Azure
CIS Microsoft Azure Foundations Benchmark
Ensure Security Defaults is enabled on Microsoft Entra ID
Enable Microsoft Entra Security Defaults to enforce baseline identity protections including MFA for admins.
Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'
Prevent shadow tenants by restricting tenant creation to administrators.
Ensure 'Restrict access to Microsoft Entra ID administration portal' is set to 'Yes'
Block standard users from accessing the Entra admin portal.
Ensure Security Defaults is enabled on Microsoft Entra ID
Provides baseline security across all users and apps.
Ensure that Microsoft Defender for Servers is set to 'On'
Enable Microsoft Defender for Cloud to protect VMs against threats.
Ensure that Microsoft Defender for App Service is set to 'On'
Detect web app attacks against App Services.
Ensure that Microsoft Defender for Databases is set to 'On'
Identify anomalous database activities.
Ensure that Microsoft Defender for Storage is set to 'On'
Detect anomalous and potentially harmful Storage account activity.
Ensure that 'Secure transfer required' is set to 'Enabled'
Require HTTPS for all data transfers to Azure Storage.
Ensure that 'Public access level' is set to Private for blob containers
Prevent anonymous access to blob storage.
Ensure that 'Auditing' is set to 'On' for SQL servers
Track database events for forensics and compliance.
Ensure 'Transparent Data Encryption' is enabled on SQL Database
Encrypt data at rest in SQL DB.
Ensure Diagnostic Setting captures appropriate categories
Forward control-plane logs to Log Analytics or storage.
Ensure that logging for Azure Key Vault is 'Enabled'
Track all access and changes to Key Vault.
Ensure that RDP (3389) and SSH (22) are restricted from the Internet
Block direct internet exposure on management ports.
Ensure that Network Watcher is 'Enabled'
Required for diagnostics, flow logs, and topology visibility.
Ensure that the expiration date is set for all Keys in Key Vault
Force key rotation by enforcing expirations.
Ensure that the expiration date is set for all Secrets in Key Vault
Force secret rotation.
Ensure App Service Authentication is set on Azure App Service
Require auth for App Service apps.
Ensure web app redirects all HTTP traffic to HTTPS
Enforce TLS for web traffic.