last sync: 2024-Dec-06 18:53:36 UTC

New Zealand ISM

Azure BuiltIn Policy Initiative (PolicySet)

Source Azure Portal
Display nameNew Zealand ISM
Id4f5b1359-4f8e-4d7c-9733-ea47fcde891e
Version1.5.0
Details on versioning
Versioning Versions supported for Versioning: 7
1.0.0-preview
1.1.0-preview
1.2.0-preview
1.2.1
1.3.0
1.4.0
1.5.0
Built-in Versioning [Preview]
CategoryRegulatory Compliance
Microsoft Learn
DescriptionNZISM v3.8. The New Zealand Information Security Manual (NZISM) details processes and controls essential for the protection of all New Zealand Government information and systems. This initiative includes policies that address a subset of NZISM controls. Additional policies will be added in upcoming releases. For full details on controls, please refer to https://www.nzism.gcsb.govt.nz/ism-document. This policy set includes definitions that have a Deny effect by default.
TypeBuiltIn
DeprecatedFalse
PreviewFalse
Policy count Total Policies: 217
Builtin Policies: 217
Static Policies: 0
Policy used
Policy DisplayName Policy Id Category Effect Roles# Roles State
[Deprecated]: Endpoint protection health issues should be resolved on your machines 8e42c1f2-a2ab-49bc-994a-12bcd0dc4ac2 Security Center Default
Disabled
Allowed
AuditIfNotExists, Disabled
0 Deprecated
[Deprecated]: Endpoint protection should be installed on your machines 1f7c564c-0a90-4d44-b7e1-9d456cffaee8 Security Center Default
Disabled
Allowed
AuditIfNotExists, Disabled
0 Deprecated
[Deprecated]: Endpoint protection solution should be installed on virtual machine scale sets 26a828e1-e88f-464e-bbb3-c134a282b9de Security Center Default
Disabled
Allowed
AuditIfNotExists, Disabled
0 Deprecated
[Deprecated]: Monitor missing Endpoint Protection in Azure Security Center af6cd1bd-1635-48cb-bde7-5b15693900b9 Security Center Default
Disabled
Allowed
AuditIfNotExists, Disabled
0 Deprecated
A maximum of 3 owners should be designated for your subscription 4f11b553-d42e-4e3a-89be-32ca364cad4c Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
A Microsoft Entra administrator should be provisioned for MySQL servers 146412e9-005c-472b-9e48-c87b72ac229e SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
A Microsoft Entra administrator should be provisioned for PostgreSQL servers b4dec045-250a-48c2-b5cc-e0c4eec8b5b4 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
A vulnerability assessment solution should be enabled on your virtual machines 501541f7-f7e7-4cd6-868c-4190fdad3ac9 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Accounts with owner permissions on Azure resources should be MFA enabled e3e008c3-56b9-4133-8fd7-d3347377402a Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Accounts with read permissions on Azure resources should be MFA enabled 81b3ccb4-e6e8-4e4a-8d05-5df25cd29fd4 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Accounts with write permissions on Azure resources should be MFA enabled 931e118d-50a1-4457-a5e4-78550e086c52 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
All authorization rules except RootManageSharedAccessKey should be removed from Service Bus namespace a1817ec0-a368-432a-8057-8371e17ac6ee Service Bus Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
All network ports should be restricted on network security groups associated to your virtual machine 9daedab3-fb2d-461e-b861-71790eead4f6 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
An Azure Active Directory administrator should be provisioned for SQL servers 1f314764-cb73-4fc9-b863-8eca98ac36e9 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
API endpoints in Azure API Management should be authenticated 8ac833bd-f505-48d5-887e-c993a1d3eea0 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
API endpoints that are unused should be disabled and removed from the Azure API Management service c8acafaf-3d23-44d1-9624-978ef0f8652c Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
API Management APIs should use only encrypted protocols ee7495e7-3ba7-40b6-bfee-c29e22cc75d4 API Management Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
API Management calls to API backends should be authenticated c15dcc82-b93c-4dcb-9332-fbf121685b54 API Management Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
API Management calls to API backends should not bypass certificate thumbprint or name validation 92bb331d-ac71-416a-8c91-02f2cb734ce4 API Management Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
API Management direct management endpoint should not be enabled b741306c-968e-4b67-b916-5675e5c709f4 API Management Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
API Management minimum API version should be set to 2019-12-01 or higher 549814b6-3212-4203-bdc8-1548d342fb67 API Management Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
API Management secret named values should be stored in Azure Key Vault f1cc7827-022c-473e-836e-5a51cae0b249 API Management Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
API Management services should use a virtual network ef619a2c-cc4d-4d03-b2ba-8c94a834d85b API Management Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
API Management should disable public network access to the service configuration endpoints df73bd95-24da-4a4f-96b9-4e8b94b402bd API Management Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
API Management subscriptions should not be scoped to all APIs 3aa03346-d8c5-4994-a5bc-7652c2a2aef1 API Management Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
App Configuration should use private link ca610c1d-041c-4332-9d88-7ed3094967c7 App Configuration Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service app slots should have Client Certificates (Incoming client certificates) enabled 5b0bd968-5cb5-4513-8987-27786c6f0df8 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should have authentication enabled 95bccee9-a7f8-4bec-9ee9-62c3473701fc App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should have Client Certificates (Incoming client certificates) enabled 19dd1db6-f442-49cf-a838-b0786b4401ef App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should have remote debugging turned off cb510bfd-1cba-4d9f-a230-cb0976f4bb71 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should have resource logs enabled 91a78b24-f231-4a8a-8da9-02c35b2b6510 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should not have CORS configured to allow every resource to access your apps 5744710e-cc2f-4ee8-8809-3b11e89f4bc9 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should only be accessible over HTTPS a4af4a39-4135-47fb-b175-47fbdf85311d App Service Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
App Service apps should require FTPS only 4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should use latest 'HTTP Version' 8c122334-9d20-4eb8-89ea-ac9a705b74ae App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should use managed identity 2b9ad585-36bc-4615-b300-fd4435808332 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps should use the latest TLS version f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps that use Java should use a specified 'Java version' 496223c3-ad65-4ecd-878a-bae78737e9ed App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps that use PHP should use a specified 'PHP version' 7261b898-8a84-4db8-9e04-18527132abb3 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
App Service apps that use Python should use a specified 'Python version' 7008174a-fd10-4ef0-817e-fc820a951d73 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Audit usage of custom RBAC roles a451c1ef-c6ca-483d-87ed-f49761e3ffb5 General Default
Audit
Allowed
Audit, Disabled
0 GA
Audit virtual machines without disaster recovery configured 0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56 Compute Fixed
auditIfNotExists
0 GA
Auditing on SQL server should be enabled a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Authentication to Linux machines should require SSH keys 630c64f9-8b6b-4c64-b511-6544ceff6fd6 Guest Configuration Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Authorized IP ranges should be defined on Kubernetes Services 0e246bcf-5f6f-4f87-bc6f-775d4712c7ea Security Center Default
Audit
Allowed
Audit, Disabled
0 GA
Automation account variables should be encrypted 3657f5a0-770e-44a3-b44e-9431ba1e9735 Automation Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure AI Services resources should encrypt data at rest with a customer-managed key (CMK) 67121cc7-ff39-4ab8-b7e3-95b84dab487d Cognitive Services Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure AI Services resources should have key access disabled (disable local authentication) 71ef260a-8f18-47b7-abcb-62d0673d94dc Azure Ai Services Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure AI Services resources should restrict network access 037eea7a-bd0a-46c5-9a66-03aea78705d3 Azure Ai Services Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure API for FHIR should use private link 1ee56206-5dd1-42ab-b02d-8aae8b1634ce API for FHIR Default
Audit
Allowed
Audit, Disabled
0 GA
Azure Cache for Redis should use private link 7803067c-7d34-46e3-8c79-0ca68fc4036d Cache Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Cosmos DB accounts should have firewall rules 862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb Cosmos DB Default
Deny
Allowed
Audit, Deny, Disabled
0 GA
Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest 1f905d99-2ab7-462c-a6b0-f709acca6c8f Cosmos DB Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Azure Cosmos DB should disable public network access 797b37f7-06b8-444c-b1ad-fc62867f335a Cosmos DB Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Databricks Clusters should disable public IP 51c1490f-3319-459c-bbbc-7f391bbed753 Azure Databricks Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Databricks Workspaces should be in a virtual network 9c25c9e4-ee12-4882-afd2-11fb9d87893f Azure Databricks Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Databricks Workspaces should disable public network access 0e7849de-b939-4c50-ab48-fc6b0f5eeba2 Azure Databricks Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Databricks Workspaces should use private link 258823f2-4595-4b52-b333-cc96192710d8 Azure Databricks Default
Audit
Allowed
Audit, Disabled
0 GA
Azure DDoS Protection should be enabled a7aca53f-2ed4-4466-a25e-0b45ade68efd Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for App Service should be enabled 2913021d-f2fd-4f3d-b958-22354e2bdbcb Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for Azure SQL Database servers should be enabled 7fe3b40f-802b-4cdd-8bd4-fd799c948cc2 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for Key Vault should be enabled 0e6763cc-5078-4e64-889d-ff4d9a839047 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for open-source relational databases should be enabled 0a9fbe0d-c5c4-4da8-87d8-f4fd77338835 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for Resource Manager should be enabled c3d20c29-b36d-48fe-808b-99a87530ad99 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for servers should be enabled 4da35fc9-c9e7-4960-aec9-797fe7d9051d Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for SQL servers on machines should be enabled 6581d072-105e-4418-827f-bd446d56421b Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for SQL should be enabled for unprotected Azure SQL servers abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for SQL should be enabled for unprotected PostgreSQL flexible servers d38668f5-d155-42c7-ab3d-9b57b50f8fbf Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Defender for SQL should be enabled for unprotected SQL Managed Instances abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Event Grid domains should use private link 9830b652-8523-49cc-b1b3-e17dce1127ca Event Grid Default
Audit
Allowed
Audit, Disabled
0 GA
Azure Event Grid topics should use private link 4b90e17e-8448-49db-875e-bd83fb6f804f Event Grid Default
Audit
Allowed
Audit, Disabled
0 GA
Azure Key Vault Managed HSM should have purge protection enabled c39ba22d-4428-4149-b981-70acb31fc383 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Key Vault should have firewall enabled 55615ac9-af46-4a59-874e-391cc3dfb490 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Key Vault should use RBAC permission model 12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Key Vaults should use private link a6abeaec-4d90-4a02-805f-6b26c4d3fbe9 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Kubernetes Service clusters should have Defender profile enabled a1840de2-8088-4ea8-b153-b4c723e9cb01 Kubernetes Default
Audit
Allowed
Audit, Disabled
0 GA
Azure Machine Learning compute instances should be recreated to get the latest software updates f110a506-2dcb-422e-bcea-d533fc8c35e2 Machine Learning Fixed
[parameters('effects')]
0 GA
Azure Machine Learning Computes should be in a virtual network 7804b5c7-01dc-4723-969b-ae300cc07ff1 Machine Learning Default
Audit
Allowed
Audit, Disabled
0 GA
Azure Machine Learning Computes should have local authentication methods disabled e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f Machine Learning Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Machine Learning workspaces should be encrypted with a customer-managed key ba769a63-b8cc-4b2d-abf6-ac33c7204be8 Machine Learning Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Machine Learning Workspaces should disable public network access 438c38d2-3772-465a-a9cc-7a6666a275ce Machine Learning Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Machine Learning workspaces should use private link 45e05259-1eb5-4f70-9574-baf73e9d219b Machine Learning Default
Audit
Allowed
Audit, Disabled
0 GA
Azure MySQL flexible server should have Microsoft Entra Only Authentication enabled 40e85574-ef33-47e8-a854-7a65c7500560 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters 0a15ec92-a229-4763-bb14-0ea34a568f8d Kubernetes Default
Audit
Allowed
Audit, Disabled
0 GA
Azure registry container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management) 090c7b07-b4ed-4561-ad20-e9075f3ccaff Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management) 17f4b1cc-c55c-4d94-b1f9-2978f6ac2957 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Azure SignalR Service should use private link 2393d2cf-a342-44cd-a2e2-fe0188fd1234 SignalR Default
Audit
Allowed
Audit, Disabled
0 GA
Azure Spring Cloud should use network injection af35e2a4-ef96-44e7-a9ae-853dd97032c4 App Platform Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
