AzPolicyAdvertizer

last sync: 2025-Jul-11 17:24:21 UTC

Automate account management | Regulatory Compliance - Operational

Azure BuiltIn Policy definition

Source Azure Portal
Display name Automate account management
Id 2cc9c165-46bd-9762-5739-d2aae5ba90a1
Version 1.1.0
Details on versioning
Versioning Versions supported for Versioning: 1
1.1.0
Built-in Versioning [Preview]
Category Regulatory Compliance
Microsoft Learn
Description CMA_0026 - Automate account management
Cloud environments AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
Available in AzUSGov The Policy is available in AzureUSGovernment cloud. Version: '1.*.*'
Additional metadata Name/Id: CMA_0026 / CMA_0026
Category: Operational
Title: Automate account management
Ownership: Customer
Description: Microsoft recommends that your organization implement automated mechanisms to support the management of accounts with access to information systems across the organization. Your organization should consider implementing account management tools that allow your organization to automate your account management process, including account requests, approvals, creation, modification, and deletion. Microsoft also recommends that your organization creates, enables, modifies, disables, and removes information system accounts as per the organization defined procedures or conditions.
Requirements: The customer is responsible for implementing this recommendation.
Mode All
Type BuiltIn
Preview False
Deprecated False
Effect Default
Manual
Allowed
Manual, Disabled
RBAC role(s) none
Rule aliases none
Rule resource types IF (1)
Compliance
The following 46 compliance controls are associated with this Policy definition 'Automate account management' (2cc9c165-46bd-9762-5739-d2aae5ba90a1)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
CIS_Azure_1.1.0 1.6 CIS_Azure_1.1.0_1.6 CIS Microsoft Azure Foundations Benchmark recommendation 1.6 1 Identity and Access Management Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0' Shared The customer is responsible for implementing this recommendation. Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. link 4
CIS_Azure_1.1.0 1.7 CIS_Azure_1.1.0_1.7 CIS Microsoft Azure Foundations Benchmark recommendation 1.7 1 Identity and Access Management Ensure that 'Notify users on password resets?' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Ensure that users are notified on their primary and secondary emails on password resets. link 5
CIS_Azure_1.1.0 1.8 CIS_Azure_1.1.0_1.8 CIS Microsoft Azure Foundations Benchmark recommendation 1.8 1 Identity and Access Management Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Ensure that all administrators are notified if any other administrator resets their password. link 10
CIS_Azure_1.1.0 4.19 CIS_Azure_1.1.0_4.19 CIS Microsoft Azure Foundations Benchmark recommendation 4.19 4 Database Services Ensure that Azure Active Directory Admin is configured Shared The customer is responsible for implementing this recommendation. Use Azure Active Directory Authentication for authentication with SQL Database. link 4
CIS_Azure_1.1.0 4.8 CIS_Azure_1.1.0_4.8 CIS Microsoft Azure Foundations Benchmark recommendation 4.8 4 Database Services Ensure that Azure Active Directory Admin is configured Shared The customer is responsible for implementing this recommendation. Use Azure Active Directory Authentication for authentication with SQL Database. link 5
CIS_Azure_1.1.0 9.5 CIS_Azure_1.1.0_9.5 CIS Microsoft Azure Foundations Benchmark recommendation 9.5 9 AppService Ensure that Register with Azure Active Directory is enabled on App Service Shared The customer is responsible for implementing this recommendation. Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords. link 6
CIS_Azure_1.3.0 1.6 CIS_Azure_1.3.0_1.6 CIS Microsoft Azure Foundations Benchmark recommendation 1.6 1 Identity and Access Management Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to "0" Shared The customer is responsible for implementing this recommendation. Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. link 4
CIS_Azure_1.3.0 1.7 CIS_Azure_1.3.0_1.7 CIS Microsoft Azure Foundations Benchmark recommendation 1.7 1 Identity and Access Management Ensure that 'Notify users on password resets?' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Ensure that users are notified on their primary and secondary emails on password resets. link 5
