last sync: 2025-Mar-23 22:31:03 UTC

EU General Data Protection Regulation (GDPR) 2016/679

Azure BuiltIn Policy Initiative (PolicySet)

Source Azure Portal
Display nameEU General Data Protection Regulation (GDPR) 2016/679
Id7326812a-86a4-40c8-af7c-8945de9c4913
Version1.0.0
Details on versioning
Versioning Versions supported for Versioning: 1
1.0.0
Built-in Versioning [Preview]
CategoryRegulatory Compliance
Microsoft Learn
DescriptionComprehensive data protection law regulating personal data processing within the EU.
Cloud environmentsAzureCloud = true
AzureChinaCloud = unknown
AzureUSGovernment = unknown
Available in AzUSGovUnknown, no evidence if Policy definition is/not available in AzureUSGovernment
TypeBuiltIn
DeprecatedFalse
PreviewFalse
Policy count Total Policies: 313
Builtin Policies: 313
Static Policies: 0
Policy used
Policy DisplayName Policy Id Category Version Versioning Effect Roles# Roles State policy in AzUSGov
[Deprecated]: Vulnerabilities in security configuration on your machines should be remediated e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15 Security Center 3.2.0 (3.2.0-deprecated) 2x
3.2.0, 3.1.0
Default
Disabled
Allowed
AuditIfNotExists, Disabled
0 Deprecated true
[Preview]: All Internet traffic should be routed via your deployed Azure Firewall fc5e4038-4584-4632-8c85-c0448d374b2c Network 3.0.0-preview 1x
3.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview unknown
[Preview]: Azure Arc enabled Kubernetes clusters should have Microsoft Defender for Cloud extension installed 8dfab9c4-fe7b-49ad-85e4-1e9be085358f Kubernetes 6.0.0-preview 1x
6.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Azure PostgreSQL flexible server should have Microsoft Entra Only Authentication enabled fa498b91-8a7e-4710-9578-da944c68d1fe SQL 1.0.0-preview 1x
1.0.0-preview
Default
Audit
Allowed
Audit, Disabled
0 Preview true
[Preview]: Azure Recovery Services vaults should use customer-managed keys for encrypting backup data 2e94d99a-8a36-4563-bc77-810d8893b671 Backup 1.0.0-preview 1x
1.0.0-preview
Default
Audit
Allowed
Audit, Deny, Disabled
0 Preview true
[Preview]: Azure Recovery Services vaults should use private link for backup deeddb44-9f94-4903-9fa0-081d524406e3 Backup 2.0.0-preview 1x
2.0.0-preview
Default
Audit
Allowed
Audit, Disabled
0 Preview unknown
[Preview]: Container Registry should use a virtual network service endpoint c4857be7-912a-4c75-87e6-e30292bcdf78 Network 1.0.0-preview 1x
1.0.0-preview
Default
Audit
Allowed
Audit, Disabled
0 Preview true
[Preview]: Guest Attestation extension should be installed on supported Linux virtual machines 672fe5a1-2fcd-42d7-b85d-902b6e28c6ff Security Center 6.0.0-preview 1x
6.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Guest Attestation extension should be installed on supported Linux virtual machines scale sets a21f8c92-9e22-4f09-b759-50500d1d2dda Security Center 5.1.0-preview 1x
5.1.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Guest Attestation extension should be installed on supported Windows virtual machines 1cb4d9c2-f88f-4069-bee0-dba239a57b09 Security Center 4.0.0-preview 1x
4.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Guest Attestation extension should be installed on supported Windows virtual machines scale sets f655e522-adff-494d-95c2-52d4f6d56a42 Security Center 3.1.0-preview 1x
3.1.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: IoT Hub device provisioning service data should be encrypted using customer-managed keys (CMK) 47031206-ce96-41f8-861b-6a915f3de284 Internet of Things 1.0.0-preview 1x
1.0.0-preview
Default
Audit
Allowed
Audit, Deny, Disabled
0 Preview true
[Preview]: Linux virtual machines should use only signed and trusted boot components 13a6c84f-49a5-410a-b5df-5b880c3fe009 Security Center 1.0.0-preview 1x
1.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview unknown
[Preview]: Log Analytics Extension should be enabled for listed virtual machine images 32133ab0-ee4b-4b44-98d6-042180979d50 Monitoring 2.0.1-preview 1x
2.0.1-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Log Analytics extension should be installed on your Linux Azure Arc machines 842c54e8-c2f9-4d79-ae8d-38d8b8019373 Monitoring 1.0.1-preview 1x
1.0.1-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview unknown
[Preview]: Log Analytics extension should be installed on your Windows Azure Arc machines d69b1763-b96d-40b8-a2d9-ca31e9fd0d3e Monitoring 1.0.1-preview 1x
1.0.1-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview unknown
[Preview]: Machines should have ports closed that might expose attack vectors af99038c-02fd-4a2f-ac24-386b62bf32de Security Center 1.0.0-preview 1x
1.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview unknown
[Preview]: Network traffic data collection agent should be installed on Linux virtual machines 04c4380f-3fae-46e8-96c9-30193528f602 Monitoring 1.0.2-preview 1x
1.0.2-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Network traffic data collection agent should be installed on Windows virtual machines 2f2ee1de-44aa-4762-b6bd-0893fc3f306d Monitoring 1.0.2-preview 1x
1.0.2-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 Preview true
[Preview]: Recovery Services vaults should use private link 11e3da8c-1d68-4392-badd-0ff3c43ab5b0 Site Recovery 1.0.0-preview 1x
1.0.0-preview
Default
Audit
Allowed
Audit, Disabled
0 Preview unknown
[Preview]: Secure Boot should be enabled on supported Windows virtual machines 97566dd7-78ae-4997-8b36-1c7bfe0d8121 Security Center 4.0.0-preview 1x
4.0.0-preview
Default
Audit
Allowed
Audit, Disabled
0 Preview true
[Preview]: vTPM should be enabled on supported virtual machines 1c30f9cd-b84c-49cc-aa2c-9288447cc3b3 Security Center 2.0.0-preview 1x
2.0.0-preview
Default
Audit
Allowed
Audit, Disabled
0 Preview true
A Microsoft Entra administrator should be provisioned for MySQL servers 146412e9-005c-472b-9e48-c87b72ac229e SQL 1.1.1 2x
1.1.1, 1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
A Microsoft Entra administrator should be provisioned for PostgreSQL servers b4dec045-250a-48c2-b5cc-e0c4eec8b5b4 SQL 1.0.1 2x
1.0.1, 1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
A vulnerability assessment solution should be enabled on your virtual machines 501541f7-f7e7-4cd6-868c-4190fdad3ac9 Security Center 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities 3cf2ab00-13f1-4d0c-8971-2ac904541a7e Guest Configuration 4.1.0 2x
4.1.0, 4.0.0
Fixed
modify
1 Contributor GA true
Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity 497dff13-db2a-4c0f-8603-28fa3b331ab6 Guest Configuration 4.1.0 2x
4.1.0, 4.0.0
Fixed
modify
1 Contributor GA true
All authorization rules except RootManageSharedAccessKey should be removed from Service Bus namespace a1817ec0-a368-432a-8057-8371e17ac6ee Service Bus 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
All network ports should be restricted on network security groups associated to your virtual machine 9daedab3-fb2d-461e-b861-71790eead4f6 Security Center 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
