CIS Microsoft Azure Benchmark v2.0
Center for Internet Security benchmark for Microsoft Azure. 120+ controls covering identity, networking, storage, databases, and logging.
Ensure MFA is enabled for all privileged users
Multi-factor authentication must be enabled for all users with administrative roles in Azure AD.
Ensure guest users are reviewed regularly
External guest users in Azure AD should be reviewed quarterly and removed if no longer needed.
Ensure NSGs restrict SSH access from the internet
Network Security Groups should not allow SSH (port 22) from any source (0.0.0.0/0).
Ensure NSGs restrict RDP access from the internet
Network Security Groups should not allow RDP (port 3389) from any source.
Ensure Storage Accounts disallow public blob access
Azure Storage accounts should have public blob access disabled.
Ensure Storage Accounts use HTTPS-only transport
All storage account traffic must use HTTPS encryption.
Ensure Azure SQL databases are not publicly accessible
Azure SQL databases should deny public network access.
Ensure Azure SQL Transparent Data Encryption is enabled
Transparent Data Encryption (TDE) must be enabled for all Azure SQL databases.
Ensure Activity Log alerts are configured
Azure Activity Log alerts should notify on critical operations like policy changes and resource deletions.
Ensure AKS clusters have RBAC enabled
Azure Kubernetes Service clusters must have RBAC enabled for access control.