AzInitiativeAdvertizer

last sync: 2025-Jul-14 17:22:34 UTC

CIS Microsoft Azure Foundations Benchmark v1.1.0

Azure BuiltIn Policy Initiative (PolicySet)

Source Azure Portal
Display nameCIS Microsoft Azure Foundations Benchmark v1.1.0
Id1a5bb27d-173f-493e-9568-eb56638dde4d
Version16.10.0
Details on versioning
Versioning Versions supported for Versioning: 9
16.10.0
16.9.0
16.8.0
16.7.0
16.6.0
16.5.0
16.4.0
16.3.0
16.2.0
Built-in Versioning [Preview]
CategoryRegulatory Compliance
Microsoft Learn
DescriptionThe Center for Internet Security (CIS) is a nonprofit entity whose mission is to 'identify, develop, validate, promote, and sustain best practice solutions for cyberdefense.' CIS benchmarks are configuration baselines and best practices for securely configuring a system. These policies address a subset of CIS Microsoft Azure Foundations Benchmark v1.1.0 controls. For more information, visit https://aka.ms/cisazure110-initiative
Cloud environmentsAzureCloud = true
AzureChinaCloud = unknown
AzureUSGovernment = true
Available in AzUSGovThe PolicySet is available in AzureUSGovernment cloud. Version: '15.9.0'
Repository: Azure-Policy 1a5bb27d-173f-493e-9568-eb56638dde4d
TypeBuiltIn
DeprecatedFalse
PreviewFalse
Policy-used summary
Policy types Policy states Policy categories
Total Policies: 146
Builtin Policies: 146
Static Policies: 0
Deprecated: 1
GA: 152
9 categories:
App Service: 11
Compute: 1
Key Vault: 6
Monitoring: 15
Network: 1
Regulatory Compliance: 82
Security Center: 18
SQL: 15
Storage: 4
Policy-used
Policy DisplayName Policy Id Category Version Versioning Effect Roles# Roles State policy in AzUSGov
[Deprecated]: Function apps should have 'Client Certificates (Incoming client certificates)' enabled eaebaea7-8013-4ceb-9d14-7eb32271373c App Service 3.1.0 (3.1.0-deprecated) 1x
3.1.0		 Default
Disabled
Allowed
Audit, Disabled		 0 Deprecated true
A vulnerability assessment solution should be enabled on your virtual machines 501541f7-f7e7-4cd6-868c-4190fdad3ac9 Security Center 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Activity log should be retained for at least one year b02aacc0-b073-424e-8298-42b22829ee0a Monitoring 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Adhere to retention periods defined 1ecb79d7-1a06-9a3b-3be8-f434d04d1ec1 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Adopt biometric authentication mechanisms 7d7a8356-5c34-9a95-3118-1424cfaf192a Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Alert personnel of information spillage 9622aaa9-5c49-40e2-5bf8-660b7cd23deb Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
An activity log alert should exist for specific Administrative operations b954148f-4c11-4c38-8221-be76711e194a Monitoring 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
An activity log alert should exist for specific Policy operations c5447c04-a4d7-4ba8-a263-c9ee321a6858 Monitoring 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
An activity log alert should exist for specific Security operations 3b980d31-7904-4bb7-8575-5665739a8052 Monitoring 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
An Azure Active Directory administrator should be provisioned for SQL servers 1f314764-cb73-4fc9-b863-8eca98ac36e9 SQL 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
App Service apps should have authentication enabled 95bccee9-a7f8-4bec-9ee9-62c3473701fc App Service 2.0.1 1x
2.0.1		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
App Service apps should have Client Certificates (Incoming client certificates) enabled 19dd1db6-f442-49cf-a838-b0786b4401ef App Service 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
App Service apps should only be accessible over HTTPS a4af4a39-4135-47fb-b175-47fbdf85311d App Service 4.0.0 1x
4.0.0		 Default
Audit
Allowed
Audit, Disabled, Deny		 0 GA true
App Service apps should use latest 'HTTP Version' 8c122334-9d20-4eb8-89ea-ac9a705b74ae App Service 4.0.0 1x
4.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
App Service apps should use managed identity 2b9ad585-36bc-4615-b300-fd4435808332 App Service 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
App Service apps should use the latest TLS version f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b App Service 2.1.0 2x
2.1.0, 2.0.1		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Audit privileged functions f26af0b1-65b6-689a-a03f-352ad2d00f98 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Audit user account status 49c23d9b-02b0-0e42-4f94-e8cef1b8381b Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Auditing on SQL server should be enabled a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9 SQL 2.0.0 1x
2.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Authenticate to cryptographic module 6f1de470-79f3-1572-866e-db0771352fc8 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Authorize access to security functions and information aeed863a-0f56-429f-945d-8bb66bd06841 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Authorize and manage access 50e9324a-7410-0539-0662-2c1e775538b7 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Authorize remote access dad8a2e9-6f27-4fc2-8933-7e99fe700c9c Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Automate account management 2cc9c165-46bd-9762-5739-d2aae5ba90a1 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Azure Defender for App Service should be enabled 2913021d-f2fd-4f3d-b958-22354e2bdbcb Security Center 1.0.3 1x
1.0.3		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA unknown
Azure Defender for Azure SQL Database servers should be enabled 7fe3b40f-802b-4cdd-8bd4-fd799c948cc2 Security Center 1.0.2 1x
1.0.2		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Azure Defender for Key Vault should be enabled 0e6763cc-5078-4e64-889d-ff4d9a839047 Security Center 1.0.3 1x
1.0.3		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA unknown
Azure Defender for servers should be enabled 4da35fc9-c9e7-4960-aec9-797fe7d9051d Security Center 1.0.3 1x
1.0.3		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Azure Defender for SQL servers on machines should be enabled 6581d072-105e-4418-827f-bd446d56421b Security Center 1.0.2 1x
1.0.2		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA unknown
