| Policy DisplayName |
Policy Id |
Category |
Version |
Versioning |
Effect |
Roles# |
Roles |
State |
policy in AzUSGov |
| [Deprecated]: API App should only be accessible over HTTPS |
b7ddfbdc-1260-477d-91fd-98bd9be789a6 |
App Service |
1.0.0 (1.0.0-deprecated) |
1x
1.0.0 |
Default
Audit
Allowed
Audit, Disabled |
0 |
|
Deprecated |
unknown |
| [Deprecated]: FTPS only should be required in your API App |
9a1b8c48-453a-4044-86c3-d8bfd823e4f5 |
App Service |
2.0.0 (2.0.0-deprecated) |
1x
2.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
Deprecated |
unknown |
| [Deprecated]: Latest TLS version should be used in your API App |
8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e |
App Service |
1.0.0 (1.0.0-deprecated) |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
Deprecated |
unknown |
| [Deprecated]: Remote debugging should be turned off for API Apps |
e9c8d085-d9cc-4b17-9cdc-059f1f01f19e |
App Service |
1.0.0 (1.0.0-deprecated) |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
Deprecated |
unknown |
| [Deprecated]: Virtual machines should have the Log Analytics extension installed |
a70ca396-0a34-413a-88e1-b956c1e683be |
Monitoring |
1.1.0 (1.1.0-deprecated) |
2x
1.1.0, 1.0.1 |
Default
Disabled
Allowed
AuditIfNotExists, Disabled |
0 |
|
Deprecated |
unknown |
| [Preview]: Secure Boot should be enabled on supported Windows virtual machines |
97566dd7-78ae-4997-8b36-1c7bfe0d8121 |
Security Center |
4.0.0-preview |
1x
4.0.0-preview |
Default
Audit
Allowed
Audit, Disabled |
0 |
|
Preview |
true |
| [Preview]: vTPM should be enabled on supported virtual machines |
1c30f9cd-b84c-49cc-aa2c-9288447cc3b3 |
Security Center |
2.0.0-preview |
1x
2.0.0-preview |
Default
Audit
Allowed
Audit, Disabled |
0 |
|
Preview |
true |
| An activity log alert should exist for specific Policy operations |
c5447c04-a4d7-4ba8-a263-c9ee321a6858 |
Monitoring |
3.0.0 |
1x
3.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| App Service apps should have authentication enabled |
95bccee9-a7f8-4bec-9ee9-62c3473701fc |
App Service |
2.0.1 |
1x
2.0.1 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| App Service apps should have remote debugging turned off |
cb510bfd-1cba-4d9f-a230-cb0976f4bb71 |
App Service |
2.0.0 |
1x
2.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| App Service apps should only be accessible over HTTPS |
a4af4a39-4135-47fb-b175-47fbdf85311d |
App Service |
4.0.0 |
1x
4.0.0 |
Default
Audit
Allowed
Audit, Disabled, Deny |
0 |
|
GA |
true |
| App Service apps should require FTPS only |
4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b |
App Service |
3.0.0 |
1x
3.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| App Service apps should use latest 'HTTP Version' |
8c122334-9d20-4eb8-89ea-ac9a705b74ae |
App Service |
4.0.0 |
1x
4.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| App Service apps should use the latest TLS version |
f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b |
App Service |
2.1.0 |
2x
2.1.0, 2.0.1 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Auditing on SQL server should be enabled |
a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9 |
SQL |
2.0.0 |
1x
2.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Azure Defender for App Service should be enabled |
2913021d-f2fd-4f3d-b958-22354e2bdbcb |
Security Center |
1.0.3 |
1x
1.0.3 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
unknown |
| Azure Defender for Key Vault should be enabled |
0e6763cc-5078-4e64-889d-ff4d9a839047 |
Security Center |
1.0.3 |
1x
1.0.3 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
unknown |
| Azure Defender for open-source relational databases should be enabled |
0a9fbe0d-c5c4-4da8-87d8-f4fd77338835 |
Security Center |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
unknown |
| Azure Defender for Resource Manager should be enabled |
c3d20c29-b36d-48fe-808b-99a87530ad99 |
Security Center |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Azure Defender for servers should be enabled |
4da35fc9-c9e7-4960-aec9-797fe7d9051d |
