last sync: 2025-Mar-24 20:12:39 UTC

NCSC Cyber Assurance Framework (CAF) v3.2

Azure BuiltIn Policy Initiative (PolicySet)

Source Azure Portal
Display nameNCSC Cyber Assurance Framework (CAF) v3.2
Id6d220abf-cf6f-4b17-8f7e-0644c4cc84b4
Version1.1.0
Details on versioning
Versioning Versions supported for Versioning: 2
1.1.0
1.0.0
Built-in Versioning [Preview]
CategoryRegulatory Compliance
Microsoft Learn
DescriptionUK framework providing cybersecurity guidance for critical national infrastructure to protect systems and data.
Cloud environmentsAzureCloud = true
AzureChinaCloud = unknown
AzureUSGovernment = unknown
Available in AzUSGovUnknown, no evidence if Policy definition is/not available in AzureUSGovernment
TypeBuiltIn
DeprecatedFalse
PreviewFalse
Policy count Total Policies: 82
Builtin Policies: 82
Static Policies: 0
Policy used
Policy DisplayName Policy Id Category Version Versioning Effect Roles# Roles State policy in AzUSGov
[Preview]: Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed 8dfab9c4-fe7b-49ad-85e4-1e9be085358f Kubernetes 6.0.0-preview 1x
6.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Guest Attestation extension should be installed on supported Linux virtual machines 672fe5a1-2fcd-42d7-b85d-902b6e28c6ff Security Center 6.0.0-preview 1x
6.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: IoT Hub device provisioning service data should be encrypted using customer-managed keys (CMK) 47031206-ce96-41f8-861b-6a915f3de284 Internet of Things 1.0.0-preview 1x
1.0.0-preview
Default
Audit
Allowed
Audit, Deny, Disabled
0 Preview true
[Preview]: Linux virtual machines should use only signed and trusted boot components 13a6c84f-49a5-410a-b5df-5b880c3fe009 Security Center 1.0.0-preview 1x
1.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview unknown
[Preview]: Log Analytics Extension should be enabled for listed virtual machine images 32133ab0-ee4b-4b44-98d6-042180979d50 Monitoring 2.0.1-preview 1x
2.0.1-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
A Microsoft Entra administrator should be provisioned for MySQL servers 146412e9-005c-472b-9e48-c87b72ac229e SQL 1.1.1 2x
1.1.1, 1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
A Microsoft Entra administrator should be provisioned for PostgreSQL servers b4dec045-250a-48c2-b5cc-e0c4eec8b5b4 SQL 1.0.1 2x
1.0.1, 1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
An activity log alert should exist for specific Administrative operations b954148f-4c11-4c38-8221-be76711e194a Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
An activity log alert should exist for specific Policy operations c5447c04-a4d7-4ba8-a263-c9ee321a6858 Monitoring 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
An activity log alert should exist for specific Security operations 3b980d31-7904-4bb7-8575-5665739a8052 Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
API endpoints in Azure API Management should be authenticated 8ac833bd-f505-48d5-887e-c993a1d3eea0 Security Center 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
API Management should disable public network access to the service configuration endpoints df73bd95-24da-4a4f-96b9-4e8b94b402bd API Management 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
App Configuration should disable public network access 3d9f5e4c-9947-4579-9539-2a7695fbc187 App Configuration 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
App Service apps should have authentication enabled 95bccee9-a7f8-4bec-9ee9-62c3473701fc App Service 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should have Client Certificates (Incoming client certificates) enabled 19dd1db6-f442-49cf-a838-b0786b4401ef App Service 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Application Insights components should block log ingestion and querying from public networks 1bc02227-0cb6-4e11-8f53-eb0b22eab7e8 Monitoring 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA unknown
Audit Linux machines that allow remote connections from accounts without passwords ea53dbee-c6c9-4f0e-9f9e-de0039b78023 Guest Configuration 3.1.0 2x
3.1.0, 3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Linux machines that do not have the passwd file permissions set to 0644 e6955644-301c-44b5-a4c4-528577de6861 Guest Configuration 3.1.0 2x
3.1.0, 3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit virtual machines without disaster recovery configured 0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56 Compute 1.0.0 1x
1.0.0
Fixed
auditIfNotExists
0 GA true
Audit VMs that do not use managed disks 06a78e20-9358-41c9-923c-fb736d382a4d Compute 1.0.0 1x
1.0.0
Fixed
audit
0 GA true
Audit Windows machines missing any of specified members in the Administrators group 30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7 Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Audit Windows machines that do not have the maximum password age set to specified number of days 4ceb8dc2-559c-478b-a15b-733fbf1e3738 Guest Configuration 2.1.0 1x