CIS_Azure_1.3.0 1.8 CIS_Azure_1.3.0_1.8 CIS Microsoft Azure Foundations Benchmark recommendation 1.8 1 Identity and Access Management Ensure that 'Notify all admins when other admins reset their password?' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Ensure that all administrators are notified if any other administrator resets their password. link 10
CIS_Azure_1.3.0 4.4 CIS_Azure_1.3.0_4.4 CIS Microsoft Azure Foundations Benchmark recommendation 4.4 4 Database Services Ensure that Azure Active Directory Admin is configured Shared The customer is responsible for implementing this recommendation. Use Azure Active Directory Authentication for authentication with SQL Database. link 5
CIS_Azure_1.3.0 9.5 CIS_Azure_1.3.0_9.5 CIS Microsoft Azure Foundations Benchmark recommendation 9.5 9 AppService Ensure that Register with Azure Active Directory is enabled on App Service Shared The customer is responsible for implementing this recommendation. Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords. link 6
CIS_Azure_1.4.0 1.6 CIS_Azure_1.4.0_1.6 CIS Microsoft Azure Foundations Benchmark recommendation 1.6 1 Identity and Access Management Ensure that 'Number of days before users are asked to re-confirm their authentication information' is not set to '0' Shared The customer is responsible for implementing this recommendation. Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0. link 4
CIS_Azure_1.4.0 1.7 CIS_Azure_1.4.0_1.7 CIS Microsoft Azure Foundations Benchmark recommendation 1.7 1 Identity and Access Management Ensure that 'Notify users on password resets?' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Ensure that users are notified on their primary and secondary emails on password resets. link 5
CIS_Azure_1.4.0 1.8 CIS_Azure_1.4.0_1.8 CIS Microsoft Azure Foundations Benchmark recommendation 1.8 1 Identity and Access Management Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes' Shared The customer is responsible for implementing this recommendation. Ensure that all administrators are notified if any other administrator resets their password. link 10
CIS_Azure_1.4.0 4.5 CIS_Azure_1.4.0_4.5 CIS Microsoft Azure Foundations Benchmark recommendation 4.5 4 Database Services Ensure that Azure Active Directory Admin is configured Shared The customer is responsible for implementing this recommendation. Use Azure Active Directory Authentication for authentication with SQL Database to manage credentials in a single place. link 5
CIS_Azure_1.4.0 9.5 CIS_Azure_1.4.0_9.5 CIS Microsoft Azure Foundations Benchmark recommendation 9.5 9 AppService Ensure that Register with Azure Active Directory is enabled on App Service Shared The customer is responsible for implementing this recommendation. Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords. link 6
CIS_Azure_2.0.0 4.1.4 CIS_Azure_2.0.0_4.1.4 CIS Microsoft Azure Foundations Benchmark recommendation 4.1.4 4.1 Ensure that Azure Active Directory Admin is Configured for SQL Servers Shared This will create administrative overhead with user account and permission management. For further security on these administrative accounts, you may want to consider higher tiers of AAD which support features like Multi Factor Authentication, that will cost more. Use Azure Active Directory Authentication for authentication with SQL Database to manage credentials in a single place. Azure Active Directory authentication is a mechanism to connect to Microsoft Azure SQL Database and SQL Data Warehouse by using identities in Azure Active Directory (Azure AD). With Azure AD authentication, identities of database users and other Microsoft services can be managed in one central location. Central ID management provides a single place to manage database users and simplifies permission management. - It provides an alternative to SQL Server authentication. - Helps stop the proliferation of user identities across database servers. - Allows password rotation in a single place. - Customers can manage database permissions using external (AAD) groups. - It can eliminate storing passwords by enabling integrated Windows authentication and other forms of authentication supported by Azure Active Directory. - Azure AD authentication uses contained database users to authenticate identities at the database level. - Azure AD supports token-based authentication for applications connecting to SQL Database. - Azure AD authentication supports ADFS (domain federation) or native user/password authentication for a local Azure Active Directory without domain synchronization. - Azure AD supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options — phone call, text message, smart cards with pin, or mobile app notification. link 5
