AzInitiativeAdvertizer

last sync: 2023-Dec-05 19:46:52 UTC

Azure Policy Initiative (PolicySet)

CIS Microsoft Azure Foundations Benchmark v1.3.0

Source

Azure Portal

Display name

CIS Microsoft Azure Foundations Benchmark v1.3.0

612b5213-9160-4969-8578-1518bd2a000c

Version

8.4.0
Details on versioning

Category

Regulatory Compliance
Microsoft Learn

Description

The Center for Internet Security (CIS) is a nonprofit entity whose mission is to 'identify, develop, validate, promote, and sustain best practice solutions for cyberdefense.' CIS benchmarks are configuration baselines and best practices for securely configuring a system. These policies address a subset of CIS Microsoft Azure Foundations Benchmark v1.3.0 controls. For more information, visit https://aka.ms/cisazure130-initiative

Type

BuiltIn

Deprecated

False

Preview

False

Policy count

Total Policies: 169
Builtin Policies: 169
Static Policies: 0

Policy used

Policy DisplayName	Policy Id	Category	Effect	State
[Deprecated]: Microsoft Defender for Storage (Classic) should be enabled	308fbb08-4ab8-4e67-9b29-592e93fb94fa	Security Center	Default Disabled Allowed AuditIfNotExists, Disabled	Deprecated
[Preview]: Storage account public access should be disallowed	4fa4b6c0-31ca-4c0d-b10d-24b96f62a751	Storage	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	Preview
Accounts with owner permissions on Azure resources should be MFA enabled	e3e008c3-56b9-4133-8fd7-d3347377402a	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Accounts with read permissions on Azure resources should be MFA enabled	81b3ccb4-e6e8-4e4a-8d05-5df25cd29fd4	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Accounts with write permissions on Azure resources should be MFA enabled	931e118d-50a1-4457-a5e4-78550e086c52	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Adhere to retention periods defined	1ecb79d7-1a06-9a3b-3be8-f434d04d1ec1	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Adopt biometric authentication mechanisms	7d7a8356-5c34-9a95-3118-1424cfaf192a	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Alert personnel of information spillage	9622aaa9-5c49-40e2-5bf8-660b7cd23deb	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
An activity log alert should exist for specific Administrative operations	b954148f-4c11-4c38-8221-be76711e194a	Monitoring	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
An activity log alert should exist for specific Policy operations	c5447c04-a4d7-4ba8-a263-c9ee321a6858	Monitoring	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
An activity log alert should exist for specific Security operations	3b980d31-7904-4bb7-8575-5665739a8052	Monitoring	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
An Azure Active Directory administrator should be provisioned for SQL servers	1f314764-cb73-4fc9-b863-8eca98ac36e9	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
App Service apps should have authentication enabled	95bccee9-a7f8-4bec-9ee9-62c3473701fc	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
App Service apps should have 'Client Certificates (Incoming client certificates)' enabled	5bb220d9-2698-4ee4-8404-b9c30c9df609	App Service	Default Audit Allowed Audit, Disabled	GA
App Service apps should have resource logs enabled	91a78b24-f231-4a8a-8da9-02c35b2b6510	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
App Service apps should only be accessible over HTTPS	a4af4a39-4135-47fb-b175-47fbdf85311d	App Service	Default Audit Allowed Audit, Disabled, Deny	GA
App Service apps should require FTPS only	4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
App Service apps should use latest 'HTTP Version'	8c122334-9d20-4eb8-89ea-ac9a705b74ae	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
App Service apps should use managed identity	2b9ad585-36bc-4615-b300-fd4435808332	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
App Service apps should use the latest TLS version	f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Audit privileged functions	f26af0b1-65b6-689a-a03f-352ad2d00f98	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Audit user account status	49c23d9b-02b0-0e42-4f94-e8cef1b8381b	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Audit VMs that do not use managed disks	06a78e20-9358-41c9-923c-fb736d382a4d	Compute	Fixed audit	GA
Auditing on SQL server should be enabled	a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Authenticate to cryptographic module	6f1de470-79f3-1572-866e-db0771352fc8	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Authorize access to security functions and information	aeed863a-0f56-429f-945d-8bb66bd06841	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Authorize and manage access	50e9324a-7410-0539-0662-2c1e775538b7	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Authorize remote access	dad8a2e9-6f27-4fc2-8933-7e99fe700c9c	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Auto provisioning of the Log Analytics agent should be enabled on your subscription	475aae12-b88a-4572-8b36-9b712b2b3a17	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Automate account management	2cc9c165-46bd-9762-5739-d2aae5ba90a1	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Azure Defender for App Service should be enabled	2913021d-f2fd-4f3d-b958-22354e2bdbcb	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Azure Defender for Azure SQL Database servers should be enabled	7fe3b40f-802b-4cdd-8bd4-fd799c948cc2	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Azure Defender for Key Vault should be enabled	0e6763cc-5078-4e64-889d-ff4d9a839047	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Azure Defender for servers should be enabled	4da35fc9-c9e7-4960-aec9-797fe7d9051d	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Azure Defender for SQL servers on machines should be enabled	6581d072-105e-4418-827f-bd446d56421b	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Azure Defender for SQL should be enabled for unprotected Azure SQL servers	abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Azure Defender for SQL should be enabled for unprotected SQL Managed Instances	abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Azure Role-Based Access Control (RBAC) should be used on Kubernetes Services	ac4a19c2-fa67-49b4-8ae5-0b2e78c49457	Security Center	Default Audit Allowed Audit, Disabled	GA
Block untrusted and unsigned processes that run from USB	3d399cf3-8fc6-0efc-6ab0-1412f1198517	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Configure actions for noncompliant devices	b53aa659-513e-032c-52e6-1ce0ba46582f	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Configure Azure Audit capabilities	a3e98638-51d4-4e28-910a-60e98c1a756f	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Configure workstations to check for digital certificates	26daf649-22d1-97e9-2a8a-01b182194d59	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Connection throttling should be enabled for PostgreSQL database servers	5345bb39-67dc-4960-a1bf-427e16b9a0bd	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Control information flow	59bedbdc-0ba9-39b9-66bb-1d1c192384e6	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Control physical access	55a7f9a0-6397-7589-05ef-5ed59a8149e7	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Correlate Vulnerability scan information	e3905a3c-97e7-0b4f-15fb-465c0927536f	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Define a physical key management process	51e4b233-8ee3-8bdc-8f5f-f33bd0d229b7	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Define cryptographic use	c4ccd607-702b-8ae6-8eeb-fc3339cd4b42	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Define organizational requirements for cryptographic key management	d661e9eb-4e15-5ba1-6f02-cdc467db0d6c	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Design an access control model	03b6427e-6072-4226-4bd9-a410ab65317e	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Detect network services that have not been authorized or approved	86ecd378-a3a0-5d5b-207c-05e6aaca43fc	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Determine assertion requirements	7a0ecd94-3699-5273-76a5-edb8499f655a	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Determine auditable events	2f67e567-03db-9d1f-67dc-b6ffb91312f4	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Develop an incident response plan	2b4e134f-1e4c-2bff-573e-082d85479b6e	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Develop and maintain baseline configurations	2f20840e-7925-221c-725d-757442753e7c	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Disable authenticators upon termination	d9d48ffb-0d8c-0bd5-5f31-5a5826d19f10	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Disconnections should be logged for PostgreSQL database servers.	eb6f77b9-bd53-4e35-a23d-7f65d5f0e446	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Document mobility training	83dfb2b8-678b-20a0-4c44-5c75ada023e6	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Document remote access guidelines	3d492600-27ba-62cc-a1c3-66eb919f6a0d	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Document security operations	2c6bee3a-2180-2430-440d-db3c7a849870	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Email notification for high severity alerts should be enabled	6e2593d9-add6-4083-9c9b-4b7d2188c899	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Employ flow control mechanisms of encrypted information	79365f13-8ba4-1f6c-2ac4-aa39929f56d0	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Employ least privilege access	1bc7fd64-291f-028e-4ed6-6e07886e163f	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Enable dual or joint authorization	2c843d78-8f64-92b5-6a9b-e8186c0e7eb6	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Enforce logical access	10c4210b-3ec9-9603-050d-77e4d26c7ebb	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Enforce mandatory and discretionary access control policies	b1666a13-8f67-9c47-155e-69e027ff6823	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Enforce security configuration settings	058e9719-1ff9-3653-4230-23f76b6492e0	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Enforce SSL connection should be enabled for MySQL database servers	e802a67a-daf5-4436-9ea6-f6d821dd0c5d	SQL	Default Audit Allowed Audit, Disabled	GA
Enforce SSL connection should be enabled for PostgreSQL database servers	d158790f-bfb0-486c-8631-2dc6b4e8e6af	SQL	Default Audit Allowed Audit, Disabled	GA
Enforce user uniqueness	e336d5f4-4d8f-0059-759c-ae10f63d1747	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Ensure cryptographic mechanisms are under configuration management	b8dad106-6444-5f55-307e-1e1cc9723e39	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Establish a configuration control board	7380631c-5bf5-0e3a-4509-0873becd8a63	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Establish a data leakage management procedure	3c9aa856-6b86-35dc-83f4-bc72cec74dea	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Establish and document a configuration management plan	526ed90e-890f-69e7-0386-ba5c0f1f784f	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Establish and document change control processes	bd4dc286-2f30-5b95-777c-681f3a7913d3	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Establish firewall and router configuration standards	398fdbd8-56fd-274d-35c6-fa2d3b2755a1	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Establish network segmentation for card holder data environment	f476f3b0-4152-526e-a209-44e5f8c968d7	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Function apps should have authentication enabled	c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Function apps should have 'Client Certificates (Incoming client certificates)' enabled	eaebaea7-8013-4ceb-9d14-7eb32271373c	App Service	Default Audit Allowed Audit, Disabled	GA
