Build Azure Expertise

Run our secure Azure scan to receive a report with custom recommendations from our cloud security experts.

Start Free Scan Learn More

Unlock Free Azure Resources

Sign up to download the 20 policies you need for Azure compliance and start your cloud security journey today.

All
Configuration Management
Data Security
Logical Access
Network Monitoring
Vulnerability Management

Configuration Management

Configuration Management

Learn about configuration standards from industry leaders such as the Center for Internet Security, NIST, SANS, AWS, and Microsoft.

Configure Shared Access Security Tokens to Expire within an Hour

Ensure Only Authorized Users Can Create Security Groups

Ensure Soft Delete Is Enabled

Utilize Managed Disks for Virtual Machines

Data Security

Learn about practices to safeguard data using encryption, transport layer security, and effective key management during transmission, processing, and storage.

Logical Access

Learn about identity and access management to protect assets against unauthorized use.

Allow Azure Services Access to Storage Accounts

Create a Review Process of Guest Users

Disable Caching of Second Factor of Authentication Beyond One Day

Disable Public Access Level for Storage Accounts with Blob Containers

Do Not Allow Users to Remember MFA on Devices They Trust

Enable Multifactor Authentication for Administrators

Enforce Multifactor Authentication for All Users

Ensure Notifications are Enabled for Password Resets

Evaluate and Restrict UDP Access from the Internet

Notify Admins of Other Admin Password Resets

Only Allow Administrators to Delete Locked Resources

Only Allow Approved Employees to Invite Guests

Prevent Bad Passwords in Azure

Protect Against Malicious Attacks with Azure AD MFA

Require 2 Ways of Authentication for Resetting Passwords

Require Multifactor Authentication for Administrators

Restrict Access to Azure Active Directory (ADD)

Restrict Access to Azure Storage From All Networks

Restrict Access to Create Security Groups Only to Administrators

Restrict Users from Adding Apps

Restrict and Review SSH Access from the Internet

Restrict and Secure Your Azure Environment

Review and Restrict RDP Access from the Internet

Risky Sign-Ins: What They Are and How to Prevent Them

Utilize Private Endpoints to Access Storage Accounts

Verify Only Administrators Manage Group Membership Access

Network Monitoring

Network Monitoring

Learn about the tools and techniques to monitor the performance and security of your environment.

Configure Activity Log Container Access to Private

Configure Storage Accounts to Use Customer Managed Keys

Create Activity Log Alert for Delete SQL Server Firewall

Create an Activity Log Alert for Create or Update Public IP Address

Create an Activity Log Alert for Delete Security Solution

Enable Logging of Read, Write, and Delete Requests for Blob Service

Enable Logging of Read, Write, and Delete Requests for Table Service

Enable Queue Storage Logging for Read Write Access

Ensure Diagnostic Setting Captures Appropriate Categories

Ensure Log Alert Exists for Create or Update Network Security Group

Ensure Logging for AppServiceHTTPLogs

Ensure Network Security Group Flow Logs Are Sent to Log Analytics

Ensure That a Diagnostic Setting Is Enabled

Ensure an Activity Log Alert Exists for Delete Public IP Address

Log and Retain All Relevant Activities

Monitor Your Environment with Network Watcher

Monitor for "Delete Network Security Groups" Through Log Alerts

Utilize Flow Logs to Log Traffic in Your Environment

Utilize Log Alerts for Create or Update SQL Server Firewall

Utilize Log Alerts for Create or Update Security Solution

Utilize Logging for Azure Key Vault

Verify Log Alert Exists for Create Policy Assignment

Verify Log Alert Exists for Delete Policy Assignment

Vulnerability Management

Vulnerability Management

Learn about protecting your critical assets with a comprehensive program to defend against malicious threats.

Activate Microsoft Defender for Azure SQL Databases

Autoprovisioning of Microsoft Defender for Containers Components.mov

Enable Autoprovisioning of Vulnerability Assessment for Machines

Enable Microsoft Defender for DNS

Enable Microsoft Defender for IoT

Enable Microsoft Defender for Open Source Relationship Databases

Enable Microsoft Defender for SQL Server on Machines

Enable Microsoft Defender for Servers

Ensure Autoprovisioning of the Log Analytics Agent Is Enabled for Azure VMs

Ensure Microsoft Defender Is Enabled for Storage Accounts

Ensure Microsoft Defender Is Enabled for the Azure Resource Manager

Ensure Microsoft Defender for Key Vaults Is Enabled

Ensure the Minimum TLS Version for Storage Accounts Is Set to 1.2

Evaluate Public IP Addresses Regularly

Utilize Microsoft Defender for Azure Cosmos DB

Verify that Microsoft Defender is Enabled for Containers