Azure Defender for SQL should be enabled for unprotected Azure SQL servers abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9 SQL 2.0.1 1x
2.0.1		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Azure Defender for SQL should be enabled for unprotected SQL Managed Instances abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9 SQL 1.0.2 1x
1.0.2		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Azure Key Vault Managed HSM should have purge protection enabled c39ba22d-4428-4149-b981-70acb31fc383 Key Vault 1.0.0 1x
1.0.0		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA unknown
Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action' 1a4e592a-6a6e-44a5-9814-e36264ca96e7 Monitoring 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Azure Monitor should collect activity logs from all regions 41388f1c-2db0-4c25-95b2-35d7f5ccbfa9 Monitoring 2.0.0 1x
2.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Azure subscriptions should have a log profile for Activity Log 7796937f-307b-4598-941c-67d3a05ebfe7 Monitoring 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Block untrusted and unsigned processes that run from USB 3d399cf3-8fc6-0efc-6ab0-1412f1198517 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Configure Azure Audit capabilities a3e98638-51d4-4e28-910a-60e98c1a756f Regulatory Compliance 1.1.1 1x
1.1.1		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Configure workstations to check for digital certificates 26daf649-22d1-97e9-2a8a-01b182194d59 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Connection throttling should be enabled for PostgreSQL database servers 5345bb39-67dc-4960-a1bf-427e16b9a0bd SQL 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Control information flow 59bedbdc-0ba9-39b9-66bb-1d1c192384e6 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Define a physical key management process 51e4b233-8ee3-8bdc-8f5f-f33bd0d229b7 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Define cryptographic use c4ccd607-702b-8ae6-8eeb-fc3339cd4b42 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Define organizational requirements for cryptographic key management d661e9eb-4e15-5ba1-6f02-cdc467db0d6c Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Design an access control model 03b6427e-6072-4226-4bd9-a410ab65317e Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Detect network services that have not been authorized or approved 86ecd378-a3a0-5d5b-207c-05e6aaca43fc Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Determine assertion requirements 7a0ecd94-3699-5273-76a5-edb8499f655a Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Determine auditable events 2f67e567-03db-9d1f-67dc-b6ffb91312f4 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Develop an incident response plan 2b4e134f-1e4c-2bff-573e-082d85479b6e Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Disable authenticators upon termination d9d48ffb-0d8c-0bd5-5f31-5a5826d19f10 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Disconnections should be logged for PostgreSQL database servers. eb6f77b9-bd53-4e35-a23d-7f65d5f0e446 SQL 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Document mobility training 83dfb2b8-678b-20a0-4c44-5c75ada023e6 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Document remote access guidelines 3d492600-27ba-62cc-a1c3-66eb919f6a0d Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Document security operations 2c6bee3a-2180-2430-440d-db3c7a849870 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Email notification for high severity alerts should be enabled 6e2593d9-add6-4083-9c9b-4b7d2188c899 Security Center 1.2.0 3x
1.2.0, 1.1.0, 1.0.1		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Email notification to subscription owner for high severity alerts should be enabled 0b15565f-aa9e-48ba-8619-45960f2c314d Security Center 2.1.0 2x
2.1.0, 2.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Employ flow control mechanisms of encrypted information 79365f13-8ba4-1f6c-2ac4-aa39929f56d0 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Employ least privilege access 1bc7fd64-291f-028e-4ed6-6e07886e163f Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Enable dual or joint authorization 2c843d78-8f64-92b5-6a9b-e8186c0e7eb6 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Enforce logical access 10c4210b-3ec9-9603-050d-77e4d26c7ebb Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Enforce mandatory and discretionary access control policies b1666a13-8f67-9c47-155e-69e027ff6823 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Enforce SSL connection should be enabled for MySQL database servers e802a67a-daf5-4436-9ea6-f6d821dd0c5d SQL 1.0.1 1x
1.0.1		 Default
Audit
Allowed
Audit, Disabled		 0 GA true
Enforce SSL connection should be enabled for PostgreSQL database servers d158790f-bfb0-486c-8631-2dc6b4e8e6af SQL 1.0.1 1x
1.0.1		 Default
Audit
Allowed
Audit, Disabled		 0 GA true
Enforce user uniqueness e336d5f4-4d8f-0059-759c-ae10f63d1747 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Establish a data leakage management procedure 3c9aa856-6b86-35dc-83f4-bc72cec74dea Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Establish and document change control processes bd4dc286-2f30-5b95-777c-681f3a7913d3 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Establish firewall and router configuration standards 398fdbd8-56fd-274d-35c6-fa2d3b2755a1 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Establish network segmentation for card holder data environment f476f3b0-4152-526e-a209-44e5f8c968d7 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Function apps should have authentication enabled c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8 App Service 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Function apps should use latest 'HTTP Version' e2c1c086-2d84-4019-bff3-c44ccd95113c App Service 4.0.0 1x
4.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Function apps should use managed identity 0da106f2-4ca3-48e8-bc85-c638fe6aea8f App Service 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Function apps should use the latest TLS version f9d614c5-c173-4d56-95a7-b4437057d193 App Service 2.1.0 2x