Function apps should require FTPS only	399b2637-a50f-4f95-96f8-3a145476eb15	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Function apps should use latest 'HTTP Version'	e2c1c086-2d84-4019-bff3-c44ccd95113c	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Function apps should use managed identity	0da106f2-4ca3-48e8-bc85-c638fe6aea8f	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Function apps should use the latest TLS version	f9d614c5-c173-4d56-95a7-b4437057d193	App Service	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Govern and monitor audit processing activities	333b4ada-4a02-0648-3d4d-d812974f1bb2	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Guest accounts with owner permissions on Azure resources should be removed	339353f6-2387-4a45-abe4-7f529d121046	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Guest accounts with read permissions on Azure resources should be removed	e9ac8f8e-ce22-4355-8f04-99b911d6be52	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Guest accounts with write permissions on Azure resources should be removed	94e1c2ac-cbbe-4cac-a2b5-389c812dee87	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Identify and authenticate network devices	ae5345d5-8dab-086a-7290-db43a3272198	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Identify and manage downstream information exchanges	c7fddb0e-3f44-8635-2b35-dc6b8e740b7c	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Implement an automated configuration management tool	33832848-42ab-63f3-1a55-c0ad309d44cd	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Implement controls to secure all media	e435f7e3-0dd9-58c9-451f-9b44b96c0232	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Implement controls to secure alternate work sites	cd36eeec-67e7-205a-4b64-dbfe3b4e3e4e	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Implement training for protecting authenticators	e4b00788-7e1c-33ec-0418-d048508e095b	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Issue public key certificates	97d91b33-7050-237b-3e23-a77d57d84e13	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Key Vault keys should have an expiration date	152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0	Key Vault	Default Audit Allowed Audit, Deny, Disabled	GA
Key Vault secrets should have an expiration date	98728c90-32c7-4049-8429-847dc0f4fe37	Key Vault	Default Audit Allowed Audit, Deny, Disabled	GA
Key vaults should have deletion protection enabled	0b60c0b2-2dc2-4e1c-b5c9-abbed971de53	Key Vault	Default Audit Allowed Audit, Deny, Disabled	GA
Log checkpoints should be enabled for PostgreSQL database servers	eb6f77b9-bd53-4e35-a23d-7f65d5f0e43d	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Log connections should be enabled for PostgreSQL database servers	eb6f77b9-bd53-4e35-a23d-7f65d5f0e442	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Maintain availability of information	3ad7f0bc-3d03-0585-4d24-529779bb02c2	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Maintain integrity of audit system	c0559109-6a27-a217-6821-5a6d44f92897	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Manage gateways	63f63e71-6c3f-9add-4c43-64de23e554a7	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Manage symmetric cryptographic keys	9c276cf3-596f-581a-7fbd-f5e46edaa0f4	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Manage system and admin accounts	34d38ea7-6754-1838-7031-d7fd07099821	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Manage the input, output, processing, and storage of data	e603da3a-8af7-4f8a-94cb-1bcc0e0333d2	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Microsoft Defender for Containers should be enabled	1c988dd6-ade4-430f-a608-2a3e5b0a6d38	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Monitor access across the organization	48c816c5-2190-61fc-8806-25d6f3df162f	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Monitor missing Endpoint Protection in Azure Security Center	af6cd1bd-1635-48cb-bde7-5b15693900b9	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Monitor privileged role assignment	ed87d27a-9abf-7c71-714c-61d881889da4	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Network Watcher should be enabled	b6e2945c-0b7b-40f5-9233-7a5323b5cdc6	Network	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Notify when account is not needed	8489ff90-8d29-61df-2d84-f9ab0f4c5e84	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Only approved VM extensions should be installed	c0e996f8-39cf-4af9-9f45-83fbde810432	Compute	Default Audit Allowed Audit, Deny, Disabled	GA
Perform a trend analysis on threats	50e81644-923d-33fc-6ebb-9733bc8d1a06	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Perform vulnerability scans	3c5e0e1a-216f-8f49-0a15-76ed0d8b8e1f	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Protect audit information	0e696f5a-451f-5c15-5532-044136538491	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Protect data in transit using encryption	b11697e8-9515-16f1-7a35-477d5c8a1344	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Protect passwords with encryption	b2d3e5a2-97ab-5497-565a-71172a729d93	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Protect special information	a315c657-4a00-8eba-15ac-44692ad24423	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Provide privacy training	518eafdd-08e5-37a9-795b-15a8d798056d	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Reassign or remove user privileges as needed	7805a343-275c-41be-9d62-7215b96212d8	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Remediate information system flaws	be38a620-000b-21cf-3cb3-ea151b704c3b	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Require approval for account creation	de770ba6-50dd-a316-2932-e0d972eaa734	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Resource logs in Azure Data Lake Store should be enabled	057ef27e-665e-4328-8ea3-04b3122bd9fb	Data Lake	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Azure Stream Analytics should be enabled	f9be5368-9bf5-4b84-9e0a-7850da98bb46	Stream Analytics	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Batch accounts should be enabled	428256e6-1fac-4f48-a757-df34c2b3336d	Batch	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Data Lake Analytics should be enabled	c95c74d9-38fe-4f0d-af86-0c7d626a315c	Data Lake	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Event