CIS Azure Benchmark v4.0.0

ActiveCommon framework

Best for: Customers who plan to develop, deploy, assess, or secure solutions that incorporate Azure. System and application administrators, security specialists, and others who develop solutions using Microsoft products and services can use these best practices to assess and improve security.

Controls by category

161 controls are Mapped to CIS Azure Benchmark v4.0.0.

10.1.1 Ensure soft delete for Azure File Shares is Enabled

Control	Status
Azure file shares should have soft delete enabled	Mapped

10.1.2 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares

Control	Status
SMB file shares should have 'SMB protocol version' set to 'SMB 3.1.1' or higher	Mapped

10.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares

Control	Status
SMB file shares should have 'SMB channel encryption' set to 'AES-256-GCM' or higher	Mapped

10.2.1 Ensure that soft delete for blobs on Azure Blob Storage storage accounts is Enabled

Control	Status
Storage account blobs should have soft delete enabled	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped

10.2.2 Ensure 'Versioning' is set to 'Enabled' on Azure Blob Storage storage accounts

Control	Status
Storage accounts should have blob versioning enabled	Mapped

10.3.1.1 Ensure that 'Enable key rotation reminders' is enabled for each Storage Account

Control	Status
Storage accounts should have infrastructure encryption enabled	Mapped
Storage accounts should each have 'Enable key rotation reminders' enabled	Mapped

10.3.1.2 Ensure that Storage Account access keys are periodically regenerated

Control	Status
Storage accounts should each have 'Enable key rotation reminders' enabled	Mapped

10.3.1.3 Ensure 'Allow storage account key access' for Azure Storage Accounts is 'Disabled'

Control	Status
Storage accounts should have shared key access disabled	Mapped

10.3.12 Ensure Redundancy is set to 'geo-redundant storage (GRS)' on critical Azure Storage Accounts

Control	Status
Storage accounts should have geo-redundant storage enabled	Mapped

10.3.2.1 Ensure Private Endpoints are used to access Storage Accounts

Control	Status
Storage accounts should use private link	Mapped

10.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts

Control	Status
Storage accounts should prohibit public access	Mapped
Storage accounts should have public network access disabled	Mapped

10.3.2.3 Ensure default network access rule for storage accounts is set to deny

Control	Status
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped

10.3.3.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is set to 'Enabled'

Control	Status
Storage accounts should have 'Default to Microsoft Entra authorization' enabled	Mapped

10.3.4 Ensure that 'Secure transfer required' is set to 'Enabled'

Control	Status
Storage accounts should have secure transfer enabled	Mapped

10.3.5 Ensure 'Allow Azure services on the trusted services list to access this storage account' is Enabled for Storage Account Access

Control	Status
Storage accounts should have 'Allow Azure services on the trusted services list to access this storage account' enabled	Mapped

10.3.6 Ensure Soft Delete is Enabled for Azure Containers and Blob Storage

Control	Status
Storage accounts should have soft delete enabled for both blobs and containers	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped

10.3.7 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'

Control	Status
Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'	Mapped

10.3.8 Ensure 'Cross Tenant Replication' is not enabled

Control	Status
Storage accounts should have cross-tenant replication disabled	Mapped

10.3.9 Ensure that 'Allow Blob Anonymous Access' is set to 'Disabled'

Control	Status
Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'	Mapped

2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)

Control	Status
Batch accounts should use customer-managed keys to encrypt data	Mapped
Cognitive Services accounts should use customer-managed keys to encrypt data	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Container Instance container groups should use customer-managed keys for encryption	Mapped
Container registries should use customer-managed keys for encryption	Mapped
Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest	Mapped
Databricks workspaces should have a customer-managed key configured	Mapped
Event Hub namespaces should use a customer-managed key for encryption	Mapped
Azure HDInsight clusters should use customer-managed keys to encrypt data at rest	Mapped
Azure API for FHIR should use a customer-managed key to encrypt data at rest	Mapped
HPC Cache accounts should use customer-managed keys for encryption	Mapped
Azure Data Explorer clusters should use customer-managed keys for encryption at rest	Mapped
Azure Machine Learning workspaces should use customer-managed keys for encryption	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
MySQL servers should use customer-managed keys to encrypt data at rest	Mapped
Service Bus Premium namespaces should use a customer-managed key for encryption	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Azure Synapse workspaces should use customer-managed keys to encrypt data at rest	Mapped