Azure SQL Database should be running TLS version 1.2 or newer 32e6bbec-16b6-44c2-be37-c5b672d103cf SQL Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
Azure SQL Database should have Microsoft Entra-only authentication enabled b3a22bc9-66de-45fb-98fa-00f5df42f41a SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure SQL Database should have Microsoft Entra-only authentication enabled during creation abda6d70-9778-44e7-84a8-06713e6db027 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure SQL Managed Instance should have Microsoft Entra-only authentication enabled 0c28c3fb-c244-42d5-a9bf-f35f2999577b SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure SQL Managed Instances should disable public network access 9dfea752-dd46-4766-aed1-c355fa93fb91 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure SQL Managed Instances should have Microsoft Entra-only authentication enabled during creation 78215662-041e-49ed-a9dd-5385911b3a1f SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Azure Web Application Firewall should be enabled for Azure Front Door entry-points 055aa869-bc98-4af8-bafc-23f1ab6ffe2c Network Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Blocked accounts with owner permissions on Azure resources should be removed 0cfea604-3201-4e14-88fc-fae4c427a6c5 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Blocked accounts with read and write permissions on Azure resources should be removed 8d7e1fde-fe26-4b5f-8108-f8e432cbc2be Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Certificates using RSA cryptography should have the specified minimum key size cee51871-e572-4576-855c-047c820360f0 Key Vault Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Configure Microsoft Defender for Containers to be enabled c9ddb292-b203-4738-aead-18e2716e858f Security Center Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled
1 Security Admin GA
Connection throttling should be enabled for PostgreSQL database servers 5345bb39-67dc-4960-a1bf-427e16b9a0bd SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Container registries should be encrypted with a customer-managed key 5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580 Container Registry Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Container registries should not allow unrestricted network access d0793b48-0edc-4296-a390-4c75d1bdfd71 Container Registry Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Container registries should use private link e8eef0a8-67cf-4eb4-9386-14b0e78733d4 Container Registry Default
Audit
Allowed
Audit, Disabled
0 GA
CORS should not allow every domain to access your API for FHIR 0fea8f8a-4169-495d-8307-30ec335f387d API for FHIR Default
Audit
Allowed
audit, Audit, disabled, Disabled
0 GA
Cosmos DB database accounts should have local authentication methods disabled 5450f5bd-9c72-4390-a9c4-a7aba4edfdd2 Cosmos DB Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
CosmosDB accounts should use private link 58440f8a-10c5-4151-bdce-dfbaad4a20b7 Cosmos DB Default
Audit
Allowed
Audit, Disabled
0 GA
Disconnections should be logged for PostgreSQL database servers. eb6f77b9-bd53-4e35-a23d-7f65d5f0e446 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Disk encryption should be enabled on Azure Data Explorer f4b53539-8df9-40e4-86c6-6b607703bd4e Azure Data Explorer Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Email notification for high severity alerts should be enabled 6e2593d9-add6-4083-9c9b-4b7d2188c899 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Email notification to subscription owner for high severity alerts should be enabled 0b15565f-aa9e-48ba-8619-45960f2c314d Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Enforce SSL connection should be enabled for MySQL database servers e802a67a-daf5-4436-9ea6-f6d821dd0c5d SQL Default
Audit
Allowed
Audit, Disabled
0 GA
Enforce SSL connection should be enabled for PostgreSQL database servers d158790f-bfb0-486c-8631-2dc6b4e8e6af SQL Default
Audit
Allowed
Audit, Disabled
0 GA
Function apps should have authentication enabled c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps should have Client Certificates (Incoming client certificates) enabled ab6a902f-9493-453b-928d-62c30b11b5a6 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps should have remote debugging turned off 0e60b895-3786-45da-8377-9c6b4b6ac5f9 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps should not have CORS configured to allow every resource to access your apps 0820b7b9-23aa-4725-a1ce-ae4558f718e5 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps should only be accessible over HTTPS 6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab App Service Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