Hub should be enabled	83a214f7-d01a-484b-91a9-ed54470c9a6a	Event Hub	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in IoT Hub should be enabled	383856f8-de7f-44a2-81fc-e5135b5c2aa4	Internet of Things	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Key Vault should be enabled	cf820ca0-f99e-4f3e-84fb-66e913812d21	Key Vault	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Logic Apps should be enabled	34f95f76-5386-4de7-b824-0d8478470c9d	Logic Apps	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Search services should be enabled	b4330a05-a843-4bc8-bf9a-cacce50c67f4	Search	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Resource logs in Service Bus should be enabled	f8d36e2f-389b-4ee4-898d-21aeb69a0f45	Service Bus	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Restrict access to private keys	8d140e8b-76c7-77de-1d46-ed1b2e112444	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Restrict access to privileged accounts	873895e8-0e3a-6492-42e9-22cd030e9fcd	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Retain security policies and procedures	efef28d0-3226-966a-a1e8-70e89c1b30bc	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Retain terminated user data	7c7032fe-9ce6-9092-5890-87a1a3755db1	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review account provisioning logs	a830fe9e-08c9-a4fb-420c-6f6bf1702395	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review audit data	6625638f-3ba1-7404-5983-0ea33d719d34	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review label activity and analytics	e23444b9-9662-40f3-289e-6d25c02b48fa	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review malware detections report weekly	4a6f5cbd-6c6b-006f-2bb1-091af1441bce	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review threat protection status weekly	fad161f5-5261-401a-22dd-e037bae011bd	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review user accounts	79f081c7-1634-01a1-708e-376197999289	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review user groups and applications with access to sensitive data	eb1c944e-0e94-647b-9b7e-fdb8d2af0838	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Review user privileges	f96d2186-79df-262d-3f76-f371e3b71798	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Revoke privileged roles as appropriate	32f22cfa-770b-057c-965b-450898425519	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Satisfy token quality requirements	056a723b-4946-9d2a-5243-3aa27c4d31a1	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Secure transfer to storage accounts should be enabled	404c3081-a854-4457-ae30-26a93ef643f9	Storage	Default Audit Allowed Audit, Deny, Disabled	GA
Set automated notifications for new and trending cloud applications in your organization	af38215f-70c4-0cd6-40c2-c52d86690a45	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
SQL managed instances should use customer-managed keys to encrypt data at rest	ac01ad65-10e5-46df-bdd9-6b0cad13e1d2	SQL	Default Audit Allowed Audit, Deny, Disabled	GA
SQL servers should use customer-managed keys to encrypt data at rest	0a370ff3-6cab-4e85-8995-295fd854c5b8	SQL	Default Audit Allowed Audit, Deny, Disabled	GA
SQL servers with auditing to storage account destination should be configured with 90 days retention or higher	89099bee-89e0-4b26-a5f4-165451757743	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Storage account containing the container with activity logs must be encrypted with BYOK	fbb99e8e-e444-4da0-9ff1-75c92f5a85b2	Monitoring	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Storage accounts should allow access from trusted Microsoft services	c9d007d0-c057-4772-b18c-01e546713bcd	Storage	Default Audit Allowed Audit, Deny, Disabled	GA
Storage accounts should restrict network access	34c877ad-507e-4c82-993e-3452a6e0ad3c	Storage	Default Audit Allowed Audit, Deny, Disabled	GA
Storage accounts should restrict network access using virtual network rules	2a1a9cdf-e04d-429a-8416-3bfb72a1b26f	Storage	Default Audit Allowed Audit, Deny, Disabled	GA
Storage accounts should use customer-managed key for encryption	6fac406b-40ca-413b-bf8e-0bf964659c25	Storage	Default Audit Allowed Audit, Disabled	GA
Subscriptions should have a contact email address for security issues	4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Support personal verification credentials issued by legal authorities	1d39b5d9-0392-8954-8359-575ce1957d1a	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
System updates should be installed on your machines	86b3d65f-7626-441e-b690-81a8b71cff60	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Terminate user session automatically	4502e506-5f35-0df4-684f-b326e3cc7093	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Transparent Data Encryption on SQL databases should be enabled	17k78e20-9358-41c9-923c-fb736d382a12	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Turn on sensors for endpoint security solution	5fc24b95-53f7-0ed1-2330-701b539b97fe	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Update antivirus definitions	ea9d7c95-2f10-8a4d-61d8-7469bd2e8d65	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Use privileged identity management	e714b481-8fac-64a2-14a9-6f079b2501a4	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Verify security functions	ece8bb17-4080-5127-915f-dc7267ee8549	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Verify software, firmware and information integrity	db28735f-518f-870e-15b4-49623cbe3aa0	Regulatory Compliance	Default Manual Allowed Manual, Disabled	GA
Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources	0961003e-5a0a-4549-abde-af6a37f2724d	Security Center	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Vulnerability assessment should be enabled on SQL Managed Instance	1b7aa243-30e4-4c9e-bca8-d0d3022b634a	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA
Vulnerability assessment should be enabled on your SQL servers	ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9	SQL	Default AuditIfNotExists Allowed AuditIfNotExists, Disabled	GA

