Azure Security Benchmark

Restrict deployment to approved Azure services using Azure Policy and management group hierarchy with documented exceptions.

• Azure Policy assignment inventory
• Allowed services policy
• Exception register

• No service restriction policy
• Exceptions granted without expiry
• Policy in audit mode only

Tag resources, track ownership, and decommission unused resources securely with documented lifecycle procedures.

• Tagging policy and compliance report
• Resource ownership register
• Decommissioning procedure and logs

• Untagged resources prevalent
• Orphan resources retained
• Decommissioning leaves data in storage

Track the asset inventory by discovering and querying all cloud resources, organising them by tagging and grouping, and giving the security organisation access to a continuously updated view.

• continuously refreshed resource inventory
• tagging standard and tag compliance reporting
• security team access to the inventory
• reconciliation between the inventory and billing or discovery data

• inventory exported to a spreadsheet quarterly
• untagged resources excluded from reporting
• security team dependent on platform teams for asset data

Limit user access to asset management features so assets cannot be modified accidentally or maliciously.

• role assignments granting asset management permissions
• resource lock or equivalent protection on critical assets
• audit log of asset management operations
• review records for who holds these permissions

• broad write access to resource metadata across the estate
• no locks on production resources so accidental deletion is possible
• asset management actions not separately audited

Ensure only authorised software executes in virtual machines by maintaining an allow list and blocking unauthorised software from running.

• application allow list definition per workload role
• enforcement mode configuration and its coverage
• blocked execution events and their triage
• process for adding software to the allow list

• allow listing deployed in audit mode only
• list built once from a running system so existing unauthorised software is baked in
• no route to add legitimate software so the control gets disabled

Monitor backups so all business-critical protectable resources are confirmed compliant with the defined backup policy and standard.

• backup compliance report listing protectable resources and their protection state
• alerting on failed or missed backup jobs
• reconciliation between the asset inventory and protected resources
• remediation records for unprotected critical resources

• backup jobs monitored but resource coverage never reconciled against the inventory
• new resources created without backup and never detected
• failed jobs logged but no alert reaches an owner

Perform periodic data recovery tests against backups to verify the backup configuration and the availability of backup data meet the defined recovery time and recovery point objectives.

• restore test schedule and completed test records
• measured restore time compared with the recovery time objective
• data currency of the restored copy compared with the recovery point objective
• defect log and remediation from failed tests

• backups verified only by job success status, never by actual restore
• tests restore a small sample that does not exercise the real recovery path
• measured restore time never compared with the stated objective

Configure automated backups for critical workloads using Azure Backup with defined retention and recovery point objectives.

• Backup policy inventory
• Backup success/failure reports
• RPO/RTO definitions
• Restore test records

• Backups configured but not tested
• RPO/RTO not defined
• Critical workloads excluded

Protect backup data with encryption, immutability, soft delete, and multi-user authorisation against ransomware and insider threats.

• Immutable vault configuration
• Soft delete settings
• MUA configuration
• Backup access audit log

• Soft delete not enabled
• Immutability off
• Backup admin without MUA

Maintain an inventory of sensitive data within the defined scope, using discovery tooling to find, classify and label it.

• defined sensitive data scope
• discovery scan results per data store
• classification and labelling scheme with applied label counts
• named owner per sensitive data set

• classification policy with no discovery run behind it
• scanning limited to structured stores, ignoring file shares and object storage
• labels applied once and never refreshed as data moves

Where regulation requires it, define the use cases and service scope for customer-managed keys and implement data at rest encryption using them.

• documented determination of where customer-managed keys are required and why
• service scope list showing which stores use customer-managed keys
• key vault configuration backing those keys
• rotation and revocation procedure

• customer-managed keys applied everywhere with no rationale, adding operational risk
• requirement asserted but the store still uses platform-managed keys
• no tested procedure for key revocation

Document and implement an enterprise cryptographic key management standard covering the key lifecycle, with keys generated, distributed and stored in a secured key vault service and rotated on a defined schedule.

• cryptographic key management standard
• key inventory with owner, algorithm, purpose and expiry
• key vault configuration and access policy
• rotation records and evidence of retiring superseded keys

• keys held in application configuration rather than a vault
• no rotation schedule so keys live indefinitely
• key inventory incomplete so orphan keys persist

Document and implement an enterprise certificate management standard covering the certificate lifecycle and certificate policies, so certificates used by critical services are tracked and renewed.

• certificate management standard and certificate policy
• certificate inventory with expiry dates and owners
• automated renewal configuration or renewal calendar
• record of expiry-driven outages and their remediation

• certificates tracked in a spreadsheet that drifts
• renewal handled reactively after an outage
• self-signed certificates in production with no policy exception

Harden the key vault service itself through access control, network restriction, logging, monitoring and backup so keys and certificates stay protected.

• key vault access policy or role assignments with least privilege
• network restriction configuration on the vault
• vault audit logging enabled and forwarded
• vault backup and soft-delete or purge protection settings
• alerting on anomalous vault access

• vault reachable from any network
• broad access granted to application service principals
• vault logs not collected so key access is unauditable
• purge protection disabled allowing irreversible deletion

Enable Microsoft Defender for Storage, SQL, and Databases to detect anomalous access patterns and data exfiltration attempts.

• Defender plans enabled inventory
• Alert routing configuration
• Sample investigated alerts

• Defender disabled to save cost
• Alerts not routed to SOC
• Alerts unactioned

Enforce TLS 1.2 or higher for all data in transit and disable legacy protocols across Azure services.

• TLS configuration policy
• Storage account secure transfer setting
• App Service HTTPS only configuration

• HTTP allowed on App Service
• TLS 1.0/1.1 still enabled
• Secure transfer required not enforced

Encrypt data at rest using platform-managed or customer-managed keys for all storage services with documented key management.

• Encryption configuration inventory
• Key Vault key inventory
• CMK rotation schedule
• Disk encryption status

• Unmanaged disks without encryption
• Key rotation not scheduled
• Key Vault access overly permissive

Perform threat modelling to identify potential threats and enumerate mitigating controls, covering both the running application and the artefacts and pipeline that produce it.

• threat models for in-scope applications with dates
• identified threats mapped to mitigating controls
• coverage of build artefacts and pipeline in the model
• trