AzInitiativeAdvertizer

last sync: 2021-Jul-08 14:19:52 UTC

Azure Policy Initiative

CIS Microsoft Azure Foundations Benchmark v1.1.0

Name CIS Microsoft Azure Foundations Benchmark v1.1.0
Azure Portal

Id 1a5bb27d-173f-493e-9568-eb56638dde4d

Version 10.1.0
details on versioning

Category Regulatory Compliance
Microsoft docs

Description This initiative includes policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure110-initiative.

Type BuiltIn

Deprecated False

Preview False

History

Date/Time (UTC ymd) (i)	Changes
2021-04-07 13:27:17	Name change: 'CIS Microsoft Azure Foundations Benchmark 1.1.0' to 'CIS Microsoft Azure Foundations Benchmark v1.1.0'
2021-03-31 14:35:06	add Policy Azure Defender for Azure SQL Database servers should be enabled (7fe3b40f-802b-4cdd-8bd4-fd799c948cc2) add Policy Azure Defender for SQL servers on machines should be enabled (6581d072-105e-4418-827f-bd446d56421b) add Policy Azure Defender for App Service should be enabled (2913021d-f2fd-4f3d-b958-22354e2bdbcb) add Policy Azure Defender for Key Vault should be enabled (0e6763cc-5078-4e64-889d-ff4d9a839047) add Policy Azure Defender for container registries should be enabled (c25d9a16-bc35-4e15-a7e5-9db606bf9ed4) add Policy Azure Defender for Kubernetes should be enabled (523b5cd1-3e23-492f-a539-13118b6d1e3a) add Policy Azure Defender for Storage should be enabled (308fbb08-4ab8-4e67-9b29-592e93fb94fa) add Policy Azure Defender for servers should be enabled (4da35fc9-c9e7-4960-aec9-797fe7d9051d) remove Policy Security Center standard pricing tier should be selected (a1181c5f-672a-477a-979a-7d58aa086233)
2021-02-17 14:28:42	add Policy Resource logs in Azure Key Vault Managed HSM should be enabled (a2a5b911-5617-447e-a49e-59dbe0e0434b) add Policy Azure Key Vault Managed HSM should have purge protection enabled (c39ba22d-4428-4149-b981-70acb31fc383)
2021-01-22 09:14:56	add Policy A vulnerability assessment solution should be enabled on your virtual machines (501541f7-f7e7-4cd6-868c-4190fdad3ac9) remove Policy [Deprecated]: A security contact phone number should be provided for your subscription (b4d66858-c922-44e3-9566-5cdb7a7be744) remove Policy [Deprecated]: Vulnerabilities should be remediated by a Vulnerability Assessment solution (760a85ff-6162-42b3-8d70-698e268f648c)
2021-01-20 16:06:15	Description change: 'This initiative includes audit policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.' to 'This initiative includes policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure110-initiative.'
2021-01-14 16:08:03	add Policy [Preview]: Storage account public access should be disallowed (4fa4b6c0-31ca-4c0d-b10d-24b96f62a751) add Policy [Preview]: Key Vault secrets should have an expiration date (98728c90-32c7-4049-8429-847dc0f4fe37) add Policy [Preview]: Key Vault keys should have an expiration date (152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0) add Policy Security Center standard pricing tier should be selected (a1181c5f-672a-477a-979a-7d58aa086233)
2020-09-02 14:03:46	add Policy Managed identity should be used in your Function App (0da106f2-4ca3-48e8-bc85-c638fe6aea8f) add Policy Managed identity should be used in your API App (c4d441f8-f9d9-4a9e-9cef-e82117cb3eef) add Policy Managed identity should be used in your Web App (2b9ad585-36bc-4615-b300-fd4435808332) remove Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on WEB App (aa81768c-cb87-4ce2-bfaa-00baa10d760c) remove Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on API app (86d97760-d216-4d81-a3ad-163087b2b6c3) remove Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Web app (843664e0-7563-41ee-a9cb-7522c382d2c4) remove Policy [Deprecated]: Ensure that 'PHP version' is the latest, if used as a part of the Function app (ab965db2-d2bf-4b64-8b39-c38ec8179461) remove Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on Function App (f0473e7a-a1ba-4e86-afb2-e829e11b01d8) remove Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Function App (10c1859c-e1a7-4df3-ab97-a487fa8059f6) remove Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the API app (c2e7ca55-f62c-49b2-89a4-d41eb661d2f0)
2020-08-21 13:50:30	remove Policy Log duration should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e8f3)
2020-07-01 14:50:07	remove Policy [Deprecated]: Advanced data security settings for SQL Managed Instance should contain an email address for security alerts (3965c43d-b5f4-482e-b74a-d89ee0e0b3a8) remove Policy [Deprecated]: Advanced Threat Protection types should be set to 'All' in SQL server Advanced Data Security settings (e756b945-1b1b-480b-8de8-9a0859d5f7ad) remove Policy [Deprecated]: Email notifications to admins should be enabled in SQL server advanced data security settings (c8343d2f-fdc9-4a97-b76f-fc71d1163bfc) remove Policy [Deprecated]: Advanced data security settings for SQL server should contain an email address to receive security alerts (9677b740-f641-4f3c-b9c5-466005c85278) remove Policy [Deprecated]: Email notifications to admins should be enabled in SQL Managed Instance advanced data security settings (aeb23562-188d-47cb-80b8-551f16ef9fff) remove Policy [Deprecated]: Advanced Threat Protection types should be set to 'All' in SQL Managed Instance advanced data security settings (bda18df3-5e41-4709-add9-2554ce68c966)
2020-06-23 16:03:23	remove Policy Security Center standard pricing tier should be selected (a1181c5f-672a-477a-979a-7d58aa086233)
2020-06-16 14:55:25	Name change: 'Audit CIS Microsoft Azure Foundations Benchmark 1.1.0 recommendations and deploy specific supporting VM extensions' to 'CIS Microsoft Azure Foundations Benchmark 1.1.0' Description change: 'This initiative includes audit and VM extension deployment policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.' to 'This initiative includes audit policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.'