Function apps should require FTPS only 399b2637-a50f-4f95-96f8-3a145476eb15 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps should use latest 'HTTP Version' e2c1c086-2d84-4019-bff3-c44ccd95113c App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps should use managed identity 0da106f2-4ca3-48e8-bc85-c638fe6aea8f App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps should use the latest TLS version f9d614c5-c173-4d56-95a7-b4437057d193 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps that use Java should use a specified 'Java version' 9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Function apps that use Python should use a specified 'Python version' 7238174a-fd10-4ef0-817e-fc820a951d73 App Service Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Guest accounts with owner permissions on Azure resources should be removed 339353f6-2387-4a45-abe4-7f529d121046 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Guest accounts with read permissions on Azure resources should be removed e9ac8f8e-ce22-4355-8f04-99b911d6be52 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Guest accounts with write permissions on Azure resources should be removed 94e1c2ac-cbbe-4cac-a2b5-389c812dee87 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Guest Configuration extension should be installed on your machines ae89ebca-1c92-4898-ac2c-9f63decb045c Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Internet-facing virtual machines should be protected with network security groups f6de0be7-9a8a-4b8a-b349-43cf02d22f7c Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
IP Forwarding on your virtual machine should be disabled bd352bd5-2853-4985-bf0d-73806b4a5744 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Key Vault keys should have an expiration date 152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Key Vault secrets should have an expiration date 98728c90-32c7-4049-8429-847dc0f4fe37 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Key vaults should have deletion protection enabled 0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Key vaults should have soft delete enabled 1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Keys using elliptic curve cryptography should have the specified curve names ff25f3c8-b739-4538-9d07-3d6d25cfb255 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Keys using RSA cryptography should have a specified minimum key size 82067dbb-e53b-4e06-b631-546d197452d9 Key Vault Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Kubernetes cluster containers should not share host process ID or host IPC namespace 47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8 Kubernetes Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Kubernetes cluster containers should run with a read only root file system df49d893-a74c-421d-bc95-c663042e5b80 Kubernetes Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Kubernetes cluster should not allow privileged containers 95edb821-ddaf-4404-9732-666045e056b4 Kubernetes Default
Deny
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Kubernetes clusters should be accessible only over HTTPS 1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d Kubernetes Default
Deny
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Kubernetes clusters should disable automounting API credentials 423dd1ba-798e-40e4-9c4d-b6902674b423 Kubernetes Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Kubernetes clusters should not allow container privilege escalation 1c6e92c9-99f0-4e55-9cf2-0c234dc48f99 Kubernetes Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Kubernetes clusters should not grant CAP_SYS_ADMIN security capabilities d2e7ea85-6b44-4317-a0be-1b951587f626 Kubernetes Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Kubernetes clusters should not use the default namespace 9f061a12-e40d-4183-a00e-171812443373 Kubernetes Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA
Log connections should be enabled for PostgreSQL database servers eb6f77b9-bd53-4e35-a23d-7f65d5f0e442 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Machines should be configured to periodically check for missing system updates bd876905-5b84-4f73-ab2d-2e7a7c4568d9 Azure Update Manager Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Machines should have secret findings resolved 3ac7c827-eea2-4bde-acc7-9568cd320efa Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Management ports of virtual machines should be protected with just-in-time network access control b0f33259-77d7-4c9e-aac6-3aabcfae693c Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Management ports should be closed on your virtual machines 22730e10-96f6-4aac-ad84-9383d35b5917 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Microsoft Antimalware for Azure should be configured to automatically update protection signatures