An activity log alert should exist for specific Administrative operations b954148f-4c11-4c38-8221-be76711e194a Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
An activity log alert should exist for specific Policy operations c5447c04-a4d7-4ba8-a263-c9ee321a6858 Monitoring 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
An activity log alert should exist for specific Security operations 3b980d31-7904-4bb7-8575-5665739a8052 Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
An Azure Active Directory administrator should be provisioned for SQL servers 1f314764-cb73-4fc9-b863-8eca98ac36e9 SQL 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
API endpoints in Azure API Management should be authenticated 8ac833bd-f505-48d5-887e-c993a1d3eea0 Security Center 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
API Management minimum API version should be set to 2019-12-01 or higher 549814b6-3212-4203-bdc8-1548d342fb67 API Management 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
API Management services should use a virtual network ef619a2c-cc4d-4d03-b2ba-8c94a834d85b API Management 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
API Management should disable public network access to the service configuration endpoints df73bd95-24da-4a4f-96b9-4e8b94b402bd API Management 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
App Configuration should disable public network access 3d9f5e4c-9947-4579-9539-2a7695fbc187 App Configuration 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
App Configuration should use a customer-managed key 967a4b4b-2da9-43c1-b7d0-f98d0d74d0b1 App Configuration 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
App Configuration should use private link ca610c1d-041c-4332-9d88-7ed3094967c7 App Configuration 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should have authentication enabled 95bccee9-a7f8-4bec-9ee9-62c3473701fc App Service 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should have Client Certificates (Incoming client certificates) enabled 19dd1db6-f442-49cf-a838-b0786b4401ef App Service 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should have remote debugging turned off cb510bfd-1cba-4d9f-a230-cb0976f4bb71 App Service 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should have resource logs enabled 91a78b24-f231-4a8a-8da9-02c35b2b6510 App Service 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should not have CORS configured to allow every resource to access your apps 5744710e-cc2f-4ee8-8809-3b11e89f4bc9 App Service 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should only be accessible over HTTPS a4af4a39-4135-47fb-b175-47fbdf85311d App Service 4.0.0 1x
4.0.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA true
App Service apps should require FTPS only 4d24b6d4-5e53-4a4f-a7f4-618fa573ee4b App Service 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should use a virtual network service endpoint 2d21331d-a4c2-4def-a9ad-ee4e1e023beb Network 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should use latest 'HTTP Version' 8c122334-9d20-4eb8-89ea-ac9a705b74ae App Service 4.0.0 1x
4.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should use managed identity 2b9ad585-36bc-4615-b300-fd4435808332 App Service 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service apps should use the latest TLS version f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b App Service 2.1.0 2x
2.1.0, 2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
App Service Environment should have internal encryption enabled fb74e86f-d351-4b8d-b034-93da7391c01f App Service 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Application Insights components should block log ingestion and querying from public networks 1bc02227-0cb6-4e11-8f53-eb0b22eab7e8 Monitoring 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA unknown
Audit diagnostic setting for selected resource types 7f89b1eb-583c-429a-8828-af049802c1d9 Monitoring 2.0.1 1x
2.0.1
Fixed
AuditIfNotExists
0 GA true
Audit flow logs configuration for every virtual network 4c3c6c5f-0d47-4402-99b8-aa543dd8bcee Network 1.0.1 2x
1.0.1, 1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA unknown
Audit Linux machines that allow remote connections from accounts without passwords ea53dbee-c6c9-4f0e-9f9e-de0039b78023 Guest Configuration 3.1.0 2x
3.1.0, 3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Linux machines that do not have the passwd file permissions set to 0644 e6955644-301c-44b5-a4c4-528577de6861 Guest Configuration 3.1.0 2x
3.1.0, 3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Linux machines that have accounts without passwords f6ec09a3-78bf-4f8f-99dc-6c77182d0f99 Guest Configuration 3.1.0 2x
3.1.0, 3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit resource location matches resource group location 0a914e76-4921-4c19-b460-a2d36003525a General 2.0.0 1x
2.0.0
Fixed
audit
0 GA unknown
Audit usage of custom RBAC roles a451c1ef-c6ca-483d-87ed-f49761e3ffb5 General 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Audit virtual machines without disaster recovery configured 0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56 Compute 1.0.0 1x
1.0.0
Fixed
auditIfNotExists
0 GA true
Audit VMs that do not use managed disks 06a78e20-9358-41c9-923c-fb736d382a4d Compute 1.0.0 1x
1.0.0
Fixed
audit
0 GA true
Audit Windows machines missing any of specified members in the Administrators group 30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7 Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Audit Windows machines on which the Log Analytics agent is not connected as expected 6265018c-d7e2-432f-a75d-094d5f6f4465 Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Audit Windows machines that allow re-use of the passwords after the specified number of unique passwords 5b054a0d-39e2-4d53-bea3-9734cad2c69b Guest Configuration 2.1.0 1x
2.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that do not contain the specified certificates in Trusted Root 934345e1-4dfb-4c70-90d7-41990dc9608b Guest Configuration 3.0.0 1x
3.0.0
Fixed
auditIfNotExists
0 GA true
Audit Windows machines that do not have the maximum password age set to specified number of days 4ceb8dc2-559c-478b-a15b-733fbf1e3738 Guest Configuration 2.1.0 1x
2.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that do not have the minimum password age set to specified number of days 237b38db-ca4d-4259-9e47-7882441ca2c0 Guest Configuration 2.1.0 1x
2.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that do not have the password complexity setting enabled bf16e0bb-31e1-4646-8202-60a235cc7e74 Guest Configuration 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that do not restrict the minimum password length to specified number of characters a2d0e922-65d0-40c4-8f87-ea6da2d307a2 Guest Configuration 2.1.0 1x
