Build Azure Expertise

Run our secure Azure scan to receive a report with custom recommendations from our cloud security experts.

Start Free Scan Learn More

Unlock Free Azure Resources

Sign up to download the 20 policies you need for Azure compliance and start your cloud security journey today.

All
Configuration Management
Data Security
Logical Access
Network Monitoring
Vulnerability Management

Configuration Management

Configuration Management

Learn about configuration standards from industry leaders such as the Center for Internet Security, NIST, SANS, AWS, and Microsoft.

Configure Shared Access Security Tokens to Expire within an Hour

Disallow Other Apps to Access Company Data

Ensure Only Authorized Users Can Create Security Groups

Ensure Secure Transfer

Ensure Soft Delete Is Enabled

Leverage CIS Benchmarks for Cloud Security

Utilize Managed Disks for Virtual Machines

Data Security

Learn about practices to safeguard data using encryption, transport layer security, and effective key management during transmission, processing, and storage.

Activate Azure Key Rotation Reminders.mov

Cloud Security Posture Management

Don't Face Cloud Security Alone

Enable Role Based Access Control (RBAC) for Azure Key Vault

Encrypt Infrastructure to Further Protect Your Environment

Encrypt Storage for Critical Data with CMKs

Ensure Use of CMKs for Unattached Disks

Ensure that Virtual Hard Disks Are Encrypted

Ensure that an Expiration Date Is Set for All Keys in Non-RBAC Key Vaults

Ensure that an Expiration Date Is Set for All Secrets in Non-RBAC Key Vaults

Ensure the Key Vault Is Recoverable

Install Endpoint Protection for All Virtual Machines

Only Install Company-Approved Extensions on Your Virtual Machines

Periodically Regenerate Access Keys

Take Advantage of Automatic Key Rotation within Azure Key Vault

Utilize CMKs for OS and Data Disks

Utilize Private Endpoints for Azure Key Vault

Logical Access

Learn about identity and access management to protect assets against unauthorized use.

Allow Azure Services Access to Storage Accounts

Consider an Exclusionary Geographic Access Policy

Create a Review Process for Apps

Create a Review Process of Guest Users

Disable Caching of Second Factor of Authentication Beyond One Day

Disable Public Access Level for Storage Accounts with Blob Containers

Do Not Allow Users to Remember MFA on Devices They Trust

Enable Multifactor Authentication for Administrators

Enable Multifactor Authentication for All Users

Enforce Multifactor Authentication for All Users

Ensure Guest Accounts Are Restricted

Ensure HTTP(S) Access from the Internet Is Reviewed and Restricted

Ensure Notifications are Enabled for Password Resets

Ensure Only Administrators Can Create Groups

Evaluate and Restrict UDP Access from the Internet

Notify Admins of Other Admin Password Resets

Only Allow Administrators to Delete Locked Resources

Only Allow Approved Employees to Invite Guests

Only Allow Trusted Apps to Access Company Data

Prevent Bad Passwords in Azure

Protect Against Malicious Attacks with Azure AD MFA

Require 2 Ways of Authentication for Resetting Passwords

Require Multifactor Authentication for Administrators

Restrict Access to Azure Active Directory (ADD)

Restrict Access to Azure Storage From All Networks

Restrict Access to Create Security Groups Only to Administrators

Restrict Users from Adding Apps

Restrict and Review SSH Access from the Internet

Restrict and Secure Your Azure Environment

Review and Restrict RDP Access from the Internet

Risky Sign-Ins: What They Are and How to Prevent Them

Utilize Private Endpoints to Access Storage Accounts

Verify Only Administrators Manage Group Membership Access

Network Monitoring

Network Monitoring

Learn about the tools and techniques to monitor the performance and security of your environment.

Configure Activity Log Container Access to Private

Configure Storage Accounts to Use Customer Managed Keys

Create Activity Log Alert for Delete SQL Server Firewall

Create an Activity Log Alert for Create or Update Public IP Address

Create an Activity Log Alert for Delete Security Solution

Enable Logging of Read, Write, and Delete Requests for Blob Service

Enable Logging of Read, Write, and Delete Requests for Table Service

Enable Queue Storage Logging for Read Write Access

Ensure Diagnostic Setting Captures Appropriate Categories

Ensure Log Alert Exists for Create or Update Network Security Group

Ensure Logging for AppServiceHTTPLogs

Ensure Network Security Group Flow Logs Are Sent to Log Analytics

Ensure That a Diagnostic Setting Is Enabled

Ensure an Activity Log Alert Exists for Delete Public IP Address

Log and Retain All Relevant Activities

Monitor Your Environment with Network Watcher

Monitor for "Delete Network Security Groups" Through Log Alerts

Utilize Flow Logs to Log Traffic in Your Environment

Utilize Log Alerts for Create or Update SQL Server Firewall

Utilize Log Alerts for Create or Update Security Solution

Utilize Logging for Azure Key Vault

Verify Log Alert Exists for Create Policy Assignment

Verify Log Alert Exists for Delete Policy Assignment

Vulnerability Management

Vulnerability Management

Learn about protecting your critical assets with a comprehensive program to defend against malicious threats.

Activate Microsoft Defender for Azure SQL Databases

Autoprovisioning of Microsoft Defender for Containers Components.mov

Enable Autoprovisioning of Vulnerability Assessment for Machines

Enable Microsoft Defender for App Services

Enable Microsoft Defender for DNS

Enable Microsoft Defender for IoT

Enable Microsoft Defender for Open Source Relationship Databases

Enable Microsoft Defender for SQL Server on Machines

Enable Microsoft Defender for Servers

Ensure Autoprovisioning of the Log Analytics Agent Is Enabled for Azure VMs

Ensure Microsoft Defender Is Enabled for Storage Accounts

Ensure Microsoft Defender Is Enabled for the Azure Resource Manager

Ensure Microsoft Defender for Databases Is Enabled

Ensure Microsoft Defender for Key Vaults Is Enabled

Ensure the Minimum TLS Version for Storage Accounts Is Set to 1.2

Evaluate Public IP Addresses Regularly

Utilize Microsoft Defender for Azure Cosmos DB

Verify that Microsoft Defender is Enabled for Containers