Roles used

No Roles used

History

Date/Time (UTC ymd) (i)	Changes
2023-05-04 17:45:12	add Policy Guest accounts with read permissions on Azure resources should be removed (e9ac8f8e-ce22-4355-8f04-99b911d6be52) add Policy Accounts with write permissions on Azure resources should be MFA enabled (931e118d-50a1-4457-a5e4-78550e086c52) add Policy Accounts with read permissions on Azure resources should be MFA enabled (81b3ccb4-e6e8-4e4a-8d05-5df25cd29fd4) add Policy Guest accounts with write permissions on Azure resources should be removed (94e1c2ac-cbbe-4cac-a2b5-389c812dee87) add Policy Guest accounts with owner permissions on Azure resources should be removed (339353f6-2387-4a45-abe4-7f529d121046) add Policy Accounts with owner permissions on Azure resources should be MFA enabled (e3e008c3-56b9-4133-8fd7-d3347377402a) Version change: '8.2.0' to '8.4.0' remove Policy [Deprecated]: MFA should be enabled for accounts with write permissions on your subscription (9297c21d-2ed6-4474-b48f-163f75654ce3) remove Policy [Deprecated]: MFA should be enabled on accounts with owner permissions on your subscription (aa633080-8b72-40c4-a2d7-d00c03e80bed) remove Policy [Deprecated]: MFA should be enabled on accounts with read permissions on your subscription (e3576e28-8b17-4677-84c3-db2990658d64) remove Policy [Deprecated]: External accounts with read permissions should be removed from your subscription (5f76cf89-fbf2-47fd-a3f4-b891fa780b60) remove Policy App Service apps that use Python should use a specified 'Python version' (7008174a-fd10-4ef0-817e-fc820a951d73) remove Policy Function apps that use Java should use a specified 'Java version' (9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc) remove Policy [Deprecated]: External accounts with owner permissions should be removed from your subscription (f8456c1c-aa66-4dfb-861a-25d127b775c9) remove Policy App Service apps that use Java should use a specified 'Java version' (496223c3-ad65-4ecd-878a-bae78737e9ed) remove Policy [Deprecated]: External accounts with write permissions should be removed from your subscription (5c607a2e-c700-4744-8254-d77e7c9eb5e4) remove Policy Function apps that use Python should use a specified 'Python version' (7238174a-fd10-4ef0-817e-fc820a951d73) remove Policy App Service apps that use PHP should use a specified 'PHP version' (7261b898-8a84-4db8-9e04-18527132abb3)
2023-02-21 18:41:21	Version change: '8.1.0' to '8.2.0' remove Policy [Deprecated]: Resource logs in Virtual Machine Scale Sets should be enabled (7c1b1214-f927-48bf-8882-84f0af6588b1)
2023-01-19 18:07:18	Version change: '8.0.0' to '8.1.0' remove Policy [Deprecated]: Vulnerability Assessment settings for SQL server should contain an email address to receive scan reports (057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9)
2022-09-16 16:31:45	add Policy Update antivirus definitions (ea9d7c95-2f10-8a4d-61d8-7469bd2e8d65) add Policy Implement an automated configuration management tool (33832848-42ab-63f3-1a55-c0ad309d44cd) add Policy Audit privileged functions (f26af0b1-65b6-689a-a03f-352ad2d00f98) add Policy Authenticate to cryptographic module (6f1de470-79f3-1572-866e-db0771352fc8) add Policy Manage gateways (63f63e71-6c3f-9add-4c43-64de23e554a7) add Policy Review threat protection status weekly (fad161f5-5261-401a-22dd-e037bae011bd) add Policy Protect passwords with encryption (b2d3e5a2-97ab-5497-565a-71172a729d93) add Policy Establish a configuration control board (7380631c-5bf5-0e3a-4509-0873becd8a63) add Policy Ensure cryptographic mechanisms are under configuration management (b8dad106-6444-5f55-307e-1e1cc9723e39) add Policy Control physical access (55a7f9a0-6397-7589-05ef-5ed59a8149e7) add Policy Alert personnel of information spillage (9622aaa9-5c49-40e2-5bf8-660b7cd23deb) add Policy Detect network services that