CIS_Azure_2.0.0 9.5 CIS_Azure_2.0.0_9.5 CIS Microsoft Azure Foundations Benchmark recommendation 9.5 9 Ensure that Register with Azure Active Directory is enabled on App Service Shared n/a Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in App Service, the app will connect to other Azure services securely without the need for usernames and passwords. App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turn-key solution for securing access to Azure SQL Database and other Azure services. link 6
FedRAMP_High_R4 AC-2(1) FedRAMP_High_R4_AC-2(1) FedRAMP High AC-2 (1) Access Control Automated System Account Management Shared n/a The organization employs automated mechanisms to support the management of information system accounts. Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage. link 7
FedRAMP_High_R4 AC-2(4) FedRAMP_High_R4_AC-2(4) FedRAMP High AC-2 (4) Access Control Automated Audit Actions Shared n/a The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles]. Supplemental Guidance: Related controls: AU-2, AU-12. link 5
FedRAMP_Moderate_R4 AC-2(1) FedRAMP_Moderate_R4_AC-2(1) FedRAMP Moderate AC-2 (1) Access Control Automated System Account Management Shared n/a The organization employs automated mechanisms to support the management of information system accounts. Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage. link 7
FedRAMP_Moderate_R4 AC-2(4) FedRAMP_Moderate_R4_AC-2(4) FedRAMP Moderate AC-2 (4) Access Control Automated Audit Actions Shared n/a The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles]. Supplemental Guidance: Related controls: AU-2, AU-12. link 5
hipaa 11155.02i2Organizational.2-02.i hipaa-11155.02i2Organizational.2-02.i 11155.02i2Organizational.2-02.i 11 Access Control 11155.02i2Organizational.2-02.i 02.04 Termination or Change of Employment Shared n/a The organization employs automated mechanisms to notify specific personnel or roles (formally defined by the organization) upon termination of an individual. 10
hipaa 1208.09aa3System.1-09.aa hipaa-1208.09aa3System.1-09.aa 1208.09aa3System.1-09.aa 12 Audit Logging & Monitoring 1208.09aa3System.1-09.aa 09.10 Monitoring Shared n/a Audit logs are maintained for management activities, system and application startup/shutdown/errors, file changes, and security policy changes. 18
ISO27001-2013 A.12.4.1 ISO27001-2013_A.12.4.1 ISO 27001:2013 A.12.4.1 Operations Security Event Logging Shared n/a Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed. link 51
ISO27001-2013 A.12.4.3 ISO27001-2013_A.12.4.3 ISO 27001:2013 A.12.4.3 Operations Security Administrator and operator logs Shared n/a System administrator and system operator activities shall be logged and the logs protected and regularly reviewed. link 27
ISO27001-2013 A.9.1.2 ISO27001-2013_A.9.1.2 ISO 27001:2013 A.9.1.2 Access Control Access to networks and network services Shared n/a Users shall only be provided with access to the network and network services that they have been specifically authorized to use. link 29
ISO27001-2013 A.9.2.2 ISO27001-2013_A.9.2.2 ISO 27001:2013 A.9.2.2 Access Control User access provisioning Shared n/a A formal user access provisioning process shall be implemented to assign or revoke access rights for all user types to all systems and services. link 19
ISO27001-2013 A.9.2.3 ISO27001-2013_A.9.2.3 ISO 27001:2013 A.9.2.3 Access Control Management of privileged access rights Shared n/a The allocation and use of privileged access rights shall be restricted and controlled. link 31
ISO27001-2013 A.9.4.1 ISO27001-2013_A.9.4.1 ISO 27001:2013 A.9.4.1 Access Control Information access restriction Shared n/a Access to information and application system functions shall be restricted in accordance with the access control policy. link 11
mp.s.2 Protection of web services and applications mp.s.2 Protection of web services and applications 404 not found n/a n/a 102
NIST_SP_800-53_R4 AC-2(1) NIST_SP_800-53_R4_AC-2(1) NIST SP 800-53 Rev. 4 AC-2 (1) Access Control Automated System Account Management Shared n/a The organization employs automated mechanisms to support the management of information system accounts. Supplemental Guidance: The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage. link 7