2.1.0, 2.0.1		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Govern and monitor audit processing activities 333b4ada-4a02-0648-3d4d-d812974f1bb2 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Guest accounts with owner permissions on Azure resources should be removed 339353f6-2387-4a45-abe4-7f529d121046 Security Center 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Guest accounts with read permissions on Azure resources should be removed e9ac8f8e-ce22-4355-8f04-99b911d6be52 Security Center 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Guest accounts with write permissions on Azure resources should be removed 94e1c2ac-cbbe-4cac-a2b5-389c812dee87 Security Center 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Identify and authenticate network devices ae5345d5-8dab-086a-7290-db43a3272198 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Identify and manage downstream information exchanges c7fddb0e-3f44-8635-2b35-dc6b8e740b7c Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Implement controls to secure all media e435f7e3-0dd9-58c9-451f-9b44b96c0232 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Implement controls to secure alternate work sites cd36eeec-67e7-205a-4b64-dbfe3b4e3e4e Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Implement training for protecting authenticators e4b00788-7e1c-33ec-0418-d048508e095b Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Internet-facing virtual machines should be protected with network security groups f6de0be7-9a8a-4b8a-b349-43cf02d22f7c Security Center 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Issue public key certificates 97d91b33-7050-237b-3e23-a77d57d84e13 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Key Vault keys should have an expiration date 152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 Key Vault 1.0.2 1x
1.0.2		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
Key Vault secrets should have an expiration date 98728c90-32c7-4049-8429-847dc0f4fe37 Key Vault 1.0.2 1x
1.0.2		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
Key vaults should have deletion protection enabled 0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 Key Vault 2.1.0 1x
2.1.0		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
Log checkpoints should be enabled for PostgreSQL database servers eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d SQL 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Log connections should be enabled for PostgreSQL database servers eb6f77b9-bd53-4e35-a23d-7f65d5f0e442 SQL 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Maintain availability of information 3ad7f0bc-3d03-0585-4d24-529779bb02c2 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Maintain integrity of audit system c0559109-6a27-a217-6821-5a6d44f92897 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA unknown
Manage gateways 63f63e71-6c3f-9add-4c43-64de23e554a7 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Manage symmetric cryptographic keys 9c276cf3-596f-581a-7fbd-f5e46edaa0f4 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Manage system and admin accounts 34d38ea7-6754-1838-7031-d7fd07099821 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Management ports of virtual machines should be protected with just-in-time network access control b0f33259-77d7-4c9e-aac6-3aabcfae693c Security Center 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Microsoft Defender for Containers should be enabled 1c988dd6-ade4-430f-a608-2a3e5b0a6d38 Security Center 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Microsoft Defender for Storage should be enabled 640d2586-54d2-465f-877f-9ffc1d2109f4 Security Center 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA unknown
Monitor access across the organization 48c816c5-2190-61fc-8806-25d6f3df162f Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Monitor privileged role assignment ed87d27a-9abf-7c71-714c-61d881889da4 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Network Watcher should be enabled b6e2945c-0b7b-40f5-9233-7a5323b5cdc6 Network 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Notify when account is not needed 8489ff90-8d29-61df-2d84-f9ab0f4c5e84 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Only approved VM extensions should be installed c0e996f8-39cf-4af9-9f45-83fbde810432 Compute 1.0.0 1x
1.0.0		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
Perform a trend analysis on threats 50e81644-923d-33fc-6ebb-9733bc8d1a06 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Perform vulnerability scans 3c5e0e1a-216f-8f49-0a15-76ed0d8b8e1f Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Protect audit information 0e696f5a-451f-5c15-5532-044136538491 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Protect data in transit using encryption b11697e8-9515-16f1-7a35-477d5c8a1344 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Protect passwords with encryption b2d3e5a2-97ab-5497-565a-71172a729d93 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Protect special information a315c657-4a00-8eba-15ac-44692ad24423 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Provide privacy training 518eafdd-08e5-37a9-795b-15a8d798056d Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Reassign or remove user privileges as needed 7805a343-275c-41be-9d62-7215b96212d8 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Remediate information system flaws be38a620-000b-21cf-3cb3-ea151b704c3b Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Require approval for account creation de770ba6-50dd-a316-2932-e0d972eaa734 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Resource logs in Azure Key Vault Managed HSM should be enabled a2a5b911-5617-447e-a49e-59dbe0e0434b Key Vault 1.1.0 1x
1.1.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA unknown
Resource logs in Key Vault should be enabled cf820ca0-f99e-4f3e-84fb-66e913812d21 Key Vault 5.0.0 1x