2.2.1.1 Ensure public network access is Disabled

Control	Status
Cognitive Services accounts should have public network access disabled	Mapped
Container registries should have public network access disabled	Mapped
Data factories should have public network access disabled	Mapped
Key vaults should have public network access disabled	Mapped
MariaDB servers should have public network access disabled	Mapped
MySQL servers should have public network access disabled	Mapped
PostgreSQL servers should have public network access disabled	Mapped
Azure Cognitive Search services should have public network access disabled	Mapped
Azure SQL databases should have public network access disabled	Mapped
Storage accounts should have public network access disabled	Mapped

2.2.1.2 Ensure Network Access Rules are set to Deny-by-default

Control	Status
Cognitive Services accounts should have network access restrictions configured	Mapped
Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'	Mapped
Container registries should not allow unrestricted network access	Mapped
Service Bus namespaces should not allow overly permissive network access	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped

2.2.2.1 Ensure Private Endpoints are used to access {service}

Control	Status
App Configuration should use private link	Mapped
Cognitive Services should use private link	Mapped
Disk access resources should use private link	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Data factories should use private link	Mapped
Azure Event Grid domains should use private link	Mapped
Azure Event Grid topics should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure API for FHIR should use private link	Mapped
IoT Hub device provisioning service instances should use private link	Mapped
Azure Key Vaults should use private link	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
Recovery Services vaults should use private link	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should use private link	Mapped
Azure File Sync should use private link	Mapped
Azure Synapse workspaces should use private link	Mapped

3.1.1 Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)

Control	Status
Databricks workspaces should be in a customer-managed virtual network	Mapped

3.1.2 Ensure that network security groups are configured for Databricks subnets

Control	Status
Databricks subnets should have network security groups configured	Mapped

3.1.7 Ensure that diagnostic log delivery is configured for Azure Databricks

Control	Status
Databricks workspaces should have diagnostic log delivery configured	Mapped

3.1.8 Ensure that data at rest and in transit is encrypted in Azure Databricks using customer managed keys (CMK)

Control	Status
Databricks workspaces should have a customer-managed key configured	Mapped

4.1.1 Ensure only MFA enabled identities can access privileged Virtual Machine

Control	Status
Microsoft Entra ID users with VM access should have multifactor authentication enabled	Mapped

6.1.1 Ensure that 'security defaults' is enabled in Microsoft Entra ID

Control	Status
Microsoft Entra ID tenants should have 'security defaults' enabled	Mapped

6.1.2 Ensure that 'multifactor authentication' is 'enabled' for all users

Control	Status
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped

Control	Status
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'	Mapped

Control	Status
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'	Mapped

6.14 Ensure that 'Users can register applications' is set to 'No'

Control	Status
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'	Mapped

6.15 Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'

Control	Status
Microsoft Entra ID policies should have 'Guest users access restrictions' set to 'Guest user access is restricted to properties and memberships of their own directory objects'	Mapped

6.16 Ensure that 'Guest invite restrictions' is set to 'Only users assigned to specific admin roles can invite guest users'

Control	Status
Microsoft Entra ID policies should have 'Guest invite restrictions' set to 'Only users assigned to specific admin roles [...]' or 'No one [..]'	Mapped

6.19 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'

Control	Status
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'	Mapped

6.2.1 Ensure that 'trusted locations' are defined

Control	Status
Microsoft Entra ID conditional access policies should have trusted locations configured	Mapped

6.2.6 Ensure that multifactor authentication is required for Windows Azure Service Management API

Control	Status
Azure Service Management API should require multifactor authentication	Mapped
Azure Management should require multifactor authentication	Mapped

6.2.7 Ensure that multifactor authentication is required to access Microsoft Admin Portals

Control	Status
Microsoft Admin Portals should require multifactor authentication	Mapped

6.21 Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'

Control	Status
Microsoft Entra ID policies should have 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' set to 'No'	Mapped

