CIS Azure Benchmark v1.5.0 Deprecated
Best for: The CIS Microsoft Azure Foundations Benchmark is for customers who plan to develop, deploy, assess, or secure solutions that incorporate Azure. System and application administrators, security specialists, and others who develop solutions using Microsoft products and services can use these best practices.
Controls by category 101 controls are
1.14 Ensure That ‘Users Can Register Applications’ Is Set to ‘No’ 1.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No' 1.2.1 Ensure Trusted Locations Are Defined 1.2.6 Ensure Multi-factor Authentication is Required for Azure Management 1.23 Ensure That No Custom Subscription Owner Roles Are Created 1.4 Ensure Guest Users Are Reviewed on a Regular Basis 2.1.1 Ensure That Microsoft Defender for Servers Is Set to 'On' 2.1.10 Ensure That Microsoft Defender for Key Vault Is Set To 'On' 2.1.11 Ensure That Microsoft Defender for DNS Is Set To 'On' 2.1.13 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' 2.1.2 Ensure That Microsoft Defender for App Services Is Set To 'On' 2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On' 2.1.4 Ensure That Microsoft Defender for Azure SQL Databases Is Set To 'On' 2.1.5 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' 2.1.6 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' 2.1.7 Ensure That Microsoft Defender for Storage Is Set To 'On' 2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On' 2.1.9 Ensure That Microsoft Defender for Cosmos DB Is Set To 'On' 2.2.1 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' 2.3.1 Ensure That 'All users with the following roles' is set to 'Owner' 2.3.3 Ensure That 'Notify about alerts with the following severity' is Set to 'High' 2.4.1 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected 2.4.2 Ensure that Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud is selected 2.6 Ensure Any of the ASC Default Policy Settings are Not Set to 'Disabled' 3.1 Ensure that 'Secure transfer required' is set to 'Enabled' 3.10 Ensure Private Endpoints are used to access Storage Accounts 3.11 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage 3.12 Ensure Storage for Critical Data are Encrypted with Customer Managed Keys 3.13 Ensure Storage logging is Enabled for Blob Service for 'Read', 'Write', and 'Delete' requests 3.14 Ensure Storage Logging is Enabled for Table Service for 'Read', 'Write', and 'Delete' Requests 3.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2' 3.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to ‘enabled’ 3.3 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account 3.5 Ensure Storage Logging is Enabled for Queue Service for 'Read', 'Write', and 'Delete' request 3.7 Ensure that 'Public access level' is disabled for storage accounts with blob containers 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny 3.9 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access 4.1.1 Ensure that 'Auditing' is set to 'On' 4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP) 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key 4.1.5 Ensure that 'Data encryption' is set to 'On' on a SQL Database 4.1.6 Ensure that 'Auditing' Retention is 'greater than 90 days' 4.2.1 Ensure that Microsoft Defender for SQL is set to 'On' for critical SQL Servers 4.2.2 Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account 4.2.3 Ensure that Vulnerability Assessment (VA) setting 'Periodic recurring scans' is set to 'on' for each SQL server 4.2.5 Ensure that Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' is set for each SQL Server 4.3.1 Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server 4.3.2 Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server 4.3.3 Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server 4.3.4 Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server 4.3.5 Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server 4.3.6 Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server 4.3.8 Ensure 'Infrastructure double encryption' for PostgreSQL Database Server is 'Enabled' 4.4.1 Ensure 'Enforce SSL connection' is set to 'Enabled' for Standard MySQL Database Server 4.4.2 Ensure 'TLS Version' is set to 'TLSV1.2' for MySQL flexible Database Server 4.4.3 Ensure server parameter 'audit_log_enabled' is set to 'ON' for MySQL Database Server 4.4.4 Ensure server parameter 'audit_log_events' has 'CONNECTION' set for MySQL Database Server 4.5.1 Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks 4.5.2 Ensure That Private Endpoints Are Used Where Possible 5.1.2 Ensure Diagnostic Setting captures appropriate categories 5.1.3 Ensure the storage container storing the activity logs is not publicly accessible 5.1.4 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key 5.1.5 Ensure that logging for Azure KeyVault is 'Enabled' 5.1.6 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics 5.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment 5.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule 5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment 5.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group 5.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution 5.2.6 Ensure that Activity Log Alert exists for Delete Security Solution 5.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule 5.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule 5.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule 6.1 Ensure that RDP from the internet access is evaluated and restricted 6.2 Ensure that SSH access from the internet is evaluated and restricted 6.3 Ensure that UDP access from the Internet is evaluated and restricted 6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted 6.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days' 6.6 Ensure that Network Watcher is 'Enabled' 7.1 Ensure Virtual Machines are utilizing Managed Disks 7.2 Ensure that 'OS and Data' disks are encrypted with Customer Managed Key (CMK) 7.3 Ensure that 'Unattached disks' are encrypted with CMK 8.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults 8.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults 8.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults 8.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults 8.5 Ensure the key vault is recoverable 8.6 Enable Role Based Access Control for Azure Key Vault 8.7 Ensure that Private Endpoints are Used for Azure Key Vault 8.8 Ensure Automatic Key Rotation is Enabled Within Azure Key Vault for the Supported Services 9.1 Ensure App Service Authentication is set up for apps in Azure App Service 9.10 Ensure FTP deployments are disabled 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service 9.3 Ensure web app is using the latest version of TLS encryption 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On' 9.5 Ensure that Register with Azure Active Directory is enabled on App Service 9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app Framework Control overlap Note CIS Azure Benchmark v2.0.0 High 98%CIS Azure Benchmark v2.1.0 High 89%CIS Azure Benchmark v3.0.0 High 81%
Frequently asked questions What does the CIS Microsoft Azure Foundations Benchmark provide? It provides prescriptive guidance for establishing a secure baseline configuration for Azure. CIS describes its benchmarks as configuration baselines and best practices for securely configuring a system.
What does Level 2 in CIS benchmarks cover? Level 2 recommends settings for environments requiring greater security. These settings could result in some reduced functionality.
Does following CIS Benchmark settings cover every Azure security need? CIS benchmarks establish the basic level of security. They are a starting point, not an exhaustive list of security configurations. Each organization must still evaluate its situation, workloads, and compliance requirements, and tailor its environment.
How does Microsoft help deploy policies for the CIS Azure Foundations Benchmark? Microsoft published the Azure Blueprint for CIS Microsoft Azure Foundations Benchmark, which deploys a core set of policies. When assigned to an architecture, `Azure Policy` evaluates resources for compliance with the assigned policy definitions.