2.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that do not store passwords using reversible encryption da0f98fe-a24b-4ad5-af69-bd0400233661 Guest Configuration 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Audit Windows machines that don't have the specified applications installed ebb67efd-3c46-49b0-adfe-5599eb944998 Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Audit Windows machines that have extra accounts in the Administrators group 3d2a3320-2a72-4c67-ac5f-caa40fbee2b2 Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Audit Windows machines that have the specified members in the Administrators group 69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f Guest Configuration 2.0.0 1x
2.0.0
Fixed
auditIfNotExists
0 GA true
Auditing on SQL server should be enabled a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9 SQL 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Authentication to Linux machines should require SSH keys 630c64f9-8b6b-4c64-b511-6544ceff6fd6 Guest Configuration 3.2.0 2x
3.2.0, 3.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Authorization rules on the Event Hub instance should be defined f4826e5f-6a27-407c-ae3e-9582eb39891d Event Hub 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Authorized IP ranges should be defined on Kubernetes Services 0e246bcf-5f6f-4f87-bc6f-775d4712c7ea Security Center 2.0.1 1x
2.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Automation account variables should be encrypted 3657f5a0-770e-44a3-b44e-9431ba1e9735 Automation 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure AI Services resources should encrypt data at rest with a customer-managed key (CMK) 67121cc7-ff39-4ab8-b7e3-95b84dab487d Cognitive Services 2.2.0 2x
2.2.0, 2.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure AI Services resources should have key access disabled (disable local authentication) 71ef260a-8f18-47b7-abcb-62d0673d94dc Azure Ai Services 1.1.0 2x
1.1.0, 1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure AI Services resources should restrict network access 037eea7a-bd0a-46c5-9a66-03aea78705d3 Azure Ai Services 3.2.0 3x
3.2.0, 3.1.0, 3.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure AI Services resources should use Azure Private Link d6759c02-b87f-42b7-892e-71b3f471d782 Azure Ai Services 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure API for FHIR should use a customer-managed key to encrypt data at rest 051cba44-2429-45b9-9649-46cec11c7119 API for FHIR 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, disabled, Disabled
0 GA unknown
Azure API for FHIR should use private link 1ee56206-5dd1-42ab-b02d-8aae8b1634ce API for FHIR 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA unknown
Azure API Management platform version should be stv2 1dc2fc00-2245-4143-99f4-874c937f13ef API Management 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Azure Arc enabled Kubernetes clusters should have the Azure Policy extension installed 6b2122c1-8120-4ff5-801b-17625a355590 Kubernetes 1.1.0 1x
1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Automation accounts should use customer-managed keys to encrypt data at rest 56a5ee18-2ae6-4810-86f7-18e39ce5629b Automation 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Backup should be enabled for Virtual Machines 013e242c-8828-4970-87b3-ab247555486d Backup 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Batch account should use customer-managed keys to encrypt data 99e9ccd8-3db9-4592-b0d1-14b1715a4d8a Batch 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Cache for Redis should use private link 7803067c-7d34-46e3-8c79-0ca68fc4036d Cache 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Container Instance container group should deploy into a virtual network 8af8f826-edcb-4178-b35f-851ea6fea615 Container Instance 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA unknown
Azure Container Instance container group should use customer-managed key for encryption 0aa61e00-0a01-4a3c-9945-e93cffedf0e6 Container Instance 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA true
Azure Cosmos DB accounts should have firewall rules 862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb Cosmos DB 2.1.0 2x
2.1.0, 2.0.0
Default
Deny
Allowed
Audit, Deny, Disabled
0 GA true
Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest 1f905d99-2ab7-462c-a6b0-f709acca6c8f Cosmos DB 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Azure Cosmos DB should disable public network access 797b37f7-06b8-444c-b1ad-fc62867f335a Cosmos DB 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Data Explorer encryption at rest should use a customer-managed key 81e74cea-30fd-40d5-802f-d72103c2aaaa Azure Data Explorer 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Defender for App Service should be enabled 2913021d-f2fd-4f3d-b958-22354e2bdbcb Security Center 1.0.3 1x
1.0.3
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure Defender for Azure SQL Database servers should be enabled 7fe3b40f-802b-4cdd-8bd4-fd799c948cc2 Security Center 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for Key Vault should be enabled 0e6763cc-5078-4e64-889d-ff4d9a839047 Security Center 1.0.3 1x
1.0.3
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure Defender for open-source relational databases should be enabled 0a9fbe0d-c5c4-4da8-87d8-f4fd77338835 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure Defender for Resource Manager should be enabled c3d20c29-b36d-48fe-808b-99a87530ad99 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for servers should be enabled 4da35fc9-c9e7-4960-aec9-797fe7d9051d Security Center 1.0.3 1x
1.0.3
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for SQL servers on machines should be enabled 6581d072-105e-4418-827f-bd446d56421b Security Center 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure Defender for SQL should be enabled for unprotected Azure SQL servers abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9 SQL 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for SQL should be enabled for unprotected MySQL flexible servers 3bc8a0d5-38e0-4a3d-a657-2cb64468fc34 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for SQL should be enabled for unprotected PostgreSQL flexible servers d38668f5-d155-42c7-ab3d-9b57b50f8fbf Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Defender for SQL should be enabled for unprotected SQL Managed Instances abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9 SQL 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Event Grid domains should use private link 9830b652-8523-49cc-b1b3-e17dce1127ca Event Grid 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure Event Grid topics should use private link 4b90e17e-8448-49db-875e-bd83fb6f804f Event Grid 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure Event Hub namespaces should have local authentication methods disabled 5d4e3c65-4873-47be-94f3-6f8b953a3598 Event Hub 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Azure File Sync should use private link 1d320205-c6a1-4ac6-873d-46224024e8e2 Storage 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Key Vault Managed HSM should have purge protection enabled c39ba22d-4428-4149-b981-70acb31fc383 Key Vault 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Azure Key Vault should use RBAC permission model 12d4fa5e-1f9f-4c21-97a9-b99b3c6611b5 Key Vault 1.0.1 2x
1.0.1, 1.0.0-preview
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Azure Key Vaults should use private link a6abeaec-4d90-4a02-805f-6b26c4d3fbe9 Key Vault 1.2.1 1x
1.2.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Kubernetes Service clusters should have Defender profile enabled a1840de2-8088-4ea8-b153-b4c723e9cb01 Kubernetes 2.0.1 1x
2.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure Machine Learning compute instances should be recreated to get the latest software updates f110a506-2dcb-422e-bcea-d533fc8c35e2 Machine Learning 1.0.3 1x
1.0.3
Fixed
[parameters('effects')]
0 GA true
Azure Machine Learning Computes should be in a virtual network 7804b5c7-01dc-4723-969b-ae300cc07ff1 Machine Learning 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure Machine Learning Computes should have local authentication methods disabled e96a9a5f-07ca-471b-9bc5-6a0f33cbd68f Machine Learning 2.1.0 2x
2.1.0, 2.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Machine Learning workspaces should be encrypted with a customer-managed key ba769a63-b8cc-4b2d-abf6-ac33c7204be8 Machine Learning 1.1.0 2x
1.1.0, 1.0.3
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Machine Learning Workspaces should disable public network access 438c38d2-3772-465a-a9cc-7a6666a275ce Machine Learning 2.0.1 1x
2.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Machine Learning workspaces should use private link 45e05259-1eb5-4f70-9574-baf73e9d219b Machine Learning 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure Monitor log profile should collect logs for categories 'write,' 'delete,' and 'action' 1a4e592a-6a6e-44a5-9814-e36264ca96e7 Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Monitor Logs for Application Insights should be linked to a Log Analytics workspace d550e854-df1a-4de9-bf44-cd894b39a95e Monitoring 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA unknown
Azure Monitor should collect activity logs from all regions 41388f1c-2db0-4c25-95b2-35d7f5ccbfa9 Monitoring 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Monitor solution 'Security and Audit' must be deployed 3e596b57-105f-48a6-be97-03e9243bad6e Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure MySQL flexible server should have Microsoft Entra Only Authentication enabled 40e85574-ef33-47e8-a854-7a65c7500560 SQL 1.0.1 2x
1.0.1, 1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters 0a15ec92-a229-4763-bb14-0ea34a568f8d Kubernetes 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure registry container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management) 090c7b07-b4ed-4561-ad20-e9075f3ccaff Security Center 1.0.1 2x
1.0.1, 1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management) 17f4b1cc-c55c-4d94-b1f9-2978f6ac2957 Security Center 1.0.1 2x
1.0.1, 1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Service Bus namespaces should use private link 1c06e275-d63d-4540-b761-71f364c2111d Service Bus 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure SignalR Service should use private link 2393d2cf-a342-44cd-a2e2-fe0188fd1234 SignalR 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure Spring Cloud should use network injection af35e2a4-ef96-44e7-a9ae-853dd97032c4 App Platform 1.2.0 1x
1.2.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA unknown
Azure SQL Database should be running TLS version 1.2 or newer 32e6bbec-16b6-44c2-be37-c5b672d103cf SQL 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA true
Azure SQL Database should have Microsoft Entra-only authentication enabled during creation abda6d70-9778-44e7-84a8-06713e6db027 SQL 1.2.0 2x
1.2.0, 1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure SQL Managed Instances should disable public network access 9dfea752-dd46-4766-aed1-c355fa93fb91 SQL 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure SQL Managed Instances should have Microsoft Entra-only authentication enabled during creation 78215662-041e-49ed-a9dd-5385911b3a1f SQL 1.2.0 2x
1.2.0, 1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Stack Edge devices should use double-encryption b4ac1030-89c5-4697-8e00-28b5ba6a8811 Azure Stack Edge 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Azure Stream Analytics jobs should use customer-managed keys to encrypt data 87ba29ef-1ab3-4d82-b763-87fcd4f531f7 Stream Analytics 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Azure subscriptions should have a log profile for Activity Log 7796937f-307b-4598-941c-67d3a05ebfe7 Monitoring 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Azure Synapse workspaces should use customer-managed keys to encrypt data at rest f7d52b2d-e161-4dfa-a82b-55e564167385 Synapse 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Synapse workspaces should use private link 72d11df1-dd8a-41f7-8925-b05b960ebafc Synapse 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Azure VPN gateways should not use 'basic' SKU e345b6c3-24bd-4c93-9bbb-7e5e49a17b78 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA unknown
Azure Web Application Firewall should be enabled for Azure Front Door entry-points 055aa869-bc98-4af8-bafc-23f1ab6ffe2c Network 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Azure Web PubSub Service should use private link eb907f70-7514-460d-92b3-a5ae93b4f917 Web PubSub 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA unknown
Both operating systems and data disks in Azure Kubernetes Service clusters should be encrypted by customer-managed keys 7d7be79c-23ba-4033-84dd-45e2a5ccdd67 Kubernetes 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Certificates should have the specified maximum validity period 0a075868-4c26-42ef-914c-5bc007359560 Key Vault 2.2.1 2x
2.2.1, 2.2.0-preview
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Cognitive Services accounts should use customer owned storage 46aa9b05-0e60-4eae-a88b-1e9d374fa515 Cognitive Services 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Container registries should be encrypted with a customer-managed key 5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580 Container Registry 1.1.2 1x
1.1.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Container registries should not allow unrestricted network access d0793b48-0edc-4296-a390-4c75d1bdfd71 Container Registry 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Container registries should use private link e8eef0a8-67cf-4eb4-9386-14b0e78733d4 Container Registry 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
CORS should not allow every domain to access your API for FHIR 0fea8f8a-4169-495d-8307-30ec335f387d API for FHIR 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, disabled, Disabled
0 GA unknown
Cosmos DB database accounts should have local authentication methods disabled 5450f5bd-9c72-4390-a9c4-a7aba4edfdd2 Cosmos DB 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Cosmos DB should use a virtual network service endpoint e0a2b1a3-f7f9-4569-807f-2a9edebdf4d9 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
CosmosDB accounts should use private link 58440f8a-10c5-4151-bdce-dfbaad4a20b7 Cosmos DB 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Dependency agent should be enabled for listed virtual machine images 11ac78e3-31bc-4f0c-8434-37ab963cea07 Monitoring 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Dependency agent should be enabled in virtual machine scale sets for listed virtual machine images e2dd799a-a932-4e9d-ac17-d473bc3c6c10 Monitoring 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Deploy default Microsoft IaaSAntimalware extension for Windows Server 2835b622-407b-4114-9198-6f7064cbe0dc Compute 1.1.0 1x
1.1.0
Fixed
deployIfNotExists
1 Virtual Machine Contributor GA unknown
Deploy Diagnostic Settings for Network Security Groups c9c29499-c1d1-4195-99bd-2ec9e3a9dc89 Monitoring 2.0.1 1x
2.0.1
Fixed
deployIfNotExists
2 Monitoring Contributor, Storage Account Contributor GA unknown
Deploy network watcher when virtual networks are created a9b99dd8-06c5-4317-8629-9d86a3c6e7d9 Network 1.0.0 1x
1.0.0
Fixed
DeployIfNotExists
1 Network Contributor GA unknown
Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs 331e8ea8-378a-410f-a2e5-ae22f38bb0da Guest Configuration 3.1.0 2x
3.1.0, 3.0.0
Fixed
deployIfNotExists
1 Contributor GA true
Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs 385f5831-96d4-41db-9a3c-cd3af78aaae6 Guest Configuration 1.2.0 1x
1.2.0
Fixed
deployIfNotExists
1 Contributor GA true
Disk access resources should use private link f39f5f49-4abf-44de-8c70-0756997bfb51 Compute 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Disk encryption should be enabled on Azure Data Explorer f4b53539-8df9-40e4-86c6-6b607703bd4e Azure Data Explorer 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Double encryption should be enabled on Azure Data Explorer ec068d99-e9c7-401f-8cef-5bdde4e6ccf1 Azure Data Explorer 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Email notification for high severity alerts should be enabled 6e2593d9-add6-4083-9c9b-4b7d2188c899 Security Center 1.2.0 3x
1.2.0, 1.1.0, 1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Email notification to subscription owner for high severity alerts should be enabled 0b15565f-aa9e-48ba-8619-45960f2c314d Security Center 2.1.0 2x
2.1.0, 2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Enforce SSL connection should be enabled for MySQL database servers e802a67a-daf5-4436-9ea6-f6d821dd0c5d SQL 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Enforce SSL connection should be enabled for PostgreSQL database servers d158790f-bfb0-486c-8631-2dc6b4e8e6af SQL 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Event Hub namespaces should use a customer-managed key for encryption a1ad735a-e96f-45d2-a7b2-9a4932cab7ec Event Hub 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Event Hub namespaces should use private link b8564268-eb4a-4337-89be-a19db070c59d Event Hub 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Event Hub should use a virtual network service endpoint d63edb4a-c612-454d-b47d-191a724fcbf0 Network 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Flow logs should be configured for every network security group c251913d-7d24-4958-af87-478ed3b9ba41 Network 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Function apps should have authentication enabled c75248c1-ea1d-4a9c-8fc9-29a6aabd5da8 App Service 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should have Client Certificates (Incoming client certificates) enabled ab6a902f-9493-453b-928d-62c30b11b5a6 App Service 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should have remote debugging turned off 0e60b895-3786-45da-8377-9c6b4b6ac5f9 App Service 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should not have CORS configured to allow every resource to access your apps 0820b7b9-23aa-4725-a1ce-ae4558f718e5 App Service 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should only be accessible over HTTPS 6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab App Service 5.0.0 1x
5.0.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA true
Function apps should require FTPS only 399b2637-a50f-4f95-96f8-3a145476eb15 App Service 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should use latest 'HTTP Version' e2c1c086-2d84-4019-bff3-c44ccd95113c App Service 4.0.0 1x
4.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should use managed identity 0da106f2-4ca3-48e8-bc85-c638fe6aea8f App Service 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Function apps should use the latest TLS version f9d614c5-c173-4d56-95a7-b4437057d193 App Service 2.1.0 2x
2.1.0, 2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Gateway subnets should not be configured with a network security group 35f9c03a-cc27-418e-9c0c-539ff999d010 Network 1.0.0 1x
1.0.0
Fixed
deny
0 GA unknown
Geo-redundant backup should be enabled for Azure Database for MariaDB 0ec47710-77ff-4a3d-9181-6aa50af424d0 SQL 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Geo-redundant backup should be enabled for Azure Database for MySQL 82339799-d096-41ae-8538-b108becf0970 SQL 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Geo-redundant backup should be enabled for Azure Database for PostgreSQL 48af4db5-9b8b-401c-8e74-076be876a430 SQL 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
Geo-redundant storage should be enabled for Storage Accounts bf045164-79ba-4215-8f95-f8048dc1780b Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Guest Configuration extension should be installed on your machines ae89ebca-1c92-4898-ac2c-9f63decb045c Security Center 1.0.3 1x
1.0.3
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
HPC Cache accounts should use customer-managed key for encryption 970f84d8-71b6-4091-9979-ace7e3fb6dbb Storage 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA unknown
Internet-facing virtual machines should be protected with network security groups f6de0be7-9a8a-4b8a-b349-43cf02d22f7c Security Center 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
IoT Hub device provisioning service instances should use private link df39c015-56a4-45de-b4a3-efe77bed320d Internet of Things 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
IP firewall rules on Azure Synapse workspaces should be removed 56fd377d-098c-4f02-8406-81eb055902b8 Synapse 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA unknown
Key Vault keys should have an expiration date 152b15f7-8e1f-4c1f-ab71-8c010ba5dbc0 Key Vault 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Key Vault secrets should have an expiration date 98728c90-32c7-4049-8429-847dc0f4fe37 Key Vault 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Key Vault should use a virtual network service endpoint ea4d6841-2173-4317-9747-ff522a45120f Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Key vaults should have deletion protection enabled 0b60c0b2-2dc2-4e1c-b5c9-abbed971de53 Key Vault 2.1.0 1x
2.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Key vaults should have soft delete enabled 1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d Key Vault 3.0.0 1x
3.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Keys should be the specified cryptographic type RSA or EC 75c4f823-d65c-4f29-a733-01d0077fdbcb Key Vault 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Keys should have a rotation policy ensuring that their rotation is scheduled within the specified number of days after creation. d8cf8476-a2ec-4916-896e-992351803c44 Key Vault 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA unknown
Keys using elliptic curve cryptography should have the specified curve names ff25f3c8-b739-4538-9d07-3d6d25cfb255 Key Vault 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Keys using RSA cryptography should have a specified minimum key size 82067dbb-e53b-4e06-b631-546d197452d9 Key Vault 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version fb893a29-21bb-418c-a157-e99480ec364c Security Center 1.0.2 1x
1.0.2
Default
Audit
Allowed
Audit, Disabled
0 GA true
Linux machines should meet requirements for the Azure compute security baseline fc9b3da7-8347-4380-8e70-0a0361d8dedd Guest Configuration 2.2.0 2x
2.2.0, 2.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost. ca88aadc-6e2b-416c-9de2-5a0f01d1693f Guest Configuration 1.2.1 3x
1.2.1, 1.2.0-preview, 1.1.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Log Analytics extension should be enabled in virtual machine scale sets for listed virtual machine images 5c3bc7b8-a64c-4e08-a9cd-7ff0f31e1138 Monitoring 2.0.1 1x
2.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Log Analytics workspaces should block log ingestion and querying from public networks 6c53d030-cc64-46f0-906d-2bc061cd1334 Monitoring 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA unknown
Log Analytics Workspaces should block non-Azure Active Directory based ingestion. e15effd4-2278-4c65-a0da-4d6f6d1890e2 Monitoring 1.0.0 1x
1.0.0
Default
Audit
Allowed
Deny, Audit, Disabled
0 GA unknown
Long-term geo-redundant backup should be enabled for Azure SQL Databases d38fc420-0735-4ef3-ac11-c806f651a570 SQL 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Machines should be configured to periodically check for missing system updates bd876905-5b84-4f73-ab2d-2e7a7c4568d9 Azure Update Manager 3.7.0 4x
3.7.0, 3.6.0, 3.5.0, 3.4.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Machines should have secret findings resolved 3ac7c827-eea2-4bde-acc7-9568cd320efa Security Center 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Managed disks should be double encrypted with both platform-managed and customer-managed keys ca91455f-eace-4f96-be59-e6e2c35b4816 Compute 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Managed disks should disable public network access 8405fdab-1faf-48aa-b702-999c9c172094 Compute 2.1.0 2x
2.1.0, 2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption d461a302-a187-421a-89ac-84acdb4edc04 Compute 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Management ports should be closed on your virtual machines 22730e10-96f6-4aac-ad84-9383d35b5917 Security Center 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Microsoft Antimalware for Azure should be configured to automatically update protection signatures c43e4a30-77cb-48ab-a4dd-93f175c63b57 Compute 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Microsoft Defender CSPM should be enabled 1f90fc71-a595-4066-8974-d4d0802e8ef0 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Microsoft Defender for APIs should be enabled 7926a6d1-b268-4586-8197-e8ae90c877d7 Security Center 1.0.3 1x
1.0.3
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Microsoft Defender for Azure Cosmos DB should be enabled adbe85b5-83e6-4350-ab58-bf3a4f736e5e Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Microsoft Defender for Containers should be enabled 1c988dd6-ade4-430f-a608-2a3e5b0a6d38 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Microsoft Defender for SQL should be enabled for unprotected Synapse workspaces d31e5c31-63b2-4f12-887b-e49456834fa1 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Microsoft Defender for Storage should be enabled 640d2586-54d2-465f-877f-9ffc1d2109f4 Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Microsoft IaaSAntimalware extension should be deployed on Windows servers 9b597639-28e4-48eb-b506-56b05d366257 Compute 1.1.0 1x
1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
MySQL servers should use customer-managed keys to encrypt data at rest 83cef61d-dbd1-4b20-a4fc-5fbc7da10833 SQL 1.0.4 1x
1.0.4
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Network Watcher should be enabled b6e2945c-0b7b-40f5-9233-7a5323b5cdc6 Network 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Only approved VM extensions should be installed c0e996f8-39cf-4af9-9f45-83fbde810432 Compute 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Only secure connections to your Azure Cache for Redis should be enabled 22bee202-a82f-4305-9a2a-6d7f44d4dedb Cache 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
OS and data disks should be encrypted with a customer-managed key 702dd420-7fcc-42c5-afe8-4026edd20fe0 Compute 3.0.0 1x
3.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
PostgreSQL servers should use customer-managed keys to encrypt data at rest 18adea5e-f416-4d0f-8aa8-d24321e3e274 SQL 1.0.4 1x
1.0.4
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Private endpoint connections on Azure SQL Database should be enabled 7698e800-9299-47a6-b3b6-5a0fee576eed SQL 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Private endpoint connections on Batch accounts should be enabled 009a0c92-f5b4-4776-9b66-4ed2b4775563 Batch 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Private endpoint should be enabled for MariaDB servers 0a1302fb-a631-4106-9753-f3d494733990 SQL 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Private endpoint should be enabled for MySQL servers 7595c971-233d-4bcf-bd18-596129188c49 SQL 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Private endpoint should be enabled for PostgreSQL servers 0564d078-92f5-4f97-8398-b9f58a51f70b SQL 1.0.2 1x
1.0.2
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Public network access on Azure SQL Database should be disabled 1b8ca024-1d5c-4dec-8995-b1a932b41780 SQL 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Public network access should be disabled for Container registries 0fdf0491-d080-4575-b627-ad0e843cba0f Container Registry 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Public network access should be disabled for MariaDB servers fdccbe47-f3e3-4213-ad5d-ea459b2fa077 SQL 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Public network access should be disabled for MySQL flexible servers c9299215-ae47-4f50-9c54-8a392f68a052 SQL 2.2.0 2x