c43e4a30-77cb-48ab-a4dd-93f175c63b57 Compute Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Microsoft Defender for APIs should be enabled 7926a6d1-b268-4586-8197-e8ae90c877d7 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Microsoft Defender for Azure Cosmos DB should be enabled adbe85b5-83e6-4350-ab58-bf3a4f736e5e Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Microsoft Defender for Containers should be enabled 1c988dd6-ade4-430f-a608-2a3e5b0a6d38 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Microsoft Defender for SQL should be enabled for unprotected Synapse workspaces d31e5c31-63b2-4f12-887b-e49456834fa1 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Microsoft Defender for Storage should be enabled 640d2586-54d2-465f-877f-9ffc1d2109f4 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Microsoft IaaSAntimalware extension should be deployed on Windows servers 9b597639-28e4-48eb-b506-56b05d366257 Compute Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
MySQL servers should use customer-managed keys to encrypt data at rest 83cef61d-dbd1-4b20-a4fc-5fbc7da10833 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Non-internet-facing virtual machines should be protected with network security groups bb91dfba-c30d-4263-9add-9c2384e659a6 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Only secure connections to your Azure Cache for Redis should be enabled 22bee202-a82f-4305-9a2a-6d7f44d4dedb Cache Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
PostgreSQL servers should use customer-managed keys to encrypt data at rest 18adea5e-f416-4d0f-8aa8-d24321e3e274 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Private endpoint connections on Azure SQL Database should be enabled 7698e800-9299-47a6-b3b6-5a0fee576eed SQL Default
Audit
Allowed
Audit, Disabled
0 GA
Private endpoint connections on Batch accounts should be enabled 009a0c92-f5b4-4776-9b66-4ed2b4775563 Batch Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Private endpoint should be enabled for MariaDB servers 0a1302fb-a631-4106-9753-f3d494733990 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Private endpoint should be enabled for MySQL servers 7595c971-233d-4bcf-bd18-596129188c49 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Private endpoint should be enabled for PostgreSQL servers 0564d078-92f5-4f97-8398-b9f58a51f70b SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Public network access on Azure SQL Database should be disabled 1b8ca024-1d5c-4dec-8995-b1a932b41780 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Public network access should be disabled for MariaDB servers fdccbe47-f3e3-4213-ad5d-ea459b2fa077 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Public network access should be disabled for MySQL flexible servers c9299215-ae47-4f50-9c54-8a392f68a052 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Public network access should be disabled for MySQL servers d9844e8a-1437-4aeb-a32c-0c992f056095 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Public network access should be disabled for PostgreSQL flexible servers 5e1de0e3-42cb-4ebc-a86d-61d0c619ca48 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Public network access should be disabled for PostgreSQL servers b52376f7-9612-48a1-81cd-1ffe4b61032c SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Require encryption on Data Lake Store accounts a7ff3161-0087-490a-9ad9-ad6217f4f43a Data Lake Fixed
deny
0 GA
Resource logs in Azure Data Lake Store should be enabled 057ef27e-665e-4328-8ea3-04b3122bd9fb Data Lake Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Azure Kubernetes Service should be enabled 245fc9df-fa96-4414-9a0b-3738c2f7341c Kubernetes Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Azure Machine Learning Workspaces should be enabled afe0c3be-ba3b-4544-ba52-0c99672a8ad6 Machine Learning Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Azure Stream Analytics should be enabled f9be5368-9bf5-4b84-9e0a-7850da98bb46 Stream Analytics Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Batch accounts should be enabled 428256e6-1fac-4f48-a757-df34c2b3336d Batch Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Data Lake Analytics should be enabled c95c74d9-38fe-4f0d-af86-0c7d626a315c Data Lake Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Event Hub should be enabled 83a214f7-d01a-484b-91a9-ed54470c9a6a Event Hub Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in IoT Hub should be enabled 383856f8-de7f-44a2-81fc-e5135b5c2aa4 Internet of Things Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Key Vault should be enabled cf820ca0-f99e-4f3e-84fb-66e913812d21 Key Vault Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Logic Apps should be enabled 34f95f76-5386-4de7-b824-0d8478470c9d Logic Apps Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Search services should be enabled b4330a05-a843-4bc8-bf9a-cacce50c67f4 Search Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Resource logs in Service Bus should be enabled f8d36e2f-389b-4ee4-898d-21aeb69a0f45 Service Bus Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Role-Based Access Control (RBAC) should be used on Kubernetes Services ac4a19c2-fa67-49b4-8ae5-0b2e78c49457 Security Center Default