have not been authorized or approved (86ecd378-a3a0-5d5b-207c-05e6aaca43fc) add Policy Identify and manage downstream information exchanges (c7fddb0e-3f44-8635-2b35-dc6b8e740b7c) add Policy Provide privacy training (518eafdd-08e5-37a9-795b-15a8d798056d) add Policy Set automated notifications for new and trending cloud applications in your organization (af38215f-70c4-0cd6-40c2-c52d86690a45) add Policy Establish firewall and router configuration standards (398fdbd8-56fd-274d-35c6-fa2d3b2755a1) add Policy Manage system and admin accounts (34d38ea7-6754-1838-7031-d7fd07099821) add Policy Enforce mandatory and discretionary access control policies (b1666a13-8f67-9c47-155e-69e027ff6823) add Policy Restrict access to privileged accounts (873895e8-0e3a-6492-42e9-22cd030e9fcd) add Policy Enforce user uniqueness (e336d5f4-4d8f-0059-759c-ae10f63d1747) add Policy Protect audit information (0e696f5a-451f-5c15-5532-044136538491) add Policy Control information flow (59bedbdc-0ba9-39b9-66bb-1d1c192384e6) add Policy Manage the input, output, processing, and storage of data (e603da3a-8af7-4f8a-94cb-1bcc0e0333d2) add Policy Remediate information system flaws (be38a620-000b-21cf-3cb3-ea151b704c3b) add Policy Develop an incident response plan (2b4e134f-1e4c-2bff-573e-082d85479b6e) add Policy Perform vulnerability scans (3c5e0e1a-216f-8f49-0a15-76ed0d8b8e1f) add Policy Govern and monitor audit processing activities (333b4ada-4a02-0648-3d4d-d812974f1bb2) add Policy Verify security functions (ece8bb17-4080-5127-915f-dc7267ee8549) add Policy Protect data in transit using encryption (b11697e8-9515-16f1-7a35-477d5c8a1344) add Policy Develop and maintain baseline configurations (2f20840e-7925-221c-725d-757442753e7c) add Policy Adhere to retention periods defined (1ecb79d7-1a06-9a3b-3be8-f434d04d1ec1) add Policy Automate account management (2cc9c165-46bd-9762-5739-d2aae5ba90a1) add Policy Establish and document a configuration management plan (526ed90e-890f-69e7-0386-ba5c0f1f784f) add Policy Monitor access across the organization (48c816c5-2190-61fc-8806-25d6f3df162f) add Policy Verify software, firmware and information integrity (db28735f-518f-870e-15b4-49623cbe3aa0) add Policy Define cryptographic use (c4ccd607-702b-8ae6-8eeb-fc3339cd4b42) add Policy Identify and authenticate network devices (ae5345d5-8dab-086a-7290-db43a3272198) add Policy Define a physical key management process (51e4b233-8ee3-8bdc-8f5f-f33bd0d229b7) add Policy Turn on sensors for endpoint security solution (5fc24b95-53f7-0ed1-2330-701b539b97fe) add Policy Authorize access to security functions and information (aeed863a-0f56-429f-945d-8bb66bd06841) add Policy Block untrusted and unsigned processes that run from USB (3d399cf3-8fc6-0efc-6ab0-1412f1198517) add Policy Establish network segmentation for card holder data environment (f476f3b0-4152-526e-a209-44e5f8c968d7) add Policy Enforce logical access (10c4210b-3ec9-9603-050d-77e4d26c7ebb) add Policy Retain security policies and procedures (efef28d0-3226-966a-a1e8-70e89c1b30bc) add Policy Manage symmetric cryptographic keys (9c276cf3-596f-581a-7fbd-f5e46edaa0f4) add Policy Document security operations (2c6bee3a-2180-2430-440d-db3c7a849870) add Policy Employ flow control mechanisms of encrypted information (79365f13-8ba4-1f6c-2ac4-aa39929f56d0) add Policy Revoke privileged roles as appropriate (32f22cfa-770b-057c-965b-450898425519) add Policy Maintain integrity of audit system (c0559109-6a27-a217-6821-5a6d44f92897) add Policy Determine assertion requirements (7a0ecd94-3699-5273-76a5-edb8499f655a) add Policy Protect special information (a315c657-4a00-8eba-15ac-44692ad24423) add Policy Notify when account is not needed (8489ff90-8d29-61df-2d84-f9ab0f4c5e84) add Policy Maintain availability of information (3ad7f0bc-3d03-0585-4d24-529779bb02c2) add Policy Implement