2020-06-11 19:46:04	Name change: '[Preview]: Audit CIS Microsoft Azure Foundations Benchmark 1.1.0 recommendations and deploy specific supporting VM extensions' to 'Audit CIS Microsoft Azure Foundations Benchmark 1.1.0 recommendations and deploy specific supporting VM extensions'
2020-04-23 15:06:19	Description change: 'This initiative includes audit and VM Extension deployment policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, please visit https://aka.ms/cisazure-blueprint.' to 'This initiative includes audit and VM extension deployment policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.'
2020-04-22 04:43:14	add Policy Storage account containing the container with activity logs must be encrypted with BYOK (fbb99e8e-e444-4da0-9ff1-75c92f5a85b2) add Policy Authentication should be enabled on your Function app (c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8) add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a) add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a) add Policy Authentication should be enabled on your web app (95bccee9-a7f8-4bec-9ee9-62c3473701fc) add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a) add Policy An activity log alert should exist for specific Security operations (3b980d31-7904-4bb7-8575-5665739a8052) add Policy An activity log alert should exist for specific Security operations (3b980d31-7904-4bb7-8575-5665739a8052) add Policy Authentication should be enabled on your API app (c4ebc54a-46e1-481a-bee2-d4411e95d828) add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a) add Policy SSH access from the Internet should be blocked (2c89a2e5-7285-40fe-afe0-ae8654b92fab) add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a) add Policy RDP access from the Internet should be blocked (e372f825-a257-4fb8-9175-797a8a8627d6) add Policy An activity log alert should exist for specific Security operations (3b980d31-7904-4bb7-8575-5665739a8052) add Policy An activity log alert should exist for specific Policy operations (c5447c04-a4d7-4ba8-a263-c9ee321a6858) add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a)
2020-02-20 08:25:18	remove Policy [Deprecated]: Web ports should be restricted on Network Security Groups associated to your VM (201ea587-7c90-41c3-910f-c280ae01cfd6)
2019-11-20 21:24:34	add Policy Ensure that 'Java version' is the latest, if used as a part of the Function app (9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc) add Policy Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On' (5bb220d9-2698-4ee4-8404-b9c30c9df609) add Policy Ensure that 'PHP version' is the latest, if used as a part of the API app (1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba) add Policy Disconnections should be logged for PostgreSQL database servers. (eb6f77b9-bd53-4e35-a23d-7f65d5f0e446) add Policy Log connections should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e442) add Policy Latest TLS version should be used in your Function App (f9d614c5-c173-4d56-95a7-b4437057d193) add Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on Function App (f0473e7a-a1ba-4e86-afb2-e829e11b01d8) add Policy Ensure that 'HTTP Version' is the latest, if used to run the Function app (e2c1c086-2d84-4019-bff3-c44ccd95113c) add Policy Custom subscription owner roles should not exist (10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9) add Policy Ensure that 'Java version' is the latest, if used as a part of the Web app (496223c3-ad65-4ecd-878a-bae78737e9ed) add Policy Latest TLS version should be used in your Web App (f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b) add Policy Ensure that 'PHP version' is the latest, if used as a part of the WEB app (7261b898-8a84-4db8-9e04-18527132abb3) add Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Web app (843664e0-7563-41ee-a9cb-7522c382d2c4) add Policy Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On' (0c192fe8-9cbb-4516-85b3-0ade8bd03886) add Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Function App (10c1859c-e1a7-4df3-ab97-a487fa8059f6) add Policy Ensure that 'HTTP Version' is the latest, if used to run the Web app (8c122334-9d20-4eb8-89ea-ac9a705b74ae) add Policy [Deprecated]: Ensure that 'PHP version' is the latest, if used as a part of the Function app (ab965db2-d2bf-4b64-8b39-c38ec8179461) add Policy Latest TLS version should be used in your API App (8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e) add Policy Ensure that 'Python version' is the latest, if used as a part of the Function app (7238174a-fd10-4ef0-817e-fc820a951d73) add Policy Log checkpoints should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d) add Policy Function apps should have 'Client Certificates (Incoming client certificates)' enabled (eaebaea7-8013-4ceb-9d14-7eb32271373c) add Policy Ensure that 'Java version' is the latest, if used as a part of the API app (88999f4c-376a-45c8-bcb3-4058f713cf39) add Policy Log duration should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e8f3) add Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on WEB App (aa81768c-cb87-4ce2-bfaa-00baa10d760c) add Policy Ensure that 'HTTP Version' is the latest, if used to run the API app (991310cd-e9f3-47bc-b7b6-f57b557d07db) add Policy Ensure that 'Python version' is the latest, if used as a part of the Web app (7008174a-fd10-4ef0-817e-fc820a951d73) add Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on API app (86d97760-d216-4d81-a3ad-163087b2b6c3) add Policy Ensure that 'Python version' is the latest, if used as a part of the API app (74c3584d-afae-46f7-a20a-6f8adba71a16) add Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the API app (c2e7ca55-f62c-49b2-89a4-d41eb661d2f0)