2.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that do not have the password complexity setting enabled bf16e0bb-31e1-4646-8202-60a235cc7e74 Guest Configuration 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that have extra accounts in the Administrators group 3d2a3320-2a72-4c67-ac5f-caa40fbee2b2 Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Audit Windows machines that have the specified members in the Administrators group 69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Azure Arc enabled Kubernetes clusters should have the Azure Policy extension installed 6b2122c1-8120-4ff5-801b-17625a355590 Kubernetes 1.1.0 1x
1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for open-source relational databases should be enabled 0a9fbe0d-c5c4-4da8-87d8-f4fd77338835 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure Defender for SQL should be enabled for unprotected Azure SQL servers abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9 SQL 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for SQL should be enabled for unprotected MySQL flexible servers 3bc8a0d5-38e0-4a3d-a657-2cb64468fc34 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for SQL should be enabled for unprotected PostgreSQL flexible servers d38668f5-d155-42c7-ab3d-9b57b50f8fbf Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Event Hub namespaces should have local authentication methods disabled 5d4e3c65-4873-47be-94f3-6f8b953a3598 Event Hub 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Azure Key Vault should use RBAC permission model 12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5 Key Vault 1.0.1 2x
1.0.1, 1.0.0-preview
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Azure Machine Learning Computes should have local authentication methods disabled e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f Machine Learning 2.1.0 2x
2.1.0, 2.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Monitor Logs for Application Insights should be linked to a Log Analytics workspace d550e854-df1a-4de9-bf44-cd894b39a95e Monitoring 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA unknown
Azure Monitor solution 'Security and Audit' must be deployed 3e596b57-105f-48a6-be97-03e9243bad6e Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure SQL Database should have Microsoft Entra-only authentication enabled during creation abda6d70-9778-44e7-84a8-06713e6db027 SQL 1.2.0 2x
1.2.0, 1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure SQL Managed Instances should have Microsoft Entra-only authentication enabled during creation 78215662-041e-49ed-a9dd-5385911b3a1f SQL 1.2.0 2x
1.2.0, 1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Web Application Firewall should be enabled for Azure Front Door entry-points 055aa869-bc98-4af8-bafc-23f1ab6ffe2c Network 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Certificates should have the specified maximum validity period 0a075868-4c26-42ef-914c-5bc007359560 Key Vault 2.2.1 2x
2.2.1, 2.2.0-preview
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Cognitive Services accounts should use customer owned storage 46aa9b05-0e60-4eae-a88b-1e9d374fa515 Cognitive Services 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Cosmos DB database accounts should have local authentication methods disabled 5450f5bd-9c72-4390-a9c4-a7aba4edfdd2 Cosmos DB 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Disk encryption should be enabled on Azure Data Explorer f4b53539-8df9-40e4-86c6-6b607703bd4e Azure Data Explorer 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Email notification for high severity alerts should be enabled 6e2593d9-add6-4083-9c9b-4b7d2188c899 Security Center 1.2.0 3x
1.2.0, 1.1.0, 1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Flow logs should be configured for every network security group c251913d-7d24-4958-af87-478ed3b9ba41 Network 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Function apps should have Client Certificates (Incoming client certificates) enabled ab6a902f-9493-453b-928d-62c30b11b5a6 App Service 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should use managed identity 0da106f2-4ca3-48e8-bc85-c638fe6aea8f App Service 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Guest Configuration extension should be installed on your machines ae89ebca-1c92-4898-ac2c-9f63decb045c Security Center 1.0.3 1x
1.0.3
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Key Vault keys should have an expiration date 152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 Key Vault 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Key Vault secrets should have an expiration date 98728c90-32c7-4049-8429-847dc0f4fe37 Key Vault 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Kubernetes cluster containers should not share host process ID or host IPC namespace 47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8 Kubernetes 5.2.0 2x
5.2.0, 5.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Kubernetes cluster containers should only use allowed capabilities c26596ff-4d70-4e6a-9a30-c2506bd2f80c Kubernetes 6.2.0 2x
6.2.0, 6.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Kubernetes cluster should not allow privileged containers 95edb821-ddaf-4404-9732-666045e056b4 Kubernetes 9.2.0 2x