6.23 Ensure that no custom subscription administrator roles exist

Control	Status
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped

6.24 Ensure that a custom role is assigned permissions for administering resource locks

Control	Status
Azure subscriptions should have a custom role for administering resource locks	Mapped

6.26 Ensure fewer than 5 users have global administrator assignment

Control	Status
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5	Mapped

6.3.2 Ensure that guest users are reviewed on a regular basis

Control	Status
Guest users should have access reviews configured monthly	Mapped

6.3.3 Ensure that use of the 'User Access Administrator' role is restricted

Control	Status
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped

6.4 Ensure that 'Restrict non-admin users from creating tenants' is set to 'Yes'

Control	Status
Microsoft Entra ID policies should have 'Users Can Create Tenants' set to 'No'	Mapped

7.1.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs

Control	Status
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs	Mapped

7.1.1.2 Ensure Diagnostic Setting captures appropriate categories

Control	Status
Azure Monitor diagnostic settings should have appropriate log categories configured	Mapped
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs	Mapped

7.1.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (CMK)

Control	Status
Storage accounts containing activity log containers should use customer-managed keys for encryption	Mapped

7.1.1.4 Ensure that logging for Azure Key Vault is 'Enabled'

Control	Status
Key vaults should have resource logs enabled	Mapped

7.1.1.5 Ensure that Network Security Group Flow logs are captured and sent to Log Analytics

Control	Status
Flow log resources should have flow logging enabled	Mapped
Network security groups should have flow logs captured and sent to Log Analytics	Mapped

7.1.1.6 Ensure that logging for Azure AppService 'HTTP logs' is enabled

Control	Status
App Service apps should have 'HTTP logs' enabled	Mapped

7.1.2.1 Ensure that Activity Log Alert exists for Create Policy Assignment

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Create Policy Assignment	Mapped

7.1.2.10 Ensure that Activity Log Alert exists for Delete Public IP Address rule

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Delete Public IP Address rule	Mapped

7.1.2.11 Ensure that an Activity Log Alert exists for Service Health

Control	Status
Azure subscriptions should have an Activity Log alert for Service Health incidents	Mapped

7.1.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment	Mapped

7.1.2.3 Ensure that Activity Log Alert exists for Create or Update Network Security Group

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group	Mapped

7.1.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group	Mapped

7.1.2.5 Ensure that Activity Log Alert exists for Create or Update Security Solution

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution	Mapped

7.1.2.6 Ensure that Activity Log Alert exists for Delete Security Solution

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Delete Security Solution	Mapped

7.1.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Create or Update SQL Server Firewall Rule	Mapped

7.1.2.8 Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Delete SQL Server Firewall Rule	Mapped

7.1.2.9 Ensure that Activity Log Alert exists for Create or Update Public IP Address rule

Control	Status
Azure subscriptions should have an Activity Log Alert configured for Create or Update Public IP Address rule	Mapped

7.1.3.1 Ensure Application Insights are Configured

Control	Status
Azure subscriptions should have at least one Application Insights resource configured	Mapped

8.1 Ensure that RDP access from the Internet is evaluated and restricted

Control	Status
Network security groups should have RDP access restrictions configured	Mapped

8.2 Ensure that SSH access from the Internet is evaluated and restricted

Control	Status
Network security groups should have SSH access from the internet restricted	Mapped

8.3 Ensure that UDP access from the Internet is evaluated and restricted

Control	Status
Network security groups should have UDP services restricted from the internet	Mapped

8.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted

Control	Status
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Network security groups should have HTTP(S) access on ports 80 and 443 from the internet evaluated and restricted	Mapped

8.5 Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'

Control	Status
Network security group flow logs should have retention set to greater than 90 days	Mapped
Flow log resources should have flow logging enabled	Mapped

8.6 Ensure that Network Watcher is 'Enabled' for Azure Regions that are in use

Control	Status
Azure subscriptions should have Network Watcher enabled	Mapped

8.8 Ensure that virtual network flow log retention days is set to greater than or equal to 90

Control	Status
Flow log resources should have flow logging enabled	Mapped

9.1.10 Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates

Control	Status
Virtual machines should have system updates installed	Mapped

9.1.11 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled'

