Virtual network gateways should use standard SKUs as a minimum
Virtual network gateways should use standard SKUs as a minimum. The use of Basic or Free SKUs in Azure has significant limitations in what can be monitored and what support can be realized from Microsoft. Basic/Free SKUs should never be used for production workloads.
Typically, these SKU's do not have a service SLA and Microsoft will usually refuse to provide support for them.
What this control checks
VPN gateways must not use the Basic SKU tier
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure VPN gateways should not use 'basic' SKU" (e345b6c3-24bd-4c93-9bbb-7e5e49a17b78); PowerPipe control azure_compliance.control.network_virtual_network_gateway_no_basic_sku.
Framework-specific interpretation
CIS Azure Benchmark v2.0.0: Mapped to 5.5 (Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production...).
CIS Azure Benchmark v2.1.0: Mapped to 5.5 (Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production...).
CIS Azure Benchmark v3.0.0: Mapped to 6.5 (Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production...).
Framework mappings
The clauses this control is mapped to in each framework.
- 5.5 Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)
- 5.5 Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)
- 6.5 Ensure that SKU Basic/Consumption is not used on artifacts that need to be monitored (Particularly for Production Workloads)
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_virtual_network_gateway_no_basic_sku - Powerpipe Control:
azure_compliance.control.network_virtual_network_gateway_no_basic_sku - Azure Policy Definition:
e345b6c3-24bd-4c93-9bbb-7e5e49a17b78
Last reviewed: 2026-10-14