Policy count Total Policies: 92
Builtin Policies: 92
Static Policies: 0

Policy used

Policy DisplayName	Policy Id	Category	Effect	State
[Preview]: Key Vault keys should have an expiration date	152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0	Key Vault	Default: Audit Allowed: (Audit, Deny, Disabled)	Preview
[Preview]: Key Vault secrets should have an expiration date	98728c90-32c7-4049-8429-847dc0f4fe37	Key Vault	Default: Audit Allowed: (Audit, Deny, Disabled)	Preview
[Preview]: Storage account public access should be disallowed	4fa4b6c0-31ca-4c0d-b10d-24b96f62a751	Storage	Default: audit Allowed: (audit, deny, disabled)	Preview
A vulnerability assessment solution should be enabled on your virtual machines	501541f7-f7e7-4cd6-868c-4190fdad3ac9	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Activity log should be retained for at least one year	b02aacc0-b073-424e-8298-42b22829ee0a	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Adaptive application controls for defining safe applications should be enabled on your machines	47a6b606-51aa-4496-8bb7-64b11cf66adc	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Adaptive network hardening recommendations should be applied on internet facing virtual machines	08e6af2d-db70-460a-bfe9-d5bd474ba9d6	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
An activity log alert should exist for specific Administrative operations	b954148f-4c11-4c38-8221-be76711e194a	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
An activity log alert should exist for specific Policy operations	c5447c04-a4d7-4ba8-a263-c9ee321a6858	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
An activity log alert should exist for specific Security operations	3b980d31-7904-4bb7-8575-5665739a8052	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
An Azure Active Directory administrator should be provisioned for SQL servers	1f314764-cb73-4fc9-b863-8eca98ac36e9	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Auditing on SQL server should be enabled	a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Authentication should be enabled on your API app	c4ebc54a-46e1-481a-bee2-d4411e95d828	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Authentication should be enabled on your Function app	c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Authentication should be enabled on your web app	95bccee9-a7f8-4bec-9ee9-62c3473701fc	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Auto provisioning of the Log Analytics agent should be enabled on your subscription	475aae12-b88a-4572-8b36-9b712b2b3a17	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for App Service should be enabled	2913021d-f2fd-4f3d-b958-22354e2bdbcb	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for Azure SQL Database servers should be enabled	7fe3b40f-802b-4cdd-8bd4-fd799c948cc2	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for container registries should be enabled	c25d9a16-bc35-4e15-a7e5-9db606bf9ed4	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for Key Vault should be enabled	0e6763cc-5078-4e64-889d-ff4d9a839047	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for Kubernetes should be enabled	523b5cd1-3e23-492f-a539-13118b6d1e3a	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for servers should be enabled	4da35fc9-c9e7-4960-aec9-797fe7d9051d	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for SQL servers on machines should be enabled	6581d072-105e-4418-827f-bd446d56421b	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for SQL should be enabled for unprotected Azure SQL servers	abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for SQL should be enabled for unprotected SQL Managed Instances	abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Defender for Storage should be enabled	308fbb08-4ab8-4e67-9b29-592e93fb94fa	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Key Vault Managed HSM should have purge protection enabled	c39ba22d-4428-4149-b981-70acb31fc383	Key Vault	Default: Audit Allowed: (Audit, Deny, Disabled)	GA
Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action'	1a4e592a-6a6e-44a5-9814-e36264ca96e7	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure Monitor should collect activity logs from all regions	41388f1c-2db0-4c25-95b2-35d7f5ccbfa9	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Azure subscriptions should have a log profile for Activity Log	7796937f-307b-4598-941c-67d3a05ebfe7	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Connection throttling should be enabled for PostgreSQL database servers	5345bb39-67dc-4960-a1bf-427e16b9a0bd	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Custom subscription owner roles should not exist	10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9	General	Default: Audit Allowed: (Audit, Disabled)	GA
Disconnections should be logged for PostgreSQL database servers.	eb6f77b9-bd53-4e35-a23d-7f65d5f0e446	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Disk encryption should be applied on virtual machines	0961003e-5a0a-4549-abde-af6a37f2724d	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Email notification for high severity alerts should be enabled	6e2593d9-add6-4083-9c9b-4b7d2188c899	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Email notification to subscription owner for high severity alerts should be enabled	0b15565f-aa9e-48ba-8619-45960f2c314d	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Enforce SSL connection should be enabled for MySQL database servers	e802a67a-daf5-4436-9ea6-f6d821dd0c5d	SQL	Default: Audit Allowed: (Audit, Disabled)	GA
Enforce SSL connection should be enabled for PostgreSQL database servers	d158790f-bfb0-486c-8631-2dc6b4e8e6af	SQL	Default: Audit Allowed: (Audit, Disabled)	GA
Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On'	0c192fe8-9cbb-4516-85b3-0ade8bd03886	App Service	Default: Audit Allowed: (Audit, Disabled)	GA
Ensure that 'HTTP Version' is the latest, if used to run the API app	991310cd-e9f3-47bc-b7b6-f57b557d07db	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'HTTP Version' is the latest, if used to run the Function app	e2c1c086-2d84-4019-bff3-c44ccd95113c	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'HTTP Version' is the latest, if used to run the Web app	8c122334-9d20-4eb8-89ea-ac9a705b74ae	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'Java version' is the latest, if used as a part of the API app	88999f4c-376a-45c8-bcb3-4058f713cf39	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'Java version' is the latest, if used as a part of the Function app	9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'Java version' is the latest, if used as a part of the Web app	496223c3-ad65-4ecd-878a-bae78737e9ed	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'PHP version' is the latest, if used as a part of the API app	1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'PHP version' is the latest, if used as a part of the WEB app	7261b898-8a84-4db8-9e04-18527132abb3	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'Python version' is the latest, if used as a part of the API app	74c3584d-afae-46f7-a20a-6f8adba71a16	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'Python version' is the latest, if used as a part of the Function app	7238174a-fd10-4ef0-817e-fc820a951d73	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure that 'Python version' is the latest, if used as a part of the Web app	7008174a-fd10-4ef0-817e-fc820a951d73	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On'	5bb220d9-2698-4ee4-8404-b9c30c9df609	App Service	Default: Audit Allowed: (Audit, Disabled)	GA