9.2.0, 9.1.0
Default
Deny
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Kubernetes clusters should not use the default namespace 9f061a12-e40d-4183-a00e-171812443373 Kubernetes 4.2.0 2x
4.2.0, 4.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Log Analytics extension should be enabled in virtual machine scale sets for listed virtual machine images 5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138 Monitoring 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Log Analytics workspaces should block log ingestion and querying from public networks 6c53d030-cc64-46f0-906d-2bc061cd1334 Monitoring 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA unknown
Managed disks should be double encrypted with both platform-managed and customer-managed keys ca91455f-eace-4f96-be59-e6e2c35b4816 Compute 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption d461a302-a187-421a-89ac-84acdb4edc04 Compute 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Management ports should be closed on your virtual machines 22730e10-96f6-4aac-ad84-9383d35b5917 Security Center 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Microsoft Defender for APIs should be enabled 7926a6d1-b268-4586-8197-e8ae90c877d7 Security Center 1.0.3 1x
1.0.3
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Microsoft Defender for Containers should be enabled 1c988dd6-ade4-430f-a608-2a3e5b0a6d38 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Microsoft Defender for SQL should be enabled for unprotected Synapse workspaces d31e5c31-63b2-4f12-887b-e49456834fa1 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Security Center standard pricing tier should be selected a1181c5f-672a-477a-979a-7d58aa086233 Security Center 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Storage account encryption scopes should use double encryption for data at rest bfecdea6-31c4-4045-ad42-71b9dc87247d Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Storage accounts should prevent shared key access 8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54 Storage 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Subscriptions should have a contact email address for security issues 4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7 Security Center 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Synapse Workspaces should use only Microsoft Entra identities for authentication during workspace creation 2158ddbe-fefa-408e-b43f-d4faef8ff3b8 Synapse 1.2.0 2x
1.2.0, 1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
The Log Analytics extension should be installed on Virtual Machine Scale Sets efbde977-ba53-4479-b8e9-10b957924fbf Monitoring 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity d26f7642-7545-4e18-9b75-8c9bbdee3a9a Security Center 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Virtual machines should be connected to a specified workspace f47b5582-33ec-4c5c-87c0-b010a6b2e917 Monitoring 1.1.0 1x
1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Virtual machines should be connected to an approved virtual network d416745a-506c-48b6-8ab1-83cb814bcaa3 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Virtual machines should have the Log Analytics extension installed a70ca396-0a34-413a-88e1-b956c1e683be Monitoring 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users 21a6bc25-125e-4d13-b82d-2e19b7208ab7 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - Accounts' ee984370-154a-4ee8-9726-19d900e56fc0 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - Audit' 33936777-f2ac-45aa-82ec-07958ec9ade4 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - Recovery console' f71be03e-e25b-4d0f-b8bc-9b3e309b66c0 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - User Account Control' 492a29ed-d143-4f03-b6a4-705ce081b463 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Settings - Account Policies' f2143251-70de-4e81-87a8-36cee5a2f29d Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking' 58383b73-94a9-4414-b382-4146eb02611b Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'User Rights Assignment' e068b215-0026-4354-b347-8fb2766f73a2 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Windows Firewall Properties' 35d9882c-993d-44e6-87d2-db66ce21b636 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements of the Azure compute security baseline 72650e9f-97bc-4b2a-ab5f-9781a9fcecbc Guest Configuration 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost. 3dc5edcd-002d-444c-b216-e123bbfa37c0 Guest Configuration 1.1.1 2x
1.1.1, 1.1.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Roles used No Roles used
History
Date/Time (UTC ymd) (i) Changes
2025-03-12 18:29:00 Version change: '1.0.0' to '1.1.0'
remove Policy [Deprecated]: Vulnerabilities in security configuration on your machines should be remediated (e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15)
2025-01-28 19:35:17 add Initiative 6d220abf-cf6f-4b17-8f7e-0644c4cc84b4
JSON compare
compare mode: version left: version right:
JSON
api-version=2023-04-01
EPAC