2.2.0, 2.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Public network access should be disabled for MySQL servers d9844e8a-1437-4aeb-a32c-0c992f056095 SQL 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Public network access should be disabled for PostgreSQL flexible servers 5e1de0e3-42cb-4ebc-a86d-61d0c619ca48 SQL 3.1.0 2x
3.1.0, 3.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Public network access should be disabled for PostgreSQL servers b52376f7-9612-48a1-81cd-1ffe4b61032c SQL 2.0.1 1x
2.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Resource logs in Azure Data Lake Store should be enabled 057ef27e-665e-4328-8ea3-04b3122bd9fb Data Lake 5.0.0 1x
5.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Azure Key Vault Managed HSM should be enabled a2a5b911-5617-447e-a49e-59dbe0e0434b Key Vault 1.1.0 1x
1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Resource logs in Azure Kubernetes Service should be enabled 245fc9df-fa96-4414-9a0b-3738c2f7341c Kubernetes 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Azure Machine Learning Workspaces should be enabled afe0c3be-ba3b-4544-ba52-0c99672a8ad6 Machine Learning 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Azure Stream Analytics should be enabled f9be5368-9bf5-4b84-9e0a-7850da98bb46 Stream Analytics 5.0.0 1x
5.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Batch accounts should be enabled 428256e6-1fac-4f48-a757-df34c2b3336d Batch 5.0.0 1x
5.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Data Lake Analytics should be enabled c95c74d9-38fe-4f0d-af86-0c7d626a315c Data Lake 5.0.0 1x
5.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Event Hub should be enabled 83a214f7-d01a-484b-91a9-ed54470c9a6a Event Hub 5.0.0 1x
5.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in IoT Hub should be enabled 383856f8-de7f-44a2-81fc-e5135b5c2aa4 Internet of Things 3.1.0 1x
3.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Resource logs in Key Vault should be enabled cf820ca0-f99e-4f3e-84fb-66e913812d21 Key Vault 5.0.0 1x
5.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Logic Apps should be enabled 34f95f76-5386-4de7-b824-0d8478470c9d Logic Apps 5.1.0 1x
5.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Resource logs in Service Bus should be enabled f8d36e2f-389b-4ee4-898d-21aeb69a0f45 Service Bus 5.0.0 1x
5.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Role-Based Access Control (RBAC) should be used on Kubernetes Services ac4a19c2-fa67-49b4-8ae5-0b2e78c49457 Security Center 1.1.0 3x
1.1.0, 1.0.4, 1.0.3
Default
Audit
Allowed
Audit, Disabled
0 GA true
Saved-queries in Azure Monitor should be saved in customer storage account for logs encryption fa298e57-9444-42ba-bf04-86e8470e32c7 Monitoring 1.1.0 1x
1.1.0
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA true
Secure transfer to storage accounts should be enabled 404c3081-a854-4457-ae30-26a93ef643f9 Storage 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Service Bus Premium namespaces should use a customer-managed key for encryption 295fc8b1-dc9f-4f53-9c61-3f313ceab40a Service Bus 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign 617c02be-7f02-4efd-8836-3180d47b6c68 Service Fabric 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Service Fabric clusters should only use Azure Active Directory for client authentication b54ed75b-3e1a-44ac-a333-05ba39b99ff0 Service Fabric 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
SQL Auditing settings should have Action-Groups configured to capture critical activities 7ff426e2-515f-405a-91c8-4f2333442eb5 SQL 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
SQL Managed Instance should have the minimal TLS version of 1.2 a8793640-60f7-487c-b5c3-1d37215905c4 SQL 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Disabled
0 GA true
SQL managed instances should use customer-managed keys to encrypt data at rest ac01ad65-10e5-46df-bdd9-6b0cad13e1d2 SQL 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
SQL Server should use a virtual network service endpoint ae5d2f14-d830-42b6-9899-df6cfe9c71a3 Network 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
SQL servers on machines should have vulnerability findings resolved 6ba6d016-e7c3-4842-b8f2-4992ebc0d72d Security Center 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
SQL servers should use customer-managed keys to encrypt data at rest 0a370ff3-6cab-4e85-8995-295fd854c5b8 SQL 2.0.1 1x
2.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
SQL servers with auditing to storage account destination should be configured with 90 days retention or higher 89099bee-89e0-4b26-a5f4-165451757743 SQL 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Storage account encryption scopes should use customer-managed keys to encrypt data at rest b5ec538c-daa0-4006-8596-35468b9148e8 Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage account encryption scopes should use double encryption for data at rest bfecdea6-31c4-4045-ad42-71b9dc87247d Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Storage account keys should not be expired 044985bb-afe1-42cd-8a36-9d5d42424537 Storage 3.0.0 1x
3.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA unknown
Storage account public access should be disallowed 4fa4b6c0-31ca-4c0d-b10d-24b96f62a751 Storage 3.1.1 2x
3.1.1, 3.1.0-preview
Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled
0 GA unknown
Storage accounts should allow access from trusted Microsoft services c9d007d0-c057-4772-b18c-01e546713bcd Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage accounts should be migrated to new Azure Resource Manager resources 37e0d2fe-28a5-43d6-a273-67d37d1f5606 Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage accounts should have infrastructure encryption 4733ea7b-a883-42fe-8cac-97454c2a9e4a Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage accounts should have the specified minimum TLS version fe83a0eb-a853-422d-aac2-1bffd182c5d0 Storage 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage accounts should prevent shared key access 8c6a50c6-9ffd-4ae7-986f-5fa6111f9a54 Storage 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage accounts should restrict network access 34c877ad-507e-4c82-993e-3452a6e0ad3c Storage 1.1.1 1x
1.1.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage accounts should restrict network access using virtual network rules 2a1a9cdf-e04d-429a-8416-3bfb72a1b26f Storage 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Storage Accounts should use a virtual network service endpoint 60d21c4f-21a3-4d94-85f4-b924e6aeeda4 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Disabled
0 GA true