External accounts with owner permissions should be removed from your subscription	f8456c1c-aa66-4dfb-861a-25d127b775c9	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
External accounts with read permissions should be removed from your subscription	5f76cf89-fbf2-47fd-a3f4-b891fa780b60	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
External accounts with write permissions should be removed from your subscription	5c607a2e-c700-4744-8254-d77e7c9eb5e4	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Function apps should have 'Client Certificates (Incoming client certificates)' enabled	eaebaea7-8013-4ceb-9d14-7eb32271373c	App Service	Default: Audit Allowed: (Audit, Disabled)	GA
Internet-facing virtual machines should be protected with network security groups	f6de0be7-9a8a-4b8a-b349-43cf02d22f7c	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Key vaults should have purge protection enabled	0b60c0b2-2dc2-4e1c-b5c9-abbed971de53	Key Vault	Default: Audit Allowed: (Audit, Deny, Disabled)	GA
Latest TLS version should be used in your API App	8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Latest TLS version should be used in your Function App	f9d614c5-c173-4d56-95a7-b4437057d193	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Latest TLS version should be used in your Web App	f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Log checkpoints should be enabled for PostgreSQL database servers	eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Log connections should be enabled for PostgreSQL database servers	eb6f77b9-bd53-4e35-a23d-7f65d5f0e442	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Managed identity should be used in your API App	c4d441f8-f9d9-4a9e-9cef-e82117cb3eef	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Managed identity should be used in your Function App	0da106f2-4ca3-48e8-bc85-c638fe6aea8f	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Managed identity should be used in your Web App	2b9ad585-36bc-4615-b300-fd4435808332	App Service	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Management ports of virtual machines should be protected with just-in-time network access control	b0f33259-77d7-4c9e-aac6-3aabcfae693c	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
MFA should be enabled accounts with write permissions on your subscription	9297c21d-2ed6-4474-b48f-163f75654ce3	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
MFA should be enabled on accounts with owner permissions on your subscription	aa633080-8b72-40c4-a2d7-d00c03e80bed	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
MFA should be enabled on accounts with read permissions on your subscription	e3576e28-8b17-4677-84c3-db2990658d64	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Monitor missing Endpoint Protection in Azure Security Center	af6cd1bd-1635-48cb-bde7-5b15693900b9	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Network Watcher should be enabled	b6e2945c-0b7b-40f5-9233-7a5323b5cdc6	Network	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Only approved VM extensions should be installed	c0e996f8-39cf-4af9-9f45-83fbde810432	Compute	Default: Audit Allowed: (Audit, Deny, Disabled)	GA
RDP access from the Internet should be blocked	e372f825-a257-4fb8-9175-797a8a8627d6	Network	Default: Audit Allowed: (Audit, Disabled)	GA
Resource logs in Azure Key Vault Managed HSM should be enabled	a2a5b911-5617-447e-a49e-59dbe0e0434b	Key Vault	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Resource logs in Key Vault should be enabled	cf820ca0-f99e-4f3e-84fb-66e913812d21	Key Vault	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Role-Based Access Control (RBAC) should be used on Kubernetes Services	ac4a19c2-fa67-49b4-8ae5-0b2e78c49457	Security Center	Default: Audit Allowed: (Audit, Disabled)	GA
Secure transfer to storage accounts should be enabled	404c3081-a854-4457-ae30-26a93ef643f9	Storage	Default: Audit Allowed: (Audit, Deny, Disabled)	GA
SQL Auditing settings should have Action-Groups configured to capture critical activities	7ff426e2-515f-405a-91c8-4f2333442eb5	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
SQL managed instances should use customer-managed keys to encrypt data at rest	048248b0-55cd-46da-b1ff-39efd52db260	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
SQL servers should use customer-managed keys to encrypt data at rest	0d134df8-db83-46fb-ad72-fe0c9428c8dd	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
SQL servers with auditing to storage account destination should be configured with 90 days retention or higher	89099bee-89e0-4b26-a5f4-165451757743	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
SSH access from the Internet should be blocked	2c89a2e5-7285-40fe-afe0-ae8654b92fab	Network	Default: Audit Allowed: (Audit, Disabled)	GA
Storage account containing the container with activity logs must be encrypted with BYOK	fbb99e8e-e444-4da0-9ff1-75c92f5a85b2	Monitoring	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Storage accounts should allow access from trusted Microsoft services	c9d007d0-c057-4772-b18c-01e546713bcd	Storage	Default: Audit Allowed: (Audit, Deny, Disabled)	GA
Storage accounts should restrict network access	34c877ad-507e-4c82-993e-3452a6e0ad3c	Storage	Default: Audit Allowed: (Audit, Deny, Disabled)	GA
Subnets should be associated with a Network Security Group	e71308d3-144b-4262-b144-efdc3cc90517	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Subscriptions should have a contact email address for security issues	4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
System updates should be installed on your machines	86b3d65f-7626-441e-b690-81a8b71cff60	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Transparent Data Encryption on SQL databases should be enabled	17k78e20-9358-41c9-923c-fb736d382a12	SQL	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Unattached disks should be encrypted	2c89a2e5-7285-40fe-afe0-ae8654b92fb2	Compute	Default: Audit Allowed: (Audit, Disabled)	GA
Vulnerabilities in security configuration on your machines should be remediated	e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15	Security Center	Default: AuditIfNotExists Allowed: (AuditIfNotExists, Disabled)	GA
Web Application should only be accessible over HTTPS	a4af4a39-4135-47fb-b175-47fbdf85311d	App Service	Default: Audit Allowed: (Audit, Disabled)	GA

