Services in this catalog
- aisearch - 1 checks
- aks - 4 checks
- apim - 1 checks
- app - 19 checks
- appinsights - 1 checks
- containerregistry - 3 checks
- cosmosdb - 3 checks
- databricks - 2 checks
- defender - 25 checks
- entra - 16 checks
- iam - 3 checks
- keyvault - 10 checks
- monitor - 15 checks
- mysql - 4 checks
- network - 9 checks
- policy - 1 checks
- postgresql - 8 checks
- sqlserver - 12 checks
- storage - 18 checks
- vm - 12 checks
aisearch
1 checks.| Check ID | Title | Severity |
|---|---|---|
aisearch_service_not_publicly_accessible | AI Search service has public network access disabled | HIGH |
aks
4 checks.| Check ID | Title | Severity |
|---|---|---|
aks_cluster_rbac_enabled | AKS cluster has RBAC enabled | HIGH |
aks_clusters_created_with_private_nodes | AKS cluster nodes do not have public IP addresses | HIGH |
aks_clusters_public_access_disabled | AKS cluster has a private endpoint and node public access is disabled | HIGH |
aks_network_policy_enabled | AKS cluster has network policy enabled | MEDIUM |
apim
1 checks.| Check ID | Title | Severity |
|---|---|---|
apim_threat_detection_llm_jacking | No potential LLM Jacking attacks detected across all Azure API Management instances | CRITICAL |
app
19 checks.| Check ID | Title | Severity |
|---|---|---|
app_client_certificates_on | Web app requires incoming client certificates | MEDIUM |
app_ensure_auth_is_set_up | App Service app has App Service Authentication enabled | MEDIUM |
app_ensure_http_is_redirected_to_https | App Service web app redirects HTTP to HTTPS | HIGH |
app_ensure_java_version_is_latest | App Service web app uses the latest supported Java version or 17 by default | LOW |
app_ensure_php_version_is_latest | App Service web app uses the latest supported PHP version or 8.2 by default | LOW |
app_ensure_python_version_is_latest | App Service web app uses the latest supported Python version or 3.12 by default | LOW |
app_ensure_using_http20 | App Service web app has HTTP/2.0 enabled | LOW |
app_ftp_deployment_disabled | App Service web app has FTP disabled or FTPS-only enforced | HIGH |
app_function_access_keys_configured | Function app has function keys configured | HIGH |
app_function_application_insights_enabled | Function App has Application Insights configured | MEDIUM |
app_function_ftps_deployment_disabled | Function app has FTP and FTPS deployments disabled | MEDIUM |
app_function_identity_is_configured | Function app has a system-assigned or user-assigned managed identity enabled | MEDIUM |
app_function_identity_without_admin_privileges | Function app managed identity is not assigned Owner, Contributor, User Access Administrator, or Role Based Acc… | HIGH |
app_function_latest_runtime_version | Function app uses the latest supported runtime version (~4) | MEDIUM |
app_function_not_publicly_accessible | Function app is not publicly accessible | HIGH |
app_function_vnet_integration_enabled | Function app has Virtual Network integration enabled | MEDIUM |
app_http_logs_enabled | App Service web app has HTTP logs enabled in diagnostic settings | LOW |
app_minimum_tls_version_12 | App Service web app has minimum TLS version set to 1.2 or 1.3 | MEDIUM |
app_register_with_identity | App Service web app has a managed identity configured | MEDIUM |
appinsights
1 checks.| Check ID | Title | Severity |
|---|---|---|
appinsights_ensure_is_configured | Subscription has at least one Application Insights resource configured | LOW |
containerregistry
3 checks.| Check ID | Title | Severity |
|---|---|---|
containerregistry_admin_user_disabled | Container Registry admin user is disabled | HIGH |
containerregistry_not_publicly_accessible | Container Registry public network access is disabled | HIGH |
containerregistry_uses_private_link | Container Registry uses a private endpoint (Private Link) | HIGH |
cosmosdb
3 checks.| Check ID | Title | Severity |
|---|---|---|
cosmosdb_account_firewall_use_selected_networks | Cosmos DB account firewall allows access only from selected networks | MEDIUM |
cosmosdb_account_use_aad_and_rbac | Cosmos DB account has local authentication disabled and uses Azure AD authentication with Azure RBAC | HIGH |
cosmosdb_account_use_private_endpoints | Cosmos DB account uses private endpoint connections | HIGH |
databricks