Audit
Allowed
Audit, Disabled
0 GA
Secure transfer to storage accounts should be enabled 404c3081-a854-4457-ae30-26a93ef643f9 Storage Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign 617c02be-7f02-4efd-8836-3180d47b6c68 Service Fabric Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Service Fabric clusters should only use Azure Active Directory for client authentication b54ed75b-3e1a-44ac-a333-05ba39b99ff0 Service Fabric Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
SQL databases should have vulnerability findings resolved feedbf84-6b99-488c-acc2-71c829aa5ffc Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
SQL managed instances should use customer-managed keys to encrypt data at rest ac01ad65-10e5-46df-bdd9-6b0cad13e1d2 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
SQL servers on machines should have vulnerability findings resolved 6ba6d016-e7c3-4842-b8f2-4992ebc0d72d Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
SQL servers should use customer-managed keys to encrypt data at rest 0a370ff3-6cab-4e85-8995-295fd854c5b8 SQL Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
SQL servers with auditing to storage account destination should be configured with 90 days retention or higher 89099bee-89e0-4b26-a5f4-165451757743 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
SQL server-targeted autoprovisioning should be enabled for SQL servers on machines plan c6283572-73bb-4deb-bf2c-7a2b8f7462cb Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Storage account keys should not be expired 044985bb-afe1-42cd-8a36-9d5d42424537 Storage Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Storage accounts should have the specified minimum TLS version fe83a0eb-a853-422d-aac2-1bffd182c5d0 Storage Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Storage accounts should prevent shared key access 8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54 Storage Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Storage accounts should restrict network access 34c877ad-507e-4c82-993e-3452a6e0ad3c Storage Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Storage accounts should restrict network access using virtual network rules 2a1a9cdf-e04d-429a-8416-3bfb72a1b26f Storage Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Storage accounts should use customer-managed key for encryption 6fac406b-40ca-413b-bf8e-0bf964659c25 Storage Default
Audit
Allowed
Audit, Disabled
0 GA
Storage accounts should use private link 6edd7eda-6dd8-40f7-810d-67160c639cd9 Storage Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Subnets should be associated with a Network Security Group e71308d3-144b-4262-b144-efdc3cc90517 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Subscriptions should have a contact email address for security issues 4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Synapse Workspaces should have Microsoft Entra-only authentication enabled 6ea81a52-5ca7-4575-9669-eaa910b7edf8 Synapse Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Synapse Workspaces should use only Microsoft Entra identities for authentication during workspace creation 2158ddbe-fefa-408e-b43f-d4faef8ff3b8 Synapse Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
There should be more than one owner assigned to your subscription 09024ccc-0c5f-475e-9457-b7c0d9ed487b Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Transparent Data Encryption on SQL databases should be enabled 17k78e20-9358-41c9-923c-fb736d382a12 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Virtual machines and virtual machine scale sets should have encryption at host enabled fc4d8e41-e223-45ea-9bf5-eada37891d87 Compute Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity d26f7642-7545-4e18-9b75-8c9bbdee3a9a Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
VM Image Builder templates should use private link 2154edb9-244f-4741-9970-660785bccdaa VM Image Builder Default
Audit
Allowed
Audit, Disabled, Deny
0 GA