JSON

{
  "properties": {
    "displayName": "CIS Microsoft Azure Foundations Benchmark v1.1.0",
    "policyType": "BuiltIn",
    "description": "This initiative includes policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure110-initiative.",
    "metadata": {
      "version": "10.1.0",
      "category": "Regulatory Compliance"
    },
    "parameters": {
      "listOfRegionsWhereNetworkWatcherShouldBeEnabled": {
        "type": "Array",
        "metadata": {
        "displayName": "[Deprecated]: List of regions where Network Watcher should be enabled",
          "description": "To see a complete list of regions use Get-AzLocation",
          "strongType": "location",
          "deprecated": true
        },
        "defaultValue": [
          "eastus"
        ]
      },
      "NetworkWatcherResourceGroupName": {
        "type": "String",
        "metadata": {
          "displayName": "NetworkWatcher resource group name",
          "description": "Name of the resource group of NetworkWatcher, such as NetworkWatcherRG"
        },
        "defaultValue": "NetworkWatcherRG"
      },
      "listOfApprovedVMExtensions": {
        "type": "Array",
        "metadata": {
          "displayName": "List of virtual machine extensions that are approved for use",
          "description": "A semicolon-separated list of virtual machine extensions; to see a complete list of extensions, use Get-AzVMExtensionImage"
        },
        "defaultValue": [
          "AzureDiskEncryption",
          "AzureDiskEncryptionForLinux",
          "DependencyAgentWindows",
          "DependencyAgentLinux",
          "IaaSAntimalware",
          "IaaSDiagnostics",
          "LinuxDiagnostic",
          "MicrosoftMonitoringAgent",
          "NetworkWatcherAgentLinux",
          "NetworkWatcherAgentWindows",
          "OmsAgentForLinux",
          "VMSnapshot",
          "VMSnapshotLinux"
        ]
      }
    },
    "policyDefinitions": [
      {
        "policyDefinitionReferenceId": "CISv110x1x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/aa633080-8b72-40c4-a2d7-d00c03e80bed",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_1.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x1x1m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9297c21d-2ed6-4474-b48f-163f75654ce3",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_1.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x1x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e3576e28-8b17-4677-84c3-db2990658d64",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_1.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x1x3",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5f76cf89-fbf2-47fd-a3f4-b891fa780b60",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_1.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x1x3m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5c607a2e-c700-4744-8254-d77e7c9eb5e4",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_1.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x1x3mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f8456c1c-aa66-4dfb-861a-25d127b775c9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_1.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x1x23",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_1.23"
        ]
      },
      {
        "policyDefinitionReferenceId": "4da35fc9-c9e7-4960-aec9-797fe7d9051d",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4da35fc9-c9e7-4960-aec9-797fe7d9051d",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "7fe3b40f-802b-4cdd-8bd4-fd799c948cc2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7fe3b40f-802b-4cdd-8bd4-fd799c948cc2",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "308fbb08-4ab8-4e67-9b29-592e93fb94fa",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/308fbb08-4ab8-4e67-9b29-592e93fb94fa",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "523b5cd1-3e23-492f-a539-13118b6d1e3a",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/523b5cd1-3e23-492f-a539-13118b6d1e3a",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "c25d9a16-bc35-4e15-a7e5-9db606bf9ed4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c25d9a16-bc35-4e15-a7e5-9db606bf9ed4",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "6581d072-105e-4418-827f-bd446d56421b",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6581d072-105e-4418-827f-bd446d56421b",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "2913021d-f2fd-4f3d-b958-22354e2bdbcb",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2913021d-f2fd-4f3d-b958-22354e2bdbcb",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "0e6763cc-5078-4e64-889d-ff4d9a839047",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0e6763cc-5078-4e64-889d-ff4d9a839047",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/475aae12-b88a-4572-8b36-9b712b2b3a17",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x3CISv110x7x5",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86b3d65f-7626-441e-b690-81a8b71cff60",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.3",
          "CIS_Azure_1.1.0_7.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x5CISv110x7x6",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/af6cd1bd-1635-48cb-bde7-5b15693900b9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.5",
          "CIS_Azure_1.1.0_7.6"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x6CISv110x7x1CISv110x7x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.6",
          "CIS_Azure_1.1.0_7.1",
          "CIS_Azure_1.1.0_7.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x7",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/08e6af2d-db70-460a-bfe9-d5bd474ba9d6",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.7"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x9",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e71308d3-144b-4262-b144-efdc3cc90517",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.9"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x9m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f6de0be7-9a8a-4b8a-b349-43cf02d22f7c",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.9"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x10",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/501541f7-f7e7-4cd6-868c-4190fdad3ac9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.10"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x12",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b0f33259-77d7-4c9e-aac6-3aabcfae693c",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.12"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x13",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/47a6b606-51aa-4496-8bb7-64b11cf66adc",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.13"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x14CISv110x4x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.14",
          "CIS_Azure_1.1.0_4.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x15CISv110x4x9",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/17k78e20-9358-41c9-923c-fb736d382a12",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.15",
          "CIS_Azure_1.1.0_4.9"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x16",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.16"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x18",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6e2593d9-add6-4083-9c9b-4b7d2188c899",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.18"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x2x19",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0b15565f-aa9e-48ba-8619-45960f2c314d",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_2.19"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x3x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_3.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x3x6CISv110x5x1x5",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/4fa4b6c0-31ca-4c0d-b10d-24b96f62a751",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_3.6",
          "CIS_Azure_1.1.0_5.1.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x3x7",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/34c877ad-507e-4c82-993e-3452a6e0ad3c",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_3.7"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x3x8",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c9d007d0-c057-4772-b18c-01e546713bcd",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_3.8"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7ff426e2-515f-405a-91c8-4f2333442eb5",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x3",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/89099bee-89e0-4b26-a5f4-165451757743",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x4m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x8",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1f314764-cb73-4fc9-b863-8eca98ac36e9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.8"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x10",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0d134df8-db83-46fb-ad72-fe0c9428c8dd",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.10"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x10m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/048248b0-55cd-46da-b1ff-39efd52db260",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.10"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x11",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e802a67a-daf5-4436-9ea6-f6d821dd0c5d",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.11"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x12",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.12"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x13",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/d158790f-bfb0-486c-8631-2dc6b4e8e6af",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.13"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x14",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/eb6f77b9-bd53-4e35-a23d-7f65d5f0e442",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.14"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x15",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/eb6f77b9-bd53-4e35-a23d-7f65d5f0e446",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.15"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x4x17",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5345bb39-67dc-4960-a1bf-427e16b9a0bd",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_4.17"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x1x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7796937f-307b-4598-941c-67d3a05ebfe7",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.1.