5.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Restrict access to private keys 8d140e8b-76c7-77de-1d46-ed1b2e112444 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Restrict access to privileged accounts 873895e8-0e3a-6492-42e9-22cd030e9fcd Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Retain security policies and procedures efef28d0-3226-966a-a1e8-70e89c1b30bc Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Retain terminated user data 7c7032fe-9ce6-9092-5890-87a1a3755db1 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Review account provisioning logs a830fe9e-08c9-a4fb-420c-6f6bf1702395 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Review audit data 6625638f-3ba1-7404-5983-0ea33d719d34 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Review malware detections report weekly 4a6f5cbd-6c6b-006f-2bb1-091af1441bce Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Review threat protection status weekly fad161f5-5261-401a-22dd-e037bae011bd Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Review user accounts 79f081c7-1634-01a1-708e-376197999289 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Review user groups and applications with access to sensitive data eb1c944e-0e94-647b-9b7e-fdb8d2af0838 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Review user privileges f96d2186-79df-262d-3f76-f371e3b71798 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Revoke privileged roles as appropriate 32f22cfa-770b-057c-965b-450898425519 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Role-Based Access Control (RBAC) should be used on Kubernetes Services ac4a19c2-fa67-49b4-8ae5-0b2e78c49457 Security Center 1.1.0 3x
1.1.0, 1.0.4, 1.0.3		 Default
Audit
Allowed
Audit, Disabled		 0 GA true
Satisfy token quality requirements 056a723b-4946-9d2a-5243-3aa27c4d31a1 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Secure transfer to storage accounts should be enabled 404c3081-a854-4457-ae30-26a93ef643f9 Storage 2.0.0 1x
2.0.0		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
Set automated notifications for new and trending cloud applications in your organization af38215f-70c4-0cd6-40c2-c52d86690a45 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
SQL Auditing settings should have Action-Groups configured to capture critical activities 7ff426e2-515f-405a-91c8-4f2333442eb5 SQL 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
SQL managed instances should use customer-managed keys to encrypt data at rest ac01ad65-10e5-46df-bdd9-6b0cad13e1d2 SQL 2.0.0 1x
2.0.0		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
SQL servers should use customer-managed keys to encrypt data at rest 0a370ff3-6cab-4e85-8995-295fd854c5b8 SQL 2.0.1 1x
2.0.1		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
SQL servers with auditing to storage account destination should be configured with 90 days retention or higher 89099bee-89e0-4b26-a5f4-165451757743 SQL 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Storage account containing the container with activity logs must be encrypted with BYOK fbb99e8e-e444-4da0-9ff1-75c92f5a85b2 Monitoring 1.0.0 1x
1.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Storage account public access should be disallowed 4fa4b6c0-31ca-4c0d-b10d-24b96f62a751 Storage 3.1.1 2x
3.1.1, 3.1.0-preview		 Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled		 0 GA unknown
Storage accounts should allow access from trusted Microsoft services c9d007d0-c057-4772-b18c-01e546713bcd Storage 1.0.0 1x
1.0.0		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
Storage accounts should restrict network access 34c877ad-507e-4c82-993e-3452a6e0ad3c Storage 1.1.1 1x
1.1.1		 Default
Audit
Allowed
Audit, Deny, Disabled		 0 GA true
Subnets should be associated with a Network Security Group e71308d3-144b-4262-b144-efdc3cc90517 Security Center 3.0.0 1x
3.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Subscriptions should have a contact email address for security issues 4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7 Security Center 1.0.1 1x
1.0.1		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Support personal verification credentials issued by legal authorities 1d39b5d9-0392-8954-8359-575ce1957d1a Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Terminate user session automatically 4502e506-5f35-0df4-684f-b326e3cc7093 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Transparent Data Encryption on SQL databases should be enabled 17k78e20-9358-41c9-923c-fb736d382a12 SQL 2.0.0 1x
2.0.0		 Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled		 0 GA true
Turn on sensors for endpoint security solution 5fc24b95-53f7-0ed1-2330-701b539b97fe Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Update antivirus definitions ea9d7c95-2f10-8a4d-61d8-7469bd2e8d65 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Use privileged identity management e714b481-8fac-64a2-14a9-6f079b2501a4 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Verify security functions ece8bb17-4080-5127-915f-dc7267ee8549 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Verify software, firmware and information integrity db28735f-518f-870e-15b4-49623cbe3aa0 Regulatory Compliance 1.1.0 1x
1.1.0		 Default
Manual
Allowed
Manual, Disabled		 0 GA true
Roles used No Roles used
History
Date/Time (UTC ymd) (i) Changes
2025-03-12 18:29:00 Version change: '16.9.0' to '16.10.0'
remove Policy [Deprecated]: Vulnerabilities in security configuration on your machines should be remediated (e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15)
2025-01-28 19:35:17 Version change: '16.8.0' to '16.9.0'
remove Policy [Deprecated]: Accounts with owner permissions on Azure resources should be MFA enabled (e3e008c3-56b9-4133-8fd7-d3347377402a)
remove Policy [Deprecated]: Accounts with write permissions on Azure resources should be MFA enabled (931e118d-50a1-4457-a5e4-78550e086c52)
remove Policy [Deprecated]: Accounts with read permissions on Azure resources should be MFA enabled (81b3ccb4-e6e8-4e4a-8d05-5df25cd29fd4)
2024-10-15 17:53:51 Version change: '16.7.0' to '16.8.0'
remove Policy [Deprecated]: System updates should be installed on your machines (86b3d65f-7626-441e-b690-81a8b71cff60)
2024-09-05 17:48:45 Version change: '16.6.0' to '16.7.0'
remove Policy [Deprecated]: Auto provisioning of the Log Analytics agent should be enabled on your subscription (475aae12-b88a-4572-8b36-9b712b2b3a17)
remove Policy [Deprecated]: Adaptive network hardening recommendations should be applied on internet facing virtual machines (08e6af2d-db70-460a-bfe9-d5bd474ba9d6)
remove Policy [Deprecated]: Adaptive application controls for defining safe applications should be enabled on your machines (47a6b606-51aa-4496-8bb7-64b11cf66adc)
2024-08-29 17:47:54 Version change: '16.5.0' to '16.6.0'
remove Policy [Deprecated]: Monitor missing Endpoint Protection in Azure Security Center (af6cd1bd-1635-48cb-bde7-5b15693900b9)