2 checks.| Check ID | Title | Severity |
|---|---|---|
databricks_workspace_cmk_encryption_enabled | Databricks workspace uses a customer-managed key (CMK) for encryption at rest | HIGH |
databricks_workspace_vnet_injection_enabled | Databricks workspace is deployed in a customer-managed VNet (VNet Injection enabled) | HIGH |
defender
25 checks.| Check ID | Title | Severity |
|---|---|---|
defender_additional_email_configured_with_a_security_contact | Security contact has additional email addresses configured | LOW |
defender_assessments_vm_endpoint_protection_installed | All virtual machines in the subscription have endpoint protection installed | HIGH |
defender_attack_path_notifications_properly_configured | Security contact has attack path email notifications enabled at or above the configured minimum risk level | HIGH |
defender_auto_provisioning_log_analytics_agent_vms_on | Defender auto-provisioning of Log Analytics agent for Azure VMs is enabled | HIGH |
defender_auto_provisioning_vulnerabilty_assessments_machines_on | All virtual machines in the subscription have a vulnerability assessment solution installed | MEDIUM |
defender_container_images_resolved_vulnerabilities | All Azure running container images in the subscription have no unresolved vulnerabilities | CRITICAL |
defender_container_images_scan_enabled | Subscription has container image vulnerability scanning enabled | HIGH |
defender_ensure_defender_for_app_services_is_on | Defender for App Services is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_arm_is_on | Defender for Azure Resource Manager is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_azure_sql_databases_is_on | Defender for Azure SQL databases is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_containers_is_on | Defender for Containers is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_cosmosdb_is_on | Defender for Cosmos DB is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_databases_is_on | Defender for Databases is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_dns_is_on | Defender for DNS is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_keyvault_is_on | Defender for Key Vaults is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_os_relational_databases_is_on | Defender for Open-Source Relational Databases is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_server_is_on | Defender for Servers is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_sql_servers_is_on | Defender for SQL servers on machines is set to On (Standard pricing tier) | HIGH |
defender_ensure_defender_for_storage_is_on | Defender for Storage is set to On (Standard pricing tier) | HIGH |
defender_ensure_iot_hub_defender_is_on | Defender for IoT Hub is set to On | HIGH |
defender_ensure_mcas_is_enabled | Defender for Cloud Apps is enabled | MEDIUM |
defender_ensure_notify_alerts_severity_is_high | Security contact has alert notifications enabled with minimum severity High or lower | HIGH |
defender_ensure_notify_emails_to_owners | Security contact notifications include the Owner role | MEDIUM |
defender_ensure_system_updates_are_applied | All virtual machines in the subscription have system updates applied | HIGH |
defender_ensure_wdatp_is_enabled | Defender for Endpoint is enabled | HIGH |
entra
16 checks.| Check ID | Title | Severity |
|---|---|---|
entra_conditional_access_policy_require_mfa_for_admin_portals | Conditional Access policy requires MFA for Microsoft Admin Portals | MEDIUM |
entra_conditional_access_policy_require_mfa_for_management_api | Multifactor Authentication is required for Windows Azure Service Management API | MEDIUM |
entra_global_admin_in_less_than_five_users | Global Administrator role has fewer than 5 members | HIGH |
entra_non_privileged_user_has_mfa | Non-privileged user has multi-factor authentication enabled | MEDIUM |
entra_policy_default_users_cannot_create_security_groups | Authorization policy disallows non-privileged users from creating security groups | MEDIUM |
entra_policy_ensure_default_user_cannot_create_apps | Tenant does not allow non-admin users to register applications | HIGH |
entra_policy_ensure_default_user_cannot_create_tenants | Authorization policy restricts non-admin users from creating tenants | MEDIUM |