NIST_SP_800-53_R4 AC-2(4) NIST_SP_800-53_R4_AC-2(4) NIST SP 800-53 Rev. 4 AC-2 (4) Access Control Automated Audit Actions Shared n/a The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles]. Supplemental Guidance: Related controls: AU-2, AU-12. link 5
NIST_SP_800-53_R5 AC-2(1) NIST_SP_800-53_R5_AC-2(1) NIST SP 800-53 Rev. 5 AC-2 (1) Access Control Automated System Account Management Shared n/a Support the management of system accounts using [Assignment: organization-defined automated mechanisms]. link 7
NIST_SP_800-53_R5 AC-2(4) NIST_SP_800-53_R5_AC-2(4) NIST SP 800-53 Rev. 5 AC-2 (4) Access Control Automated Audit Actions Shared n/a Automatically audit account creation, modification, enabling, disabling, and removal actions. link 5
op.acc.1 Identification op.acc.1 Identification 404 not found n/a n/a 63
op.acc.2 Access requirements op.acc.2 Access requirements 404 not found n/a n/a 61
op.acc.3 Segregation of functions and tasks op.acc.3 Segregation of functions and tasks 404 not found n/a n/a 41
op.acc.4 Access rights management process op.acc.4 Access rights management process 404 not found n/a n/a 38
op.acc.5 Authentication mechanism (external users) op.acc.5 Authentication mechanism (external users) 404 not found n/a n/a 69
op.exp.8 Recording of the activity op.exp.8 Recording of the activity 404 not found n/a n/a 65
op.ext.4 Interconnection of systems op.ext.4 Interconnection of systems 404 not found n/a n/a 68
PCI_DSS_v4.0 10.2.1.5 PCI_DSS_v4.0_10.2.1.5 PCI DSS v4.0 10.2.1.5 Requirement 10: Log and Monitor All Access to System Components and Cardholder Data Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events Shared n/a Audit logs capture all changes to identification and authentication credentials including, but not limited to: • Creation of new accounts. • Elevation of privileges. • All changes, additions, or deletions to accounts with administrative access. link 13
PCI_DSS_v4.0 7.3.1 PCI_DSS_v4.0_7.3.1 PCI DSS v4.0 7.3.1 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is managed via an access control system(s) Shared n/a An access control system(s) is in place that restricts access based on a user’s need to know and covers all system components. link 15
PCI_DSS_v4.0 7.3.2 PCI_DSS_v4.0_7.3.2 PCI DSS v4.0 7.3.2 Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know Access to system components and data is managed via an access control system(s) Shared n/a The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function. link 10
SWIFT_CSCF_v2022 5.1 SWIFT_CSCF_v2022_5.1 SWIFT CSCF v2022 5.1 5. Manage Identities and Segregate Privileges Enforce the security principles of need-to-know access, least privilege, and separation of duties for operator accounts. Shared n/a Accounts are defined according to the security principles of need-to-know access, least privilege, and separation of duties. link 35
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
CIS Microsoft Azure Foundations Benchmark v1.1.0 1a5bb27d-173f-493e-9568-eb56638dde4d Regulatory Compliance GA BuiltIn true
CIS Microsoft Azure Foundations Benchmark v1.3.0 612b5213-9160-4969-8578-1518bd2a000c Regulatory Compliance GA BuiltIn true
CIS Microsoft Azure Foundations Benchmark v1.4.0 c3f5c4d9-9a1d-4a99-85c0-7f93e384d5c5 Regulatory Compliance GA BuiltIn unknown
CIS Microsoft Azure Foundations Benchmark v2.0.0 06f19060-9e68-4070-92ca-f15cc126059e Regulatory Compliance GA BuiltIn unknown
FedRAMP High d5264498-16f4-418a-b659-fa7ef418175f Regulatory Compliance GA BuiltIn true
FedRAMP Moderate e95f5a9f-57ad-4d03-bb0b-b1d16db93693 Regulatory Compliance GA BuiltIn true
HITRUST/HIPAA a169a624-5599-4385-a696-c8d643089fab Regulatory Compliance GA BuiltIn unknown
ISO 27001:2013 89c6cddc-1c73-4ac1-b19c-54d1a15a42f2 Regulatory Compliance GA BuiltIn true
NIST SP 800-53 Rev. 4 cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f Regulatory Compliance GA BuiltIn true
NIST SP 800-53 Rev. 5 179d1daa-458f-4e47-8086-2a68d0d6c38f Regulatory Compliance GA BuiltIn true
PCI DSS v4 c676748e-3af9-4e22-bc28-50feed564afb Regulatory Compliance GA BuiltIn true
Spain ENS 175daf90-21e1-4fec-b745-7b4c909aa94c Regulatory Compliance GA BuiltIn unknown
SWIFT CSP-CSCF v2022 7bc7cd6c-4114-ff31-3cac-59be3157596d Regulatory Compliance GA BuiltIn unknown
History
Date/Time (UTC ymd) (i) Change type Change detail
2022-09-27 16:35:32 change Minor (1.0.0 > 1.1.0)
2022-09-02 16:33:37 add 2cc9c165-46bd-9762-5739-d2aae5ba90a1
JSON compare
compare mode: version left: version right:
JSON
api-version=2021-06-01
EPAC