2024-06-06 18:16:34 Version change: '16.4.0' to '16.5.0'
remove Policy [Deprecated]: Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources (0961003e-5a0a-4549-abde-af6a37f2724d)
2023-12-12 19:47:53 add Policy App Service apps should have Client Certificates (Incoming client certificates) enabled (19dd1db6-f442-49cf-a838-b0786b4401ef)
Version change: '16.3.0' to '16.4.0'
remove Policy [Deprecated]: App Service apps should have 'Client Certificates (Incoming client certificates)' enabled (5bb220d9-2698-4ee4-8404-b9c30c9df609)
2023-12-07 18:54:02 add Policy Microsoft Defender for Storage should be enabled (640d2586-54d2-465f-877f-9ffc1d2109f4)
Version change: '16.2.0' to '16.3.0'
remove Policy [Deprecated]: Microsoft Defender for Storage (Classic) should be enabled (308fbb08-4ab8-4e67-9b29-592e93fb94fa)
2023-05-04 17:45:12 add Policy Guest accounts with owner permissions on Azure resources should be removed (339353f6-2387-4a45-abe4-7f529d121046)
add Policy [Deprecated]: Accounts with write permissions on Azure resources should be MFA enabled (931e118d-50a1-4457-a5e4-78550e086c52)
add Policy Guest accounts with write permissions on Azure resources should be removed (94e1c2ac-cbbe-4cac-a2b5-389c812dee87)
add Policy Guest accounts with read permissions on Azure resources should be removed (e9ac8f8e-ce22-4355-8f04-99b911d6be52)
add Policy [Deprecated]: Accounts with owner permissions on Azure resources should be MFA enabled (e3e008c3-56b9-4133-8fd7-d3347377402a)
add Policy [Deprecated]: Accounts with read permissions on Azure resources should be MFA enabled (81b3ccb4-e6e8-4e4a-8d05-5df25cd29fd4)
Version change: '16.0.0' to '16.2.0'
remove Policy [Deprecated]: External accounts with read permissions should be removed from your subscription (5f76cf89-fbf2-47fd-a3f4-b891fa780b60)
remove Policy [Deprecated]: External accounts with owner permissions should be removed from your subscription (f8456c1c-aa66-4dfb-861a-25d127b775c9)
remove Policy App Service apps that use Java should use a specified 'Java version' (496223c3-ad65-4ecd-878a-bae78737e9ed)
remove Policy [Deprecated]: MFA should be enabled for accounts with write permissions on your subscription (9297c21d-2ed6-4474-b48f-163f75654ce3)
remove Policy Function apps that use Python should use a specified 'Python version' (7238174a-fd10-4ef0-817e-fc820a951d73)
remove Policy App Service apps that use PHP should use a specified 'PHP version' (7261b898-8a84-4db8-9e04-18527132abb3)
remove Policy [Deprecated]: External accounts with write permissions should be removed from your subscription (5c607a2e-c700-4744-8254-d77e7c9eb5e4)
remove Policy [Deprecated]: MFA should be enabled on accounts with read permissions on your subscription (e3576e28-8b17-4677-84c3-db2990658d64)
remove Policy App Service apps that use Python should use a specified 'Python version' (7008174a-fd10-4ef0-817e-fc820a951d73)
remove Policy [Deprecated]: MFA should be enabled on accounts with owner permissions on your subscription (aa633080-8b72-40c4-a2d7-d00c03e80bed)
remove Policy Function apps that use Java should use a specified 'Java version' (9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc)
2022-09-16 16:31:45 add Policy Determine auditable events (2f67e567-03db-9d1f-67dc-b6ffb91312f4)
add Policy Turn on sensors for endpoint security solution (5fc24b95-53f7-0ed1-2330-701b539b97fe)
add Policy Verify software, firmware and information integrity (db28735f-518f-870e-15b4-49623cbe3aa0)
add Policy Authorize and manage access (50e9324a-7410-0539-0662-2c1e775538b7)
add Policy Disable authenticators upon termination (d9d48ffb-0d8c-0bd5-5f31-5a5826d19f10)
add Policy Enforce mandatory and discretionary access control policies (b1666a13-8f67-9c47-155e-69e027ff6823)
add Policy Satisfy token quality requirements (056a723b-4946-9d2a-5243-3aa27c4d31a1)
add Policy Authorize remote access (dad8a2e9-6f27-4fc2-8933-7e99fe700c9c)
add Policy Maintain availability of information (3ad7f0bc-3d03-0585-4d24-529779bb02c2)
add Policy Implement controls to secure alternate work sites (cd36eeec-67e7-205a-4b64-dbfe3b4e3e4e)
add Policy Manage symmetric cryptographic keys (9c276cf3-596f-581a-7fbd-f5e46edaa0f4)
add Policy Define organizational requirements for cryptographic key management (d661e9eb-4e15-5ba1-6f02-cdc467db0d6c)
add Policy Review user privileges (f96d2186-79df-262d-3f76-f371e3b71798)
add Policy Reassign or remove user privileges as needed (7805a343-275c-41be-9d62-7215b96212d8)
add Policy Retain terminated user data (7c7032fe-9ce6-9092-5890-87a1a3755db1)
add Policy Determine assertion requirements (7a0ecd94-3699-5273-76a5-edb8499f655a)
add Policy Protect special information (a315c657-4a00-8eba-15ac-44692ad24423)
add Policy Review threat protection status weekly (fad161f5-5261-401a-22dd-e037bae011bd)
add Policy Enforce logical access (10c4210b-3ec9-9603-050d-77e4d26c7ebb)
add Policy Establish and document change control processes (bd4dc286-2f30-5b95-777c-681f3a7913d3)
add Policy Review malware detections report weekly (4a6f5cbd-6c6b-006f-2bb1-091af1441bce)
add Policy Review user groups and applications with access to sensitive data (eb1c944e-0e94-647b-9b7e-fdb8d2af0838)
add Policy Support personal verification credentials issued by legal authorities (1d39b5d9-0392-8954-8359-575ce1957d1a)
add Policy Govern and monitor audit processing activities (333b4ada-4a02-0648-3d4d-d812974f1bb2)
add Policy Require approval for account creation (de770ba6-50dd-a316-2932-e0d972eaa734)
add Policy Provide privacy training (518eafdd-08e5-37a9-795b-15a8d798056d)
add Policy Document security operations (2c6bee3a-2180-2430-440d-db3c7a849870)
add Policy Manage gateways (63f63e71-6c3f-9add-4c43-64de23e554a7)
add Policy Control information flow (59bedbdc-0ba9-39b9-66bb-1d1c192384e6)
add Policy Manage system and admin accounts (34d38ea7-6754-1838-7031-d7fd07099821)
add Policy Enforce user uniqueness (e336d5f4-4d8f-0059-759c-ae10f63d1747)
add Policy Monitor access across the organization (48c816c5-2190-61fc-8806-25d6f3df162f)
add Policy Monitor privileged role assignment (ed87d27a-9abf-7c71-714c-61d881889da4)
add Policy Restrict access to private keys (8d140e8b-76c7-77de-1d46-ed1b2e112444)
add Policy Configure Azure Audit capabilities (a3e98638-51d4-4e28-910a-60e98c1a756f)
add Policy Review account provisioning logs (a830fe9e-08c9-a4fb-420c-6f6bf1702395)
