| Source | Azure Portal | ||
| Display name | Microsoft Managed Control 1659 - Architecture And Provisioning For Name / Address Resolution Service | ||
| Id | 35a4102f-a778-4a2e-98c2-971056288df8 | ||
| Version | 1.0.0 Details on versioning |
||
| Category | Regulatory Compliance Microsoft Learn |
||
| Description | Microsoft implements this System and Communications Protection control | ||
| Additional metadata |
Name/Id: ACF1659 / Microsoft Managed Control 1659 Category: System and Communications Protection Title: Architecture And Provisioning For Name / Address Resolution Service Ownership: Customer, Microsoft Description: The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation. Requirements: The Azure DNS offering provides name and address resolution. Fault tolerance is built into the service through redundancy at multiple levels, including multiple DNS server clusters and multiple servers per cluster, and deployment at multiple Azure datacenter facilities which are geographically separated. Azure DNS also leverages network controls to restrict type of hosts that can access an authoritative DNS server in a particular role. The implementation incorporates a master repository of DNS zones. Master repository is deployed in multiple datacenters across different geographical regions for redundancy purposes. Data from master repository is pulled into edge DNS servers on demand for resolving authoritative DNS queries. Data from master repository is backed up and monitored with the security incident and event management tool as documented in the AU family of controls. Additionally, a backup system built using a completely different hardware and software system stack is implemented and kept in sync with the master repository. This system is engaged in case of a catastrophic failure of the primary system. Azure DNS recursive resolver service has built-in cross region failover capability that automatically switches the DNS traffic to another region in case there is a catastrophic failure of DNS resolution in one region. |
||
| Mode | Indexed | ||
| Type | Static | ||
| Preview | False | ||
| Deprecated | False | ||
| Effect | Fixed audit |
||
| RBAC role(s) | none | ||
| Rule aliases | none | ||
| Rule resource types | IF (2) Microsoft.Resources/subscriptions Microsoft.Resources/subscriptions/resourceGroups |
||
| Compliance | Not a Compliance control | ||
| Initiatives usage | none | ||
| History | none | ||
| JSON compare | n/a | ||
| JSON |
|