controls to secure alternate work sites (cd36eeec-67e7-205a-4b64-dbfe3b4e3e4e) add Policy Employ least privilege access (1bc7fd64-291f-028e-4ed6-6e07886e163f) add Policy Review account provisioning logs (a830fe9e-08c9-a4fb-420c-6f6bf1702395) add Policy Enable dual or joint authorization (2c843d78-8f64-92b5-6a9b-e8186c0e7eb6) add Policy Define organizational requirements for cryptographic key management (d661e9eb-4e15-5ba1-6f02-cdc467db0d6c) add Policy Review user accounts (79f081c7-1634-01a1-708e-376197999289) add Policy Enforce security configuration settings (058e9719-1ff9-3653-4230-23f76b6492e0) add Policy Restrict access to private keys (8d140e8b-76c7-77de-1d46-ed1b2e112444) add Policy Review audit data (6625638f-3ba1-7404-5983-0ea33d719d34) add Policy Support personal verification credentials issued by legal authorities (1d39b5d9-0392-8954-8359-575ce1957d1a) add Policy Review user groups and applications with access to sensitive data (eb1c944e-0e94-647b-9b7e-fdb8d2af0838) add Policy Reassign or remove user privileges as needed (7805a343-275c-41be-9d62-7215b96212d8) add Policy Establish a data leakage management procedure (3c9aa856-6b86-35dc-83f4-bc72cec74dea) add Policy Audit user account status (49c23d9b-02b0-0e42-4f94-e8cef1b8381b) add Policy Monitor privileged role assignment (ed87d27a-9abf-7c71-714c-61d881889da4) add Policy Implement controls to secure all media (e435f7e3-0dd9-58c9-451f-9b44b96c0232) add Policy Use privileged identity management (e714b481-8fac-64a2-14a9-6f079b2501a4) add Policy Review malware detections report weekly (4a6f5cbd-6c6b-006f-2bb1-091af1441bce) add Policy Terminate user session automatically (4502e506-5f35-0df4-684f-b326e3cc7093) add Policy Configure workstations to check for digital certificates (26daf649-22d1-97e9-2a8a-01b182194d59) add Policy Design an access control model (03b6427e-6072-4226-4bd9-a410ab65317e) add Policy Document remote access guidelines (3d492600-27ba-62cc-a1c3-66eb919f6a0d) add Policy Authorize remote access (dad8a2e9-6f27-4fc2-8933-7e99fe700c9c) add Policy Satisfy token quality requirements (056a723b-4946-9d2a-5243-3aa27c4d31a1) add Policy Retain terminated user data (7c7032fe-9ce6-9092-5890-87a1a3755db1) add Policy Correlate Vulnerability scan information (e3905a3c-97e7-0b4f-15fb-465c0927536f) add Policy Review user privileges (f96d2186-79df-262d-3f76-f371e3b71798) add Policy Require approval for account creation (de770ba6-50dd-a316-2932-e0d972eaa734) add Policy Authorize and manage access (50e9324a-7410-0539-0662-2c1e775538b7) add Policy Determine auditable events (2f67e567-03db-9d1f-67dc-b6ffb91312f4) add Policy Configure Azure Audit capabilities (a3e98638-51d4-4e28-910a-60e98c1a756f) add Policy Establish and document change control processes (bd4dc286-2f30-5b95-777c-681f3a7913d3) add Policy Review label activity and analytics (e23444b9-9662-40f3-289e-6d25c02b48fa) add Policy Adopt biometric authentication mechanisms (7d7a8356-5c34-9a95-3118-1424cfaf192a) add Policy Issue public key certificates (97d91b33-7050-237b-3e23-a77d57d84e13) add Policy Disable authenticators upon termination (d9d48ffb-0d8c-0bd5-5f31-5a5826d19f10) add Policy Perform a trend analysis on threats (50e81644-923d-33fc-6ebb-9733bc8d1a06) add Policy Configure actions for noncompliant devices (b53aa659-513e-032c-52e6-1ce0ba46582f) add Policy Implement training for protecting authenticators (e4b00788-7e1c-33ec-0418-d048508e095b) add Policy Document mobility training (83dfb2b8-678b-20a0-4c44-5c75ada023e6) Version change: '7.0.0' to '8.0.0'