add Policy Issue public key certificates (97d91b33-7050-237b-3e23-a77d57d84e13)
add Policy Establish network segmentation for card holder data environment (f476f3b0-4152-526e-a209-44e5f8c968d7)
add Policy Define a physical key management process (51e4b233-8ee3-8bdc-8f5f-f33bd0d229b7)
add Policy Protect passwords with encryption (b2d3e5a2-97ab-5497-565a-71172a729d93)
add Policy Audit user account status (49c23d9b-02b0-0e42-4f94-e8cef1b8381b)
add Policy Authorize access to security functions and information (aeed863a-0f56-429f-945d-8bb66bd06841)
add Policy Employ least privilege access (1bc7fd64-291f-028e-4ed6-6e07886e163f)
add Policy Update antivirus definitions (ea9d7c95-2f10-8a4d-61d8-7469bd2e8d65)
add Policy Adopt biometric authentication mechanisms (7d7a8356-5c34-9a95-3118-1424cfaf192a)
add Policy Revoke privileged roles as appropriate (32f22cfa-770b-057c-965b-450898425519)
add Policy Protect audit information (0e696f5a-451f-5c15-5532-044136538491)
add Policy Block untrusted and unsigned processes that run from USB (3d399cf3-8fc6-0efc-6ab0-1412f1198517)
add Policy Document mobility training (83dfb2b8-678b-20a0-4c44-5c75ada023e6)
add Policy Remediate information system flaws (be38a620-000b-21cf-3cb3-ea151b704c3b)
add Policy Use privileged identity management (e714b481-8fac-64a2-14a9-6f079b2501a4)
add Policy Restrict access to privileged accounts (873895e8-0e3a-6492-42e9-22cd030e9fcd)
add Policy Verify security functions (ece8bb17-4080-5127-915f-dc7267ee8549)
add Policy Adhere to retention periods defined (1ecb79d7-1a06-9a3b-3be8-f434d04d1ec1)
add Policy Implement controls to secure all media (e435f7e3-0dd9-58c9-451f-9b44b96c0232)
add Policy Employ flow control mechanisms of encrypted information (79365f13-8ba4-1f6c-2ac4-aa39929f56d0)
add Policy Implement training for protecting authenticators (e4b00788-7e1c-33ec-0418-d048508e095b)
add Policy Alert personnel of information spillage (9622aaa9-5c49-40e2-5bf8-660b7cd23deb)
add Policy Document remote access guidelines (3d492600-27ba-62cc-a1c3-66eb919f6a0d)
add Policy Establish firewall and router configuration standards (398fdbd8-56fd-274d-35c6-fa2d3b2755a1)
add Policy Establish a data leakage management procedure (3c9aa856-6b86-35dc-83f4-bc72cec74dea)
add Policy Detect network services that have not been authorized or approved (86ecd378-a3a0-5d5b-207c-05e6aaca43fc)
add Policy Automate account management (2cc9c165-46bd-9762-5739-d2aae5ba90a1)
add Policy Enable dual or joint authorization (2c843d78-8f64-92b5-6a9b-e8186c0e7eb6)
add Policy Terminate user session automatically (4502e506-5f35-0df4-684f-b326e3cc7093)
add Policy Retain security policies and procedures (efef28d0-3226-966a-a1e8-70e89c1b30bc)
add Policy Review audit data (6625638f-3ba1-7404-5983-0ea33d719d34)
add Policy Identify and manage downstream information exchanges (c7fddb0e-3f44-8635-2b35-dc6b8e740b7c)
add Policy Design an access control model (03b6427e-6072-4226-4bd9-a410ab65317e)
add Policy Review user accounts (79f081c7-1634-01a1-708e-376197999289)
add Policy Authenticate to cryptographic module (6f1de470-79f3-1572-866e-db0771352fc8)
add Policy Configure workstations to check for digital certificates (26daf649-22d1-97e9-2a8a-01b182194d59)
add Policy Define cryptographic use (c4ccd607-702b-8ae6-8eeb-fc3339cd4b42)
add Policy Identify and authenticate network devices (ae5345d5-8dab-086a-7290-db43a3272198)
add Policy Audit privileged functions (f26af0b1-65b6-689a-a03f-352ad2d00f98)
add Policy Notify when account is not needed (8489ff90-8d29-61df-2d84-f9ab0f4c5e84)
add Policy Perform vulnerability scans (3c5e0e1a-216f-8f49-0a15-76ed0d8b8e1f)
add Policy Maintain integrity of audit system (c0559109-6a27-a217-6821-5a6d44f92897)
add Policy Perform a trend analysis on threats (50e81644-923d-33fc-6ebb-9733bc8d1a06)
add Policy Protect data in transit using encryption (b11697e8-9515-16f1-7a35-477d5c8a1344)
add Policy Develop an incident response plan (2b4e134f-1e4c-2bff-573e-082d85479b6e)
add Policy Set automated notifications for new and trending cloud applications in your organization (af38215f-70c4-0cd6-40c2-c52d86690a45)
Version change: '15.0.0' to '16.0.0'
2022-09-13 16:35:24 Description change: 'This initiative includes policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure110-initiative.' to 'The Center for Internet Security (CIS) is a nonprofit entity whose mission is to 'identify, develop, validate, promote, and sustain best practice solutions for cyberdefense.' CIS benchmarks are configuration baselines and best practices for securely configuring a system. These policies address a subset of CIS Microsoft Azure Foundations Benchmark v1.1.0 controls. For more information, visit https://aka.ms/cisazure110-initiative'
2022-07-07 16:32:14 Version change: '14.0.0' to '15.0.0'
remove Policy [Deprecated]: Managed identity should be used in your API App (c4d441f8-f9d9-4a9e-9cef-e82117cb3eef)
remove Policy [Deprecated]: Ensure that 'PHP version' is the latest, if used as a part of the API app (1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba)
remove Policy [Deprecated]: Ensure that 'HTTP Version' is the latest, if used to run the API app (991310cd-e9f3-47bc-b7b6-f57b557d07db)
remove Policy [Deprecated]: API apps that use Python should use the latest 'Python version' (74c3584d-afae-46f7-a20a-6f8adba71a16)
remove Policy [Deprecated]: Ensure that 'Java version' is the latest, if used as a part of the API app (88999f4c-376a-45c8-bcb3-4058f713cf39)
remove Policy [Deprecated]: Latest TLS version should be used in your API App (8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e)
remove Policy [Deprecated]: Authentication should be enabled on your API app (c4ebc54a-46e1-481a-bee2-d4411e95d828)
remove Policy [Deprecated]: API apps should have 'Client Certificates (Incoming client certificates)' enabled (0c192fe8-9cbb-4516-85b3-0ade8bd03886)
2022-01-27 17:51:51 remove Policy [Deprecated]: Custom subscription owner roles should not exist (10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9)
2022-01-13 19:18:29 add Policy Microsoft Defender for Containers should be enabled (1c988dd6-ade4-430f-a608-2a3e5b0a6d38)
remove Policy [Deprecated]: Azure Defender for Kubernetes should be enabled (523b5cd1-3e23-492f-a539-13118b6d1e3a)