Security Center |
1.0.3 |
1x
1.0.3 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Azure Defender for SQL servers on machines should be enabled |
6581d072-105e-4418-827f-bd446d56421b |
Security Center |
1.0.2 |
1x
1.0.2 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
unknown |
| Azure Defender for SQL should be enabled for unprotected SQL Managed Instances |
abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9 |
SQL |
1.0.2 |
1x
1.0.2 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Azure Key Vault should use RBAC permission model |
12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5 |
Key Vault |
1.0.1 |
2x
1.0.1, 1.0.0-preview |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
unknown |
| Configure managed disks to disable public network access |
8426280e-b5be-43d9-979e-653d12a08638 |
Compute |
2.0.0 |
1x
2.0.0 |
Default
Modify
Allowed
Modify, Disabled |
1 |
Contributor |
GA |
unknown |
| Connection throttling should be enabled for PostgreSQL database servers |
5345bb39-67dc-4960-a1bf-427e16b9a0bd |
SQL |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| CosmosDB accounts should use private link |
58440f8a-10c5-4151-bdce-dfbaad4a20b7 |
Cosmos DB |
1.0.0 |
1x
1.0.0 |
Default
Audit
Allowed
Audit, Disabled |
0 |
|
GA |
true |
| Deploy SQL DB transparent data encryption |
86a912f6-9a06-4e26-b447-11b16ba8659f |
SQL |
2.2.0 |
1x
2.2.0 |
Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled |
1 |
SQL DB Contributor |
GA |
true |
| Disconnections should be logged for PostgreSQL database servers. |
eb6f77b9-bd53-4e35-a23d-7f65d5f0e446 |
SQL |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Email notification for high severity alerts should be enabled |
6e2593d9-add6-4083-9c9b-4b7d2188c899 |
Security Center |
1.2.0 |
3x
1.2.0, 1.1.0, 1.0.1 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Enable Security Center's auto provisioning of the Log Analytics agent on your subscriptions with custom workspace. |
8e7da0a5-0a0e-4bbc-bfc0-7773c018b616 |
Security Center |
1.0.0 |
1x
1.0.0 |
Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled |
1 |
Contributor |
GA |
true |
| Enable Security Center's auto provisioning of the Log Analytics agent on your subscriptions with default workspace. |
6df2fee6-a9ed-4fef-bced-e13be1b25f1c |
Security Center |
1.0.0 |
1x
1.0.0 |
Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled |
1 |
Contributor |
GA |
true |
| Function apps should have remote debugging turned off |
0e60b895-3786-45da-8377-9c6b4b6ac5f9 |
App Service |
2.0.0 |
1x
2.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Function apps should only be accessible over HTTPS |
6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab |
App Service |
5.0.0 |
1x
5.0.0 |
Default
Audit
Allowed
Audit, Disabled, Deny |
0 |
|
GA |
true |
| Function apps should require FTPS only |
399b2637-a50f-4f95-96f8-3a145476eb15 |
App Service |
3.0.0 |
1x
3.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Function apps should use latest 'HTTP Version' |
e2c1c086-2d84-4019-bff3-c44ccd95113c |
App Service |
4.0.0 |
1x
4.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Function apps should use the latest TLS version |
f9d614c5-c173-4d56-95a7-b4437057d193 |
App Service |
2.1.0 |
2x
2.1.0, 2.0.1 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Infrastructure encryption should be enabled for Azure Database for PostgreSQL servers |
24fba194-95d6-48c0-aea7-f65bf859c598 |
SQL |
1.0.0 |
1x
1.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Key Vault keys should have an expiration date |
152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 |
Key Vault |
1.0.2 |
1x
1.0.2 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Key Vault secrets should have an expiration date |
98728c90-32c7-4049-8429-847dc0f4fe37 |
Key Vault |
1.0.2 |
1x
1.0.2 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Key vaults should have deletion protection enabled |
0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 |
Key Vault |
2.1.0 |
1x
2.1.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Key vaults should have soft delete enabled |