2022-09-05 16:34:24	Description change: 'This initiative includes policies that address a subset of CIS Microsoft Azure Foundations Benchmark recommendations. Additional policies will be added in upcoming releases. For more information, visit https://aka.ms/cisazure130-initiative.' to 'The Center for Internet Security (CIS) is a nonprofit entity whose mission is to 'identify, develop, validate, promote, and sustain best practice solutions for cyberdefense.' CIS benchmarks are configuration baselines and best practices for securely configuring a system. These policies address a subset of CIS Microsoft Azure Foundations Benchmark v1.3.0 controls. For more information, visit https://aka.ms/cisazure130-initiative'
2022-07-07 16:32:14	Version change: '6.1.0' to '7.0.0' remove Policy [Deprecated]: Ensure that 'HTTP Version' is the latest, if used to run the API app (991310cd-e9f3-47bc-b7b6-f57b557d07db) remove Policy [Deprecated]: Authentication should be enabled on your API app (c4ebc54a-46e1-481a-bee2-d4411e95d828) remove Policy [Deprecated]: Ensure that 'Java version' is the latest, if used as a part of the API app (88999f4c-376a-45c8-bcb3-4058f713cf39) remove Policy [Deprecated]: API apps that use Python should use the latest 'Python version' (74c3584d-afae-46f7-a20a-6f8adba71a16) remove Policy [Deprecated]: Managed identity should be used in your API App (c4d441f8-f9d9-4a9e-9cef-e82117cb3eef) remove Policy [Deprecated]: Ensure that 'PHP version' is the latest, if used as a part of the API app (1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba) remove Policy [Deprecated]: Latest TLS version should be used in your API App (8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e) remove Policy [Deprecated]: API apps should have 'Client Certificates (Incoming client certificates)' enabled (0c192fe8-9cbb-4516-85b3-0ade8bd03886) remove Policy [Deprecated]: FTPS only should be required in your API App (9a1b8c48-453a-4044-86c3-d8bfd823e4f5)
2022-04-22 19:50:54	Version change: '6.0.0' to '6.1.0'
2022-01-27 17:51:51	remove Policy [Deprecated]: Custom subscription owner roles should not exist (10ee2ea2-fb4d-45b8-a7e9-a2e770044cd9)
2022-01-13 19:18:29	add Policy Microsoft Defender for Containers should be enabled (1c988dd6-ade4-430f-a608-2a3e5b0a6d38) add Policy App Service apps should have resource logs enabled (91a78b24-f231-4a8a-8da9-02c35b2b6510) remove Policy [Deprecated]: Azure Defender for Kubernetes should be enabled (523b5cd1-3e23-492f-a539-13118b6d1e3a) remove Policy [Deprecated]: Azure Defender for container registries should be enabled (c25d9a16-bc35-4e15-a7e5-9db606bf9ed4) remove Policy [Deprecated]: Unattached disks should be encrypted (2c89a2e5-7285-40fe-afe0-ae8654b92fb2) remove Policy [Deprecated]: Diagnostic logs in App Services should be enabled (b607c5de-e7d9-4eee-9e5c-83f1bcee4fa0)
2021-12-08 16:24:23	add Policy SQL managed instances should use customer-managed keys to encrypt data at rest (ac01ad65-10e5-46df-bdd9-6b0cad13e1d2) add Policy SQL servers should use customer-managed keys to encrypt data at rest (0a370ff3-6cab-4e85-8995-295fd854c5b8) remove Policy [Deprecated]: SQL servers should use customer-managed keys to encrypt data at rest (0d134df8-db83-46fb-ad72-fe0c9428c8dd) remove Policy [Deprecated]: SQL managed instances should use customer-managed keys to encrypt data at rest (048248b0-55cd-46da-b1ff-39efd52db260)
2021-09-30 16:01:51	remove Policy [Deprecated]: SSH access from the Internet should be blocked (2c89a2e5-7285-40fe-afe0-ae8654b92fab) remove Policy [Deprecated]: RDP access from the Internet should be blocked (e372f825-a257-4fb8-9175-797a8a8627d6)
2021-07-08 14:19:52	Name change: '[Preview]: CIS Microsoft Azure Foundations Benchmark v1.3.0' to 'CIS Microsoft Azure Foundations Benchmark v1.3.0'
2021-04-07 13:27:17	Name change: '[Preview]: CIS Microsoft Azure Foundations Benchmark 1.3.0' to '[Preview]: CIS Microsoft Azure Foundations Benchmark v1.3.0'
2021-02-17 14:28:42	add Initiative 612b5213-9160-4969-8578-1518bd2a000c

JSON compare

compare mode: version left: version right:

JSON

api-version=2021-06-01
EPAC