Storage accounts should use customer-managed key for encryption 6fac406b-40ca-413b-bf8e-0bf964659c25 Storage 1.0.3 1x
1.0.3
Default
Audit
Allowed
Audit, Disabled
0 GA true
Storage accounts should use private link 6edd7eda-6dd8-40f7-810d-67160c639cd9 Storage 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Subnets should be associated with a Network Security Group e71308d3-144b-4262-b144-efdc3cc90517 Security Center 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Subscriptions should have a contact email address for security issues 4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7 Security Center 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Synapse Workspaces should use only Microsoft Entra identities for authentication during workspace creation 2158ddbe-fefa-408e-b43f-d4faef8ff3b8 Synapse 1.2.0 2x
1.2.0, 1.1.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
System updates should be installed on your machines (powered by Update Center) f85bf3e0-d513-442e-89c3-1784ad63382b Security Center 1.0.1 2x
1.0.1, 1.0.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host 41425d9f-d1a5-499a-9932-f8ed8453932c Kubernetes 1.0.1 1x
1.0.1
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
The Log Analytics extension should be installed on Virtual Machine Scale Sets efbde977-ba53-4479-b8e9-10b957924fbf Monitoring 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Transparent Data Encryption on SQL databases should be enabled 17k78e20-9358-41c9-923c-fb736d382a12 SQL 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Virtual machines and virtual machine scale sets should have encryption at host enabled fc4d8e41-e223-45ea-9bf5-eada37891d87 Compute 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity d26f7642-7545-4e18-9b75-8c9bbdee3a9a Security Center 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Virtual machines should be connected to a specified workspace f47b5582-33ec-4c5c-87c0-b010a6b2e917 Monitoring 1.1.0 1x
1.1.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Virtual machines should be connected to an approved virtual network d416745a-506c-48b6-8ab1-83cb814bcaa3 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Virtual machines should be migrated to new Azure Resource Manager resources 1d84d5fb-01f6-4d12-ba4f-4a26081d403d Compute 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Virtual machines should have the Log Analytics extension installed a70ca396-0a34-413a-88e1-b956c1e683be Monitoring 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Virtual network firewall rule on Azure SQL Database should be enabled to allow traffic from the specified subnet 77e8b146-0078-4fb2-b002-e112381199f0 SQL 1.0.0 1x
1.0.0
Fixed
AuditIfNotExists
0 GA unknown
Virtual networks should use specified virtual network gateway f1776c76-f58c-4245-a8d0-2b207198dc8b Network 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
VM Image Builder templates should use private link 2154edb9-244f-4741-9970-660785bccdaa VM Image Builder 1.1.0 1x
1.1.0
Default
Audit
Allowed
Audit, Disabled, Deny
0 GA unknown
VPN gateways should use only Azure Active Directory (Azure AD) authentication for point-to-site users 21a6bc25-125e-4d13-b82d-2e19b7208ab7 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Vulnerability assessment should be enabled on SQL Managed Instance 1b7aa243-30e4-4c9e-bca8-d0d3022b634a SQL 1.0.1 1x
1.0.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Vulnerability assessment should be enabled on your SQL servers ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9 SQL 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Vulnerability assessment should be enabled on your Synapse workspaces 0049a6b3-a662-4f3e-8635-39cf44ace45a Synapse 1.0.0 1x
1.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Web Application Firewall (WAF) should be enabled for Application Gateway 564feb30-bf6a-4854-b4bb-0d2d2d1e6c66 Network 2.0.0 1x
2.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Web Application Firewall (WAF) should use the specified mode for Application Gateway 12430be1-6cc8-4527-a9a8-e3d38f250096 Network 1.0.0 1x
1.0.0
Default
Audit
Allowed
Audit, Deny, Disabled
0 GA true
Windows Defender Exploit Guard should be enabled on your machines bed48b13-6647-468e-aa2f-1af1d3f4dd40 Guest Configuration 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should be configured to use secure communication protocols 5752e6d6-1206-46d8-8ab1-ecc2f71a8112 Guest Configuration 4.1.1 1x
4.1.1
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - Accounts' ee984370-154a-4ee8-9726-19d900e56fc0 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - Audit' 33936777-f2ac-45aa-82ec-07958ec9ade4 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - Microsoft Network Server' caf2d518-f029-4f6b-833b-d7081702f253 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Options - Recovery console' f71be03e-e25b-4d0f-b8bc-9b3e309b66c0 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'Security Settings - Account Policies' f2143251-70de-4e81-87a8-36cee5a2f29d Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'System Audit Policies - Account Management' 94d9aca8-3757-46df-aa51-f218c5f11954 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'System Audit Policies - Detailed Tracking' 58383b73-94a9-4414-b382-4146eb02611b Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements for 'System Audit Policies - Privilege Use' 87845465-c458-45f3-af66-dcd62176f397 Guest Configuration 3.0.0 1x
3.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows machines should meet requirements of the Azure compute security baseline 72650e9f-97bc-4b2a-ab5f-9781a9fcecbc Guest Configuration 2.0.0 1x
2.0.0
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA true
Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost. 3dc5edcd-002d-444c-b216-e123bbfa37c0 Guest Configuration 1.1.1 2x
1.1.1, 1.1.0-preview
Default
AuditIfNotExists
Allowed
AuditIfNotExists, Disabled
0 GA unknown
Roles used Total Roles usage: 8
Total Roles unique usage: 5
Role Role Id Policies count Policies
Monitoring Contributor 749f88d5-cbae-40b8-bcfc-e573ddc772fa 1 Deploy Diagnostic Settings for Network Security Groups
Network Contributor 4d97b98b-1d4f-4787-a291-c67834d212e7 1 Deploy network watcher when virtual networks are created
Contributor b24988ac-6180-42a0-ab88-20f7382dd24c 4 Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities, Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity, Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs, Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs
Virtual Machine Contributor 9980e02c-c2be-4d73-94e8-173b1dc7cf3c 1 Deploy default Microsoft IaaSAntimalware extension for Windows Server
Storage Account Contributor 17d1049b-9a84-46fb-8f53-869881c3d3ab 1 Deploy Diagnostic Settings for Network Security Groups
History
Date/Time (UTC ymd) (i) Changes
2025-01-30 19:27:00 add Initiative 7326812a-86a4-40c8-af7c-8945de9c4913
JSON compare n/a
JSON
api-version=2023-04-01
EPAC