Vulnerabilities in security configuration on your machines should be remediated e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15 Security Center Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Vulnerability assessment should be enabled on SQL Managed Instance 1b7aa243-30e4-4c9e-bca8-d0d3022b634a SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Vulnerability assessment should be enabled on your SQL servers ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9 SQL Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Web Application Firewall (WAF) should be enabled for Application Gateway 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 Network Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Web Application Firewall (WAF) should use the specified mode for Application Gateway 12430be1-6cc8-4527-a9a8-e3d38f250096 Network Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Web Application Firewall (WAF) should use the specified mode for Azure Front Door Service 425bea59-a659-4cbb-8d31-34499bd030b8 Network Default
Audit
Allowed
Audit, Deny, Disabled
0 GA
Windows Defender Exploit Guard should be enabled on your machines bed48b13-6647-468e-aa2f-1af1d3f4dd40 Guest Configuration Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Windows machines should be configured to use secure communication protocols 5752e6d6-1206-46d8-8ab1-ecc2f71a8112 Guest Configuration Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA
Roles used Total Roles usage: 1
Total Roles unique usage: 1
Role Role Id Policies count Policies
Security Admin fb1c8493-542b-48eb-b624-b4c8fea62acd 1 Configure Microsoft Defender for Containers to be enabled
History
Date/Time (UTC ymd) (i) Changes
2024-10-18 17:51:45 add Policy [Deprecated]: Endpoint protection solution should be installed on virtual machine scale sets (26a828e1-e88f-464e-bbb3-c134a282b9de)
add Policy [Deprecated]: Monitor missing Endpoint Protection in Azure Security Center (af6cd1bd-1635-48cb-bde7-5b15693900b9)
add Policy [Deprecated]: Endpoint protection health issues should be resolved on your machines (8e42c1f2-a2ab-49bc-994a-12bcd0dc4ac2)
add Policy [Deprecated]: Endpoint protection should be installed on your machines (1f7c564c-0a90-4d44-b7e1-9d456cffaee8)
Description change: 'New Zealand Information Security Manual (ISM) policy initiative. This policy set includes definitions that have a Deny effect by default' to 'NZISM v3.8. The New Zealand Information Security Manual (NZISM) details processes and controls essential for the protection of all New Zealand Government information and systems. This initiative includes policies that address a subset of NZISM controls. Additional policies will be added in upcoming releases. For full details on controls, please refer to https://www.nzism.gcsb.govt.nz/ism-document. This policy set includes definitions that have a Deny effect by default.'
Version change: '1.4.0' to '1.5.0'
remove Policy [Deprecated]: Cognitive Services should use private link (cddd188c-4b82-4c48-a19d-ddf74ee66a01)
2024-10-15 17:53:51 Version change: '1.3.0' to '1.4.0'
remove Policy [Deprecated]: System updates should be installed on your machines (86b3d65f-7626-441e-b690-81a8b71cff60)
remove Policy [Deprecated]: System updates on virtual machine scale sets should be installed (c3f317a7-a95c-4547-b7e7-11017ebdf2fe)
2024-09-23 17:50:57 Version change: '1.2.1' to '1.3.0'
remove Policy [Deprecated]: Endpoint protection health issues should be resolved on your machines (8e42c1f2-a2ab-49bc-994a-12bcd0dc4ac2)
2024-09-13 17:47:48 Name change: '[Preview]: New Zealand ISM' to 'New Zealand ISM'
Version change: '1.2.0-preview' to '1.2.1'
2024-09-05 17:48:45 Version change: '1.1.0-preview' to '1.2.0-preview'
remove Policy [Deprecated]: Vulnerabilities in security configuration on your virtual machine scale sets should be remediated (3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4)
remove Policy [Deprecated]: Auto provisioning of the Log Analytics agent should be enabled on your subscription (475aae12-b88a-4572-8b36-9b712b2b3a17)
remove Policy [Deprecated]: Adaptive network hardening recommendations should be applied on internet facing virtual machines (08e6af2d-db70-460a-bfe9-d5bd474ba9d6)
remove Policy [Deprecated]: Adaptive application controls for defining safe applications should be enabled on your machines (47a6b606-51aa-4496-8bb7-64b11cf66adc)
remove Policy [Deprecated]: Vulnerabilities in container security configurations should be remediated (e8cbc669-f12d-49eb-93e7-9273119e9933)
remove Policy [Deprecated]: Allowlist rules in your adaptive application control policy should be updated (123a3936-f020-408a-ba0c-47873faf1534)
2024-08-29 17:47:54 Version change: '1.0.0-preview' to '1.1.0-preview'
remove Policy [Deprecated]: Monitor missing Endpoint Protection in Azure Security Center (af6cd1bd-1635-48cb-bde7-5b15693900b9)
remove Policy [Deprecated]: Endpoint protection should be installed on your machines (1f7c564c-0a90-4d44-b7e1-9d456cffaee8)
remove Policy [Deprecated]: Endpoint protection solution should be installed on virtual machine scale sets (26a828e1-e88f-464e-bbb3-c134a282b9de)
2024-08-01 18:19:47 add Initiative 4f5b1359-4f8e-4d7c-9733-ea47fcde891e
JSON compare
compare mode: version left: version right:
JSON
api-version=2021-06-01
EPAC