entra_policy_guest_invite_only_for_admin_roles | Tenant authorization policy restricts guest invitations to users with specific admin roles or disables guest i… | HIGH |
entra_policy_guest_users_access_restrictions | Authorization policy restricts guest user access to properties and memberships of their own directory objects | MEDIUM |
entra_policy_restricts_user_consent_for_apps | Entra authorization policy disallows user consent for applications | HIGH |
entra_policy_user_consent_for_verified_apps | Entra tenant does not allow users to consent to non-verified applications | HIGH |
entra_privileged_user_has_mfa | Privileged user has multi-factor authentication enabled | HIGH |
entra_security_defaults_enabled | Microsoft Entra ID tenant has Security Defaults enabled | CRITICAL |
entra_trusted_named_locations_exists | Entra tenant has a trusted named location with IP ranges defined | LOW |
entra_user_with_vm_access_has_mfa | Entra ID user with VM access has multi-factor authentication enabled | HIGH |
entra_users_cannot_create_microsoft_365_groups | Microsoft 365 group creation by users is disabled | MEDIUM |
iam
3 checks.| Check ID | Title | Severity |
|---|---|---|
iam_custom_role_has_permissions_to_administer_resource_locks | Custom role has permission to administer resource locks | MEDIUM |
iam_role_user_access_admin_restricted | Role assignment does not grant the User Access Administrator role | HIGH |
iam_subscription_roles_owner_custom_not_created | Custom role is not a subscription owner role | HIGH |
keyvault
10 checks.| Check ID | Title | Severity |
|---|---|---|
keyvault_access_only_through_private_endpoints | Key Vault using private endpoints has public network access disabled | HIGH |
keyvault_key_expiration_set_in_non_rbac | Key in non-RBAC Key Vault has expiration date set | HIGH |
keyvault_key_rotation_enabled | Key Vault key has automatic rotation enabled | HIGH |
keyvault_logging_enabled | Key Vault has at least one diagnostic setting with audit logging enabled | HIGH |
keyvault_non_rbac_secret_expiration_set | Secret in non-RBAC Key Vault has expiration date set | MEDIUM |
keyvault_private_endpoints | Key Vault uses private endpoints | HIGH |
keyvault_rbac_enabled | Key Vault uses Azure RBAC for access control | HIGH |
keyvault_rbac_key_expiration_set | Key in RBAC-enabled Key Vault has expiration date set | MEDIUM |
keyvault_rbac_secret_expiration_set | Secret in RBAC-enabled Key Vault has expiration date set | MEDIUM |
keyvault_recoverable | Key Vault has soft delete and purge protection enabled | HIGH |
monitor
15 checks.| Check ID | Title | Severity |
|---|---|---|
monitor_alert_create_policy_assignment | Subscription has an Azure Monitor activity log alert for policy assignment creation | MEDIUM |
monitor_alert_create_update_nsg | Subscription has an Activity Log alert for Network Security Group create or update operations | HIGH |
monitor_alert_create_update_public_ip_address_rule | Subscription has an Activity Log Alert for Public IP address create or update operations | MEDIUM |
monitor_alert_create_update_security_solution | Subscription has Activity Log alert for Security Solution create or update | MEDIUM |
monitor_alert_create_update_sqlserver_fr | Subscription has an Activity Log alert for SQL Server firewall rule create or update events | MEDIUM |
monitor_alert_delete_nsg | Subscription has an Activity Log alert for Network Security Group delete operations | HIGH |
monitor_alert_delete_policy_assignment | Subscription has an Activity Log alert for policy assignment deletion | HIGH |
monitor_alert_delete_public_ip_address_rule | Azure subscription has an Activity Log alert for public IP address deletion | MEDIUM |
monitor_alert_delete_security_solution | Subscription has an Azure Monitor Activity Log alert for Microsoft.Security/securitySolutions delete operation… | MEDIUM |
monitor_alert_delete_sqlserver_fr | Subscription has an Activity Log Alert for SQL Server firewall rule deletions | MEDIUM |
monitor_alert_service_health_exists | Azure subscription has an enabled Activity Log alert for Service Health incidents | MEDIUM |
monitor_diagnostic_setting_with_appropriate_categories | Subscription has a diagnostic setting capturing Administrative, Security, Alert, and Policy categories | HIGH |