remove Policy [Deprecated]: Unattached disks should be encrypted (2c89a2e5-7285-40fe-afe0-ae8654b92fb2)
remove Policy [Deprecated]: Azure Defender for container registries should be enabled (c25d9a16-bc35-4e15-a7e5-9db606bf9ed4)
2021-12-08 16:24:23 add Policy SQL servers should use customer-managed keys to encrypt data at rest (0a370ff3-6cab-4e85-8995-295fd854c5b8)
add Policy SQL managed instances should use customer-managed keys to encrypt data at rest (ac01ad65-10e5-46df-bdd9-6b0cad13e1d2)
remove Policy [Deprecated]: SQL managed instances should use customer-managed keys to encrypt data at rest (048248b0-55cd-46da-b1ff-39efd52db260)
remove Policy [Deprecated]: SQL servers should use customer-managed keys to encrypt data at rest (0d134df8-db83-46fb-ad72-fe0c9428c8dd)
2021-09-30 16:01:51 remove Policy [Deprecated]: RDP access from the Internet should be blocked (e372f825-a257-4fb8-9175-797a8a8627d6)
remove Policy [Deprecated]: SSH access from the Internet should be blocked (2c89a2e5-7285-40fe-afe0-ae8654b92fab)
2021-04-07 13:27:17 Name change: 'CIS Microsoft Azure Foundations Benchmark 1.1.0' to 'CIS Microsoft Azure Foundations Benchmark v1.1.0'
2021-03-31 14:35:06 add Policy Azure Defender for servers should be enabled (4da35fc9-c9e7-4960-aec9-797fe7d9051d)
add Policy Azure Defender for SQL servers on machines should be enabled (6581d072-105e-4418-827f-bd446d56421b)
add Policy Azure Defender for App Service should be enabled (2913021d-f2fd-4f3d-b958-22354e2bdbcb)
add Policy Azure Defender for Key Vault should be enabled (0e6763cc-5078-4e64-889d-ff4d9a839047)
add Policy [Deprecated]: Azure Defender for container registries should be enabled (c25d9a16-bc35-4e15-a7e5-9db606bf9ed4)
add Policy Azure Defender for Azure SQL Database servers should be enabled (7fe3b40f-802b-4cdd-8bd4-fd799c948cc2)
add Policy [Deprecated]: Microsoft Defender for Storage (Classic) should be enabled (308fbb08-4ab8-4e67-9b29-592e93fb94fa)
add Policy [Deprecated]: Azure Defender for Kubernetes should be enabled (523b5cd1-3e23-492f-a539-13118b6d1e3a)
remove Policy Security Center standard pricing tier should be selected (a1181c5f-672a-477a-979a-7d58aa086233)
2021-02-17 14:28:42 add Policy Resource logs in Azure Key Vault Managed HSM should be enabled (a2a5b911-5617-447e-a49e-59dbe0e0434b)
add Policy Azure Key Vault Managed HSM should have purge protection enabled (c39ba22d-4428-4149-b981-70acb31fc383)
2021-01-22 09:14:56 add Policy A vulnerability assessment solution should be enabled on your virtual machines (501541f7-f7e7-4cd6-868c-4190fdad3ac9)
remove Policy [Deprecated]: Vulnerabilities should be remediated by a Vulnerability Assessment solution (760a85ff-6162-42b3-8d70-698e268f648c)
remove Policy [Deprecated]: A security contact phone number should be provided for your subscription (b4d66858-c922-44e3-9566-5cdb7a7be744)
2021-01-20 16:06:15 Description change: 'This initiative includes audit policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.' to 'This initiative includes policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure110-initiative.'
2021-01-14 16:08:03 add Policy Storage account public access should be disallowed (4fa4b6c0-31ca-4c0d-b10d-24b96f62a751)
add Policy Security Center standard pricing tier should be selected (a1181c5f-672a-477a-979a-7d58aa086233)
add Policy Key Vault keys should have an expiration date (152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0)
add Policy Key Vault secrets should have an expiration date (98728c90-32c7-4049-8429-847dc0f4fe37)
2020-09-02 14:03:46 add Policy Function apps should use managed identity (0da106f2-4ca3-48e8-bc85-c638fe6aea8f)
add Policy App Service apps should use managed identity (2b9ad585-36bc-4615-b300-fd4435808332)
add Policy [Deprecated]: Managed identity should be used in your API App (c4d441f8-f9d9-4a9e-9cef-e82117cb3eef)
remove Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on Function App (f0473e7a-a1ba-4e86-afb2-e829e11b01d8)
remove Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on WEB App (aa81768c-cb87-4ce2-bfaa-00baa10d760c)
remove Policy [Deprecated]: Ensure that 'PHP version' is the latest, if used as a part of the Function app (ab965db2-d2bf-4b64-8b39-c38ec8179461)
remove Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Web app (843664e0-7563-41ee-a9cb-7522c382d2c4)
remove Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Function App (10c1859c-e1a7-4df3-ab97-a487fa8059f6)
remove Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the API app (c2e7ca55-f62c-49b2-89a4-d41eb661d2f0)
remove Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on API app (86d97760-d216-4d81-a3ad-163087b2b6c3)
2020-08-21 13:50:30 remove Policy Log duration should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e8f3)
2020-07-01 14:50:07 remove Policy [Deprecated]: Email notifications to admins should be enabled in SQL Managed Instance advanced data security settings (aeb23562-188d-47cb-80b8-551f16ef9fff)
remove Policy [Deprecated]: Advanced data security settings for SQL Managed Instance should contain an email address for security alerts (3965c43d-b5f4-482e-b74a-d89ee0e0b3a8)
remove Policy [Deprecated]: Advanced Threat Protection types should be set to 'All' in SQL server Advanced Data Security settings (e756b945-1b1b-480b-8de8-9a0859d5f7ad)
remove Policy [Deprecated]: Advanced Threat Protection types should be set to 'All' in SQL Managed Instance advanced data security settings (bda18df3-5e41-4709-add9-2554ce68c966)
remove Policy [Deprecated]: Advanced data security settings for SQL server should contain an email address to receive security alerts (9677b740-f641-4f3c-b9c5-466005c85278)
remove Policy [Deprecated]: Email notifications to admins should be enabled in SQL server advanced data security settings (c8343d2f-fdc9-4a97-b76f-fc71d1163bfc)
2020-06-23 16:03:23 remove Policy Security Center standard pricing tier should be selected (a1181c5f-672a-477a-979a-7d58aa086233)
2020-06-16 14:55:25 Name change: 'Audit CIS Microsoft Azure Foundations Benchmark 1.1.0 recommendations and deploy specific supporting VM extensions' to 'CIS Microsoft Azure Foundations Benchmark 1.1.0'
Description change: 'This initiative includes audit and VM extension deployment policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.' to 'This initiative includes audit policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.'