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x1x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b02aacc0-b073-424e-8298-42b22829ee0a",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.1.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x1x3",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1a4e592a-6a6e-44a5-9814-e36264ca96e7",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.1.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x1x4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/41388f1c-2db0-4c25-95b2-35d7f5ccbfa9",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.1.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x1x6",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/fbb99e8e-e444-4da0-9ff1-75c92f5a85b2",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.1.6"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x1x7",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/cf820ca0-f99e-4f3e-84fb-66e913812d21",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.1.7"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c5447c04-a4d7-4ba8-a263-c9ee321a6858",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Authorization/policyAssignments/write"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b954148f-4c11-4c38-8221-be76711e194a",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Network/networkSecurityGroups/write"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x3",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b954148f-4c11-4c38-8221-be76711e194a",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Network/networkSecurityGroups/delete"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b954148f-4c11-4c38-8221-be76711e194a",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Network/networkSecurityGroups/securityRules/write"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x5",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b954148f-4c11-4c38-8221-be76711e194a",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Network/networkSecurityGroups/securityRules/delete"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x6",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3b980d31-7904-4bb7-8575-5665739a8052",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Security/securitySolutions/write"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.6"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x7",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3b980d31-7904-4bb7-8575-5665739a8052",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Security/securitySolutions/delete"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.7"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x8",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b954148f-4c11-4c38-8221-be76711e194a",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Sql/servers/firewallRules/write"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.8"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x8m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b954148f-4c11-4c38-8221-be76711e194a",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Sql/servers/firewallRules/delete"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.8"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x2x9",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/3b980d31-7904-4bb7-8575-5665739a8052",
        "parameters": {
          "operationName": {
            "value": "Microsoft.Security/policies/write"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.2.9"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x6x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e372f825-a257-4fb8-9175-797a8a8627d6",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_6.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x6x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2c89a2e5-7285-40fe-afe0-ae8654b92fab",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_6.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x6x5",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/b6e2945c-0b7b-40f5-9233-7a5323b5cdc6",
        "parameters": {
          "resourceGroupName": {
          "value": "[parameters('NetworkWatcherResourceGroupName')]"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_6.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x7x3",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2c89a2e5-7285-40fe-afe0-ae8654b92fb2",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_7.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x7x4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c0e996f8-39cf-4af9-9f45-83fbde810432",
        "parameters": {
          "approvedExtensions": {
          "value": "[parameters('listOfApprovedVMExtensions')]"
          }
        },
        "groupNames": [
          "CIS_Azure_1.1.0_7.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x8x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_8.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x8x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/98728c90-32c7-4049-8429-847dc0f4fe37",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_8.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x8x4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_8.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x8x5",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/ac4a19c2-fa67-49b4-8ae5-0b2e78c49457",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_8.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x1",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c4ebc54a-46e1-481a-bee2-d4411e95d828",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x1m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x1mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/95bccee9-a7f8-4bec-9ee9-62c3473701fc",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.1"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x2",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a4af4a39-4135-47fb-b175-47fbdf85311d",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.2"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x3",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x3m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f9d614c5-c173-4d56-95a7-b4437057d193",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x3mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.3"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x4",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0c192fe8-9cbb-4516-85b3-0ade8bd03886",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x4m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/eaebaea7-8013-4ceb-9d14-7eb32271373c",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x4mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/5bb220d9-2698-4ee4-8404-b9c30c9df609",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.4"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x5",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c4d441f8-f9d9-4a9e-9cef-e82117cb3eef",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x5m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0da106f2-4ca3-48e8-bc85-c638fe6aea8f",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x5mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2b9ad585-36bc-4615-b300-fd4435808332",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.5"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x7",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.7"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x7mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7261b898-8a84-4db8-9e04-18527132abb3",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.7"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x8",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/74c3584d-afae-46f7-a20a-6f8adba71a16",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.8"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x8m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7238174a-fd10-4ef0-817e-fc820a951d73",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.8"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x8mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7008174a-fd10-4ef0-817e-fc820a951d73",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.8"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x9",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/88999f4c-376a-45c8-bcb3-4058f713cf39",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.9"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x9m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.9"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x9mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/496223c3-ad65-4ecd-878a-bae78737e9ed",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.9"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x10",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/991310cd-e9f3-47bc-b7b6-f57b557d07db",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.10"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x10m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/e2c1c086-2d84-4019-bff3-c44ccd95113c",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.10"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x9x10mm",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8c122334-9d20-4eb8-89ea-ac9a705b74ae",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_9.10"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x5x1x7m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a2a5b911-5617-447e-a49e-59dbe0e0434b",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_5.1.7"
        ]
      },
      {
        "policyDefinitionReferenceId": "CISv110x8x4m",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/c39ba22d-4428-4149-b981-70acb31fc383",
        "parameters": {
          