monitor_diagnostic_settings_exists | Subscription has an Activity Log diagnostic setting | HIGH |
monitor_storage_account_with_activity_logs_cmk_encrypted | Storage account storing Activity Log data is encrypted with a customer-managed key | MEDIUM |
monitor_storage_account_with_activity_logs_is_private | Storage account storing activity logs does not allow public blob access | HIGH |
mysql
4 checks.| Check ID | Title | Severity |
|---|---|---|
mysql_flexible_server_audit_log_connection_activated | MySQL flexible server has audit_log_events including CONNECTION | MEDIUM |
mysql_flexible_server_audit_log_enabled | MySQL flexible server has audit_log_enabled set to ON | MEDIUM |
mysql_flexible_server_minimum_tls_version_12 | MySQL flexible server enforces TLS 1.2 or higher | HIGH |
mysql_flexible_server_ssl_connection_enabled | MySQL Flexible Server enforces SSL connections | HIGH |
network
9 checks.| Check ID | Title | Severity |
|---|---|---|
network_bastion_host_exists | Azure subscription has at least one Bastion Host | MEDIUM |
network_flow_log_captured_sent | Network Watcher has flow logs enabled and sent to a Log Analytics workspace | HIGH |
network_flow_log_more_than_90_days | Network Watcher has all flow logs enabled with retention set to 0 or at least 90 days | MEDIUM |
network_http_internet_access_restricted | Network security group restricts inbound HTTP (port 80) access from the Internet | HIGH |
network_public_ip_shodan | Azure public IP address is not listed in Shodan | HIGH |
network_rdp_internet_access_restricted | Network security group does not allow inbound RDP (TCP 3389) from the Internet | HIGH |
network_ssh_internet_access_restricted | Network security group does not allow inbound SSH (TCP port 22) from the Internet | HIGH |
network_udp_internet_access_restricted | Network security group does not allow inbound UDP from the Internet | HIGH |
network_watcher_enabled | Network Watcher is enabled for all locations in the subscription | HIGH |
policy
1 checks.| Check ID | Title | Severity |
|---|---|---|
policy_ensure_asc_enforcement_enabled | Security Center built-in policy assignment has enforcement mode set to Default | MEDIUM |
postgresql
8 checks.| Check ID | Title | Severity |
|---|---|---|
postgresql_flexible_server_allow_access_services_disabled | PostgreSQL flexible server has ‘Allow public access from any Azure service’ disabled | HIGH |
postgresql_flexible_server_connection_throttling_on | Flexible PostgreSQL server has connection_throttling enabled | MEDIUM |
postgresql_flexible_server_enforce_ssl_enabled | PostgreSQL Flexible Server enforces SSL connections | HIGH |
postgresql_flexible_server_entra_id_authentication_enabled | Microsoft Entra ID authentication is enabled for PostgreSQL Flexible Server | MEDIUM |
postgresql_flexible_server_log_checkpoints_on | PostgreSQL Flexible Server has checkpoint logging enabled | LOW |
postgresql_flexible_server_log_connections_on | PostgreSQL flexible server has log_connections enabled | MEDIUM |
postgresql_flexible_server_log_disconnections_on | PostgreSQL Flexible Server has disconnection logging enabled | MEDIUM |
postgresql_flexible_server_log_retention_days_greater_3 | PostgreSQL flexible server log_retention_days is between 4 and 7 days | MEDIUM |
sqlserver
12 checks.| Check ID | Title | Severity |
|---|---|---|
sqlserver_auditing_enabled | SQL Server has an auditing policy configured | HIGH |
sqlserver_auditing_retention_90_days | SQL server has auditing enabled with retention greater than 90 days | MEDIUM |
sqlserver_azuread_administrator_enabled | SQL Server has an Azure Active Directory administrator configured | MEDIUM |
sqlserver_microsoft_defender_enabled | SQL Server has Microsoft Defender for SQL enabled | HIGH |
sqlserver_recommended_minimal_tls_version | SQL server enforces minimal TLS version 1.2 or 1.3 | MEDIUM |
sqlserver_tde_encrypted_with_cmk | SQL server uses a customer-managed key for the TDE protector and all databases have TDE enabled | CRITICAL |
sqlserver_tde_encryption_enabled | SQL database has Transparent Data Encryption (TDE) enabled | HIGH |
sqlserver_unrestricted_inbound_access | Azure SQL Server does not have firewall rules allowing 0.0.0.0-255.255.255.255 | CRITICAL |