2020-06-11 19:46:04 Name change: '[Preview]: Audit CIS Microsoft Azure Foundations Benchmark 1.1.0 recommendations and deploy specific supporting VM extensions' to 'Audit CIS Microsoft Azure Foundations Benchmark 1.1.0 recommendations and deploy specific supporting VM extensions'
2020-04-23 15:06:19 Description change: 'This initiative includes audit and VM Extension deployment policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, please visit https://aka.ms/cisazure-blueprint.' to 'This initiative includes audit and VM extension deployment policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure-blueprint.'
2020-04-22 04:43:14 add Policy An activity log alert should exist for specific Policy operations (c5447c04-a4d7-4ba8-a263-c9ee321a6858)
add Policy [Deprecated]: RDP access from the Internet should be blocked (e372f825-a257-4fb8-9175-797a8a8627d6)
add Policy Storage account containing the container with activity logs must be encrypted with BYOK (fbb99e8e-e444-4da0-9ff1-75c92f5a85b2)
add Policy An activity log alert should exist for specific Security operations (3b980d31-7904-4bb7-8575-5665739a8052)
add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a)
add Policy [Deprecated]: Authentication should be enabled on your API app (c4ebc54a-46e1-481a-bee2-d4411e95d828)
add Policy An activity log alert should exist for specific Security operations (3b980d31-7904-4bb7-8575-5665739a8052)
add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a)
add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a)
add Policy Function apps should have authentication enabled (c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8)
add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a)
add Policy App Service apps should have authentication enabled (95bccee9-a7f8-4bec-9ee9-62c3473701fc)
add Policy An activity log alert should exist for specific Security operations (3b980d31-7904-4bb7-8575-5665739a8052)
add Policy [Deprecated]: SSH access from the Internet should be blocked (2c89a2e5-7285-40fe-afe0-ae8654b92fab)
add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a)
add Policy An activity log alert should exist for specific Administrative operations (b954148f-4c11-4c38-8221-be76711e194a)
2020-02-20 08:25:18 remove Policy [Deprecated]: Web ports should be restricted on Network Security Groups associated to your VM (201ea587-7c90-41c3-910f-c280ae01cfd6)
2019-11-20 21:24:34 add Policy [Deprecated]: API apps that use Python should use the latest 'Python version' (74c3584d-afae-46f7-a20a-6f8adba71a16)
add Policy App Service apps that use Java should use a specified 'Java version' (496223c3-ad65-4ecd-878a-bae78737e9ed)
add Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the API app (c2e7ca55-f62c-49b2-89a4-d41eb661d2f0)
add Policy Log connections should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e442)
add Policy [Deprecated]: Custom subscription owner roles should not exist (10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9)
add Policy App Service apps should use the latest TLS version (f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b)
add Policy App Service apps should use latest 'HTTP Version' (8c122334-9d20-4eb8-89ea-ac9a705b74ae)
add Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Function App (10c1859c-e1a7-4df3-ab97-a487fa8059f6)
add Policy [Deprecated]: Function apps should have 'Client Certificates (Incoming client certificates)' enabled (eaebaea7-8013-4ceb-9d14-7eb32271373c)
add Policy Function apps that use Python should use a specified 'Python version' (7238174a-fd10-4ef0-817e-fc820a951d73)
add Policy [Deprecated]: Ensure that 'Java version' is the latest, if used as a part of the API app (88999f4c-376a-45c8-bcb3-4058f713cf39)
add Policy Log checkpoints should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d)
add Policy [Deprecated]: App Service apps should have 'Client Certificates (Incoming client certificates)' enabled (5bb220d9-2698-4ee4-8404-b9c30c9df609)
add Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on WEB App (aa81768c-cb87-4ce2-bfaa-00baa10d760c)
add Policy Disconnections should be logged for PostgreSQL database servers. (eb6f77b9-bd53-4e35-a23d-7f65d5f0e446)
add Policy [Deprecated]: Ensure that 'HTTP Version' is the latest, if used to run the API app (991310cd-e9f3-47bc-b7b6-f57b557d07db)
add Policy App Service apps that use Python should use a specified 'Python version' (7008174a-fd10-4ef0-817e-fc820a951d73)
add Policy App Service apps that use PHP should use a specified 'PHP version' (7261b898-8a84-4db8-9e04-18527132abb3)
add Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on Function App (f0473e7a-a1ba-4e86-afb2-e829e11b01d8)
add Policy Function apps that use Java should use a specified 'Java version' (9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc)
add Policy [Deprecated]: API apps should have 'Client Certificates (Incoming client certificates)' enabled (0c192fe8-9cbb-4516-85b3-0ade8bd03886)
add Policy Function apps should use the latest TLS version (f9d614c5-c173-4d56-95a7-b4437057d193)
add Policy [Deprecated]: Ensure that 'PHP version' is the latest, if used as a part of the Function app (ab965db2-d2bf-4b64-8b39-c38ec8179461)
add Policy [Deprecated]: Ensure that Register with Azure Active Directory is enabled on API app (86d97760-d216-4d81-a3ad-163087b2b6c3)
add Policy Log duration should be enabled for PostgreSQL database servers (eb6f77b9-bd53-4e35-a23d-7f65d5f0e8f3)
add Policy Function apps should use latest 'HTTP Version' (e2c1c086-2d84-4019-bff3-c44ccd95113c)
add Policy [Deprecated]: Ensure that 'PHP version' is the latest, if used as a part of the API app (1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba)
add Policy [Deprecated]: Latest TLS version should be used in your API App (8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e)
add Policy [Deprecated]: Ensure that '.NET Framework' version is the latest, if used as a part of the Web app (843664e0-7563-41ee-a9cb-7522c382d2c4)
JSON compare
compare mode: version left: version right:
JSON
api-version=2023-04-01
EPAC