
A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.
- Service
Azure AD
A3.2.5.1: PCI DSS scope is documented and validated. 20
A3.2.5.1.1Checks if automated sensitive data discovery is enabled for Azure Purview. The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.0
Attributes
- Section
A3.2.5.1: PCI DSS scope is documented and validated.
- Service
Azure Purview
A3.2.5.1.2Checks if Azure Purview is enabled in your account per region. The rule is NON_COMPLIANT if the status attribute is not set to ENABLED.0
Attributes
- Section
A3.2.5.1: PCI DSS scope is documented and validated.
- Service
Azure Purview
A3.2.5.2: PCI DSS scope is documented and validated. 20
A3.2.5.1.3Checks if automated sensitive data discovery is enabled for Azure Purview. The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.0
Attributes
- Section
A3.2.5.2: PCI DSS scope is documented and validated.
- Service
Azure Purview
A3.2.5.1.4Checks if Azure Purview is enabled in your account per region. The rule is NON_COMPLIANT if the status attribute is not set to ENABLED.0
Attributes
- Section
A3.2.5.2: PCI DSS scope is documented and validated.
- Service
Azure Purview
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. 117
A3.3.1.1Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure API Management
A3.3.1.2Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Resource Manager
A3.3.1.3Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Monitor
A3.3.1.4Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Monitor
A3.3.1.5Checks whether Azure Monitor alerts with the given metric name have the specified settings.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Monitor
A3.3.1.6Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.1
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Monitor
A3.3.1.7Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Virtual Machines
A3.3.1.8Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.1
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Storage
A3.3.1.9Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Security Center
A3.3.1.10Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Service Bus
A3.3.1.11Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
- Service
Azure Network
A3.4.1: Logical access to the cardholder data environment is controlled and managed. 2513
A3.4.1.1Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Backup
A3.4.1.2Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Database Migration Service
A3.4.1.3Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Cosmos DB
A3.4.1.4Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Managed Disks
A3.4.1.5Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Kubernetes Service
A3.4.1.6Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Files
A3.4.1.7Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Files
A3.4.1.8Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure HDInsight
A3.4.1.9Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure AD
A3.4.1.10Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure AD
A3.4.1.11Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Functions
A3.4.1.12Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Cosmos DB
A3.4.1.13Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Database
A3.4.1.14Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Database
A3.4.1.15Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Synapse Analytics
A3.4.1.16Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Blob Storage
A3.4.1.17Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Storage
A3.4.1.18Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Storage
A3.4.1.19Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Storage
A3.4.1.20Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Storage
A3.4.1.21Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Storage
A3.4.1.22Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Storage
A3.4.1.23Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Machine Learning
A3.4.1.24Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.1
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Key Vault
A3.4.1.25Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.0
Attributes
- Section
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- Service
Azure Automations
A3.5.1: Suspicious events are identified and responded to. 117
A3.5.1.1Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure API Management
A3.5.1.2Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Resource Manager
A3.5.1.3Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Monitor
A3.5.1.4Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Monitor
A3.5.1.5Checks whether Azure Monitor alerts with the given metric name have the specified settings.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Monitor
A3.5.1.6Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Monitor
A3.5.1.7Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Virtual Machines
A3.5.1.8Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Storage
A3.5.1.9Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.1
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Security Center
A3.5.1.10Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Service Bus
A3.5.1.11Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.0
Attributes
- Section
A3.5.1: Suspicious events are identified and responded to.
- Service
Azure Network