sqlserver_va_emails_notifications_admins_enabled | SQL Server has Vulnerability Assessment enabled and email notifications to subscription admins configured | MEDIUM |
sqlserver_va_periodic_recurring_scans_enabled | SQL Server has Vulnerability Assessment periodic recurring scans enabled | MEDIUM |
sqlserver_va_scan_reports_configured | SQL server has Vulnerability Assessment enabled and scan report recipients configured | MEDIUM |
sqlserver_vulnerability_assessment_enabled | SQL server has vulnerability assessment enabled with storage container configured | MEDIUM |
storage
18 checks.| Check ID | Title | Severity |
|---|---|---|
storage_account_key_access_disabled | Storage account has shared key access disabled | HIGH |
storage_blob_public_access_level_is_disabled | Storage account has ‘Allow blob public access’ disabled | HIGH |
storage_blob_versioning_is_enabled | Storage account has blob versioning enabled | MEDIUM |
storage_cross_tenant_replication_disabled | Storage account has cross-tenant replication disabled | HIGH |
storage_default_network_access_rule_is_denied | Storage account default network access rule is set to Deny | HIGH |
storage_default_to_entra_authorization_enabled | Storage account uses Microsoft Entra authorization by default | MEDIUM |
storage_ensure_azure_services_are_trusted_to_access_is_enabled | Storage account has ‘Allow trusted Microsoft services to access this storage account’ enabled | MEDIUM |
storage_ensure_encryption_with_customer_managed_keys | Azure Storage account uses customer-managed keys (CMKs) for encryption | HIGH |
storage_ensure_file_shares_soft_delete_is_enabled | Storage account has soft delete enabled for file shares | MEDIUM |
storage_ensure_minimum_tls_version_12 | Storage account minimum TLS version is 1.2 | MEDIUM |
storage_ensure_private_endpoints_in_storage_accounts | Storage account has private endpoint connections | MEDIUM |
storage_ensure_soft_delete_is_enabled | Storage account has soft delete for containers enabled | MEDIUM |
storage_geo_redundant_enabled | Azure Storage account uses geo-redundant replication (GRS, GZRS, RA-GRS, or RA-GZRS) | MEDIUM |
storage_infrastructure_encryption_is_enabled | Storage account has infrastructure encryption enabled | LOW |
storage_key_rotation_90_days | Storage account has access key expiration period set to 90 days or less | MEDIUM |
storage_secure_transfer_required_is_enabled | Storage account has secure transfer required enabled | HIGH |
storage_smb_channel_encryption_with_secure_algorithm | Storage account uses AES-256-GCM for SMB channel encryption on file shares | MEDIUM |
storage_smb_protocol_version_is_latest | Storage account allows only the latest SMB protocol version for file shares | MEDIUM |
vm
12 checks.| Check ID | Title | Severity |
|---|---|---|
vm_backup_enabled | Virtual Machine is protected by Azure Backup | HIGH |
vm_desired_sku_size | Virtual Machine uses an organization-approved SKU size | MEDIUM |
vm_ensure_attached_disks_encrypted_with_cmk | Virtual Machine OS or data disk is encrypted with a customer-managed key (CMK) | MEDIUM |
vm_ensure_unattached_disks_encrypted_with_cmk | Unattached disk is encrypted with a customer-managed key (CMK) | MEDIUM |
vm_ensure_using_approved_images | Virtual Machine uses an approved custom machine image | HIGH |
vm_ensure_using_managed_disks | Virtual Machine uses managed disks for OS and data disks | HIGH |
vm_jit_access_enabled | Virtual Machine has Just-in-Time (JIT) access enabled | MEDIUM |
vm_linux_enforce_ssh_authentication | Linux Virtual Machine has password authentication disabled (SSH key authentication enforced) | HIGH |
vm_scaleset_associated_with_load_balancer | Virtual Machine Scale Set is associated with a load balancer backend pool | MEDIUM |
vm_scaleset_not_empty | Virtual Machine Scale Set has at least one VM instance | MEDIUM |
vm_sufficient_daily_backup_retention_period | Virtual Machine has a backup policy with a daily retention period meeting the configured minimum | MEDIUM |
vm_trusted_launch_enabled | Virtual Machine has Trusted Launch with Secure Boot and vTPM enabled | MEDIUM |
What’s next
Cloud Security overview
Connect a provider, see findings end-to-end.
All checks
Index across every provider.
Compliance frameworks
How check IDs map to SOC 2 / PCI / HIPAA / ISO controls.
Reports
Per-framework PDF scorecards.