        },
        "groupNames": [
          "CIS_Azure_1.1.0_8.4"
        ]
      }
    ],
    "policyDefinitionGroups": [
      {
        "name": "CIS_Azure_1.1.0_1.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.1"
      },
      {
        "name": "CIS_Azure_1.1.0_1.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.5"
      },
      {
        "name": "CIS_Azure_1.1.0_1.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.6"
      },
      {
        "name": "CIS_Azure_1.1.0_1.7",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.7"
      },
      {
        "name": "CIS_Azure_1.1.0_1.15",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.15"
      },
      {
        "name": "CIS_Azure_1.1.0_1.21",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.21"
      },
      {
        "name": "CIS_Azure_1.1.0_1.22",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.22"
      },
      {
        "name": "CIS_Azure_1.1.0_1.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.2"
      },
      {
        "name": "CIS_Azure_1.1.0_1.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.3"
      },
      {
        "name": "CIS_Azure_1.1.0_1.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.4"
      },
      {
        "name": "CIS_Azure_1.1.0_1.8",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.8"
      },
      {
        "name": "CIS_Azure_1.1.0_1.9",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.9"
      },
      {
        "name": "CIS_Azure_1.1.0_1.10",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.10"
      },
      {
        "name": "CIS_Azure_1.1.0_1.11",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.11"
      },
      {
        "name": "CIS_Azure_1.1.0_1.12",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.12"
      },
      {
        "name": "CIS_Azure_1.1.0_1.13",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.13"
      },
      {
        "name": "CIS_Azure_1.1.0_1.14",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.14"
      },
      {
        "name": "CIS_Azure_1.1.0_1.16",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.16"
      },
      {
        "name": "CIS_Azure_1.1.0_1.17",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.17"
      },
      {
        "name": "CIS_Azure_1.1.0_1.18",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.18"
      },
      {
        "name": "CIS_Azure_1.1.0_1.19",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.19"
      },
      {
        "name": "CIS_Azure_1.1.0_1.20",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.20"
      },
      {
        "name": "CIS_Azure_1.1.0_1.23",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_1.23"
      },
      {
        "name": "CIS_Azure_1.1.0_2.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.1"
      },
      {
        "name": "CIS_Azure_1.1.0_2.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.2"
      },
      {
        "name": "CIS_Azure_1.1.0_2.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.3"
      },
      {
        "name": "CIS_Azure_1.1.0_2.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.4"
      },
      {
        "name": "CIS_Azure_1.1.0_2.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.5"
      },
      {
        "name": "CIS_Azure_1.1.0_2.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.6"
      },
      {
        "name": "CIS_Azure_1.1.0_2.7",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.7"
      },
      {
        "name": "CIS_Azure_1.1.0_2.8",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.8"
      },
      {
        "name": "CIS_Azure_1.1.0_2.9",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.9"
      },
      {
        "name": "CIS_Azure_1.1.0_2.10",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.10"
      },
      {
        "name": "CIS_Azure_1.1.0_2.11",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.11"
      },
      {
        "name": "CIS_Azure_1.1.0_2.12",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.12"
      },
      {
        "name": "CIS_Azure_1.1.0_2.13",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.13"
      },
      {
        "name": "CIS_Azure_1.1.0_2.14",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.14"
      },
      {
        "name": "CIS_Azure_1.1.0_2.15",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.15"
      },
      {
        "name": "CIS_Azure_1.1.0_2.16",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.16"
      },
      {
        "name": "CIS_Azure_1.1.0_2.17",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.17"
      },
      {
        "name": "CIS_Azure_1.1.0_2.18",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.18"
      },
      {
        "name": "CIS_Azure_1.1.0_2.19",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_2.19"
      },
      {
        "name": "CIS_Azure_1.1.0_3.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.1"
      },
      {
        "name": "CIS_Azure_1.1.0_3.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.2"
      },
      {
        "name": "CIS_Azure_1.1.0_3.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.4"
      },
      {
        "name": "CIS_Azure_1.1.0_3.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.5"
      },
      {
        "name": "CIS_Azure_1.1.0_3.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.6"
      },
      {
        "name": "CIS_Azure_1.1.0_3.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.3"
      },
      {
        "name": "CIS_Azure_1.1.0_3.7",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.7"
      },
      {
        "name": "CIS_Azure_1.1.0_3.8",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_3.8"
      },
      {
        "name": "CIS_Azure_1.1.0_4.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.1"
      },
      {
        "name": "CIS_Azure_1.1.0_4.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.2"
      },
      {
        "name": "CIS_Azure_1.1.0_4.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.3"
      },
      {
        "name": "CIS_Azure_1.1.0_4.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.4"
      },
      {
        "name": "CIS_Azure_1.1.0_4.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.5"