1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d |
Key Vault |
3.0.0 |
1x
3.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Log checkpoints should be enabled for PostgreSQL database servers |
eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d |
SQL |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Log connections should be enabled for PostgreSQL database servers |
eb6f77b9-bd53-4e35-a23d-7f65d5f0e442 |
SQL |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Managed disks should disable public network access |
8405fdab-1faf-48aa-b702-999c9c172094 |
Compute |
2.1.0 |
2x
2.1.0, 2.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
unknown |
| Microsoft Defender for Azure Cosmos DB should be enabled |
adbe85b5-83e6-4350-ab58-bf3a4f736e5e |
Security Center |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
unknown |
| Microsoft Defender for Containers should be enabled |
1c988dd6-ade4-430f-a608-2a3e5b0a6d38 |
Security Center |
1.0.0 |
1x
1.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Network Watcher should be enabled |
b6e2945c-0b7b-40f5-9233-7a5323b5cdc6 |
Network |
3.0.0 |
1x
3.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| OS and data disks should be encrypted with a customer-managed key |
702dd420-7fcc-42c5-afe8-4026edd20fe0 |
Compute |
3.0.0 |
1x
3.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Public network access should be disabled for PostgreSQL flexible servers |
5e1de0e3-42cb-4ebc-a86d-61d0c619ca48 |
SQL |
3.1.0 |
2x
3.1.0, 3.0.1 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
unknown |
| Public network access should be disabled for PostgreSQL servers |
b52376f7-9612-48a1-81cd-1ffe4b61032c |
SQL |
2.0.1 |
1x
2.0.1 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Resource logs in Key Vault should be enabled |
cf820ca0-f99e-4f3e-84fb-66e913812d21 |
Key Vault |
5.0.0 |
1x
5.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Secure transfer to storage accounts should be enabled |
404c3081-a854-4457-ae30-26a93ef643f9 |
Storage |
2.0.0 |
1x
2.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| SQL servers with auditing to storage account destination should be configured with 90 days retention or higher |
89099bee-89e0-4b26-a5f4-165451757743 |
SQL |
3.0.0 |
1x
3.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Storage account public access should be disallowed |
4fa4b6c0-31ca-4c0d-b10d-24b96f62a751 |
Storage |
3.1.1 |
2x
3.1.1, 3.1.0-preview |
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled |
0 |
|
GA |
unknown |
| Storage accounts should allow access from trusted Microsoft services |
c9d007d0-c057-4772-b18c-01e546713bcd |
Storage |
1.0.0 |
1x
1.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Storage accounts should have infrastructure encryption |
4733ea7b-a883-42fe-8cac-97454c2a9e4a |
Storage |
1.0.0 |
1x
1.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Storage accounts should have the specified minimum TLS version |
fe83a0eb-a853-422d-aac2-1bffd182c5d0 |
Storage |
1.0.0 |
1x
1.0.0 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Storage accounts should restrict network access |
34c877ad-507e-4c82-993e-3452a6e0ad3c |
Storage |
1.1.1 |
1x
1.1.1 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Storage accounts should restrict network access using virtual network rules |
2a1a9cdf-e04d-429a-8416-3bfb72a1b26f |
Storage |
1.0.1 |
1x
1.0.1 |
Default
Audit
Allowed
Audit, Deny, Disabled |
0 |
|
GA |
true |
| Storage accounts should use customer-managed key for encryption |
6fac406b-40ca-413b-bf8e-0bf964659c25 |
Storage |
1.0.3 |
1x
1.0.3 |
Default
Audit
Allowed
Audit, Disabled |
0 |
|
GA |
true |
| Storage accounts should use private link |
6edd7eda-6dd8-40f7-810d-67160c639cd9 |
Storage |
2.0.0 |
1x
2.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |
| Transparent Data Encryption on SQL databases should be enabled |
17k78e20-9358-41c9-923c-fb736d382a12 |
SQL |
2.0.0 |
1x
2.0.0 |
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled |
0 |
|
GA |
true |