Control	Status
Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default	Mapped

9.1.12 Ensure That 'All users with the following roles' is set to 'Owner'

Control	Status
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped

9.1.13 Ensure 'Additional email addresses' is Configured with a Security Contact Email

Control	Status
Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email	Mapped

9.1.14 Ensure that 'Notify about alerts with the following severity (or higher)' is enabled

Control	Status
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped

9.1.15 Ensure that 'Notify about attack paths with the following risk level (or higher)' is enabled

Control	Status
Security contacts should have attack path email notifications enabled at the configured minimum risk level	Mapped

9.1.17 [LEGACY] Ensure That Microsoft Defender for DNS Is Set To 'On'

Control	Status
Azure subscriptions should have Azure Defender for DNS enabled	Mapped

9.1.3.1 Ensure that Defender for Servers is set to 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped

9.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On'

Control	Status
Virtual machines should have a vulnerability assessment solution enabled	Mapped

9.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'

Control	Status
Security Center should have Windows Defender ATP (WDATP) integration selected	Mapped

9.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for container registries enabled	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped

9.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped

9.1.6.1 Ensure That Microsoft Defender for App Services Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for App Service enabled	Mapped

9.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled	Mapped

9.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for open-source relational databases enabled	Mapped

9.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for Azure SQL Database servers enabled	Mapped

9.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'

Control	Status
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped

9.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for Key Vault enabled	Mapped

9.1.9.1 Ensure That Microsoft Defender for Resource Manager Is Set To 'On'

Control	Status
Azure subscriptions should have Azure Defender for Resource Manager enabled	Mapped

9.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On'

Control	Status
Azure subscriptions should have Microsoft Defender for IoT Hub enabled	Mapped

9.3.1 Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults

Control	Status
RBAC key vaults should have 'Expiration Date' configured for all keys	Mapped

9.3.2 Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults.

Control	Status
Non-RBAC key vaults should have 'Expiration Date' configured for all keys	Mapped

9.3.3 Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults

Control	Status
RBAC key vaults should have 'Expiration Date' configured for all secrets	Mapped

9.3.4 Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults

Control	Status
Non-RBAC key vaults should have 'Expiration Date' configured for all secrets	Mapped

9.3.5 Ensure the Key Vault is Recoverable

Control	Status
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
Key vaults should have recoverability configured	Mapped

9.3.6 Ensure that Role Based Access Control for Azure Key Vault is enabled

Control	Status
Key vaults should have Role-Based Access Control (RBAC) enabled	Mapped

9.3.7 Ensure that Public Network Access when using Private Endpoint is disabled

Control	Status
Key vaults should have public network access disabled	Mapped

9.3.8 Ensure that Private Endpoints are Used for Azure Key Vault

Control	Status
Azure Key Vaults should use private link	Mapped

9.3.9 Ensure automatic key rotation is enabled within Azure Key Vault

Control	Status
Key vault keys should have automatic rotation enabled	Mapped

9.4.1 Ensure an Azure Bastion Host Exists

Control	Status
Azure subscriptions should have at least one Azure Bastion host	Mapped

Framework	Control overlap	Note
CIS Azure Benchmark v5.0.0	High 66%
CIS Azure Benchmark v3.0.0	High 61%
CIS Azure Benchmark v2.1.0	Medium 59%

Frequently asked questions

What does the CIS Microsoft Azure Foundations Benchmark provide?

It gives prescriptive guidance for establishing a secure baseline configuration for Azure. It is described as a step-by-step checklist for securing Azure.

What are the CIS Benchmark levels?

Level 1 recommends essential basic security requirements that should cause little or no interruption of service or reduced functionality. Level 2 recommends settings for environments requiring greater security that could result in some reduced functionality.

Does following CIS Benchmark settings guarantee application security?

CIS benchmarks establish the basic level of security. They are a starting point, not an exhaustive list. Each organization must still evaluate its own situation, workloads, and compliance requirements, and tailor its environment.

How are CIS Benchmarks developed and updated?

Each benchmark goes through two phases of consensus review. One phase occurs during initial development, and the other occurs after publication, using community feedback. Revisions depend on the community that developed it and on the release schedule of the supported technology.