      },
      {
        "name": "CIS_Azure_1.1.0_4.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.6"
      },
      {
        "name": "CIS_Azure_1.1.0_4.7",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.7"
      },
      {
        "name": "CIS_Azure_1.1.0_4.8",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.8"
      },
      {
        "name": "CIS_Azure_1.1.0_4.9",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.9"
      },
      {
        "name": "CIS_Azure_1.1.0_4.10",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.10"
      },
      {
        "name": "CIS_Azure_1.1.0_4.11",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.11"
      },
      {
        "name": "CIS_Azure_1.1.0_4.12",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.12"
      },
      {
        "name": "CIS_Azure_1.1.0_4.13",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.13"
      },
      {
        "name": "CIS_Azure_1.1.0_4.14",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.14"
      },
      {
        "name": "CIS_Azure_1.1.0_4.15",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.15"
      },
      {
        "name": "CIS_Azure_1.1.0_4.16",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.16"
      },
      {
        "name": "CIS_Azure_1.1.0_4.17",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.17"
      },
      {
        "name": "CIS_Azure_1.1.0_4.18",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.18"
      },
      {
        "name": "CIS_Azure_1.1.0_4.19",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_4.19"
      },
      {
        "name": "CIS_Azure_1.1.0_5.1.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.1.1"
      },
      {
        "name": "CIS_Azure_1.1.0_5.1.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.1.2"
      },
      {
        "name": "CIS_Azure_1.1.0_5.1.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.1.3"
      },
      {
        "name": "CIS_Azure_1.1.0_5.1.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.1.4"
      },
      {
        "name": "CIS_Azure_1.1.0_5.1.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.1.5"
      },
      {
        "name": "CIS_Azure_1.1.0_5.1.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.1.6"
      },
      {
        "name": "CIS_Azure_1.1.0_5.1.7",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.1.7"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.1"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.2"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.3"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.4"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.5"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.6"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.7",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.7"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.8",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.8"
      },
      {
        "name": "CIS_Azure_1.1.0_5.2.9",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_5.2.9"
      },
      {
        "name": "CIS_Azure_1.1.0_6.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_6.1"
      },
      {
        "name": "CIS_Azure_1.1.0_6.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_6.2"
      },
      {
        "name": "CIS_Azure_1.1.0_6.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_6.3"
      },
      {
        "name": "CIS_Azure_1.1.0_6.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_6.5"
      },
      {
        "name": "CIS_Azure_1.1.0_6.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_6.4"
      },
      {
        "name": "CIS_Azure_1.1.0_7.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_7.1"
      },
      {
        "name": "CIS_Azure_1.1.0_7.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_7.2"
      },
      {
        "name": "CIS_Azure_1.1.0_7.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_7.3"
      },
      {
        "name": "CIS_Azure_1.1.0_7.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_7.4"
      },
      {
        "name": "CIS_Azure_1.1.0_7.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_7.5"
      },
      {
        "name": "CIS_Azure_1.1.0_7.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_7.6"
      },
      {
        "name": "CIS_Azure_1.1.0_8.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_8.1"
      },
      {
        "name": "CIS_Azure_1.1.0_8.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_8.2"
      },
      {
        "name": "CIS_Azure_1.1.0_8.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_8.4"
      },
      {
        "name": "CIS_Azure_1.1.0_8.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_8.5"
      },
      {
        "name": "CIS_Azure_1.1.0_8.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_8.3"
      },
      {
        "name": "CIS_Azure_1.1.0_9.1",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.1"
      },
      {
        "name": "CIS_Azure_1.1.0_9.2",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.2"
      },
      {
        "name": "CIS_Azure_1.1.0_9.3",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.3"
      },
      {
        "name": "CIS_Azure_1.1.0_9.4",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.4"
      },
      {
        "name": "CIS_Azure_1.1.0_9.5",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.5"
      },
      {
        "name": "CIS_Azure_1.1.0_9.6",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.6"
      },
      {
        "name": "CIS_Azure_1.1.0_9.7",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.7"
      },
      {
        "name": "CIS_Azure_1.1.0_9.8",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.8"
      },
      {
        "name": "CIS_Azure_1.1.0_9.9",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.9"
      },
      {
        "name": "CIS_Azure_1.1.0_9.10",
        "additionalMetadataId": "/providers/Microsoft.PolicyInsights/policyMetadata/CIS_Azure_1.1.0_9.10"
      }
    ]
  },
  "id": "/providers/Microsoft.Authorization/policySetDefinitions/1a5bb27d-173f-493e-9568-eb56638dde4d",
  "type": "Microsoft.Authorization/policySetDefinitions",
  "name": "1a5bb27d-173f-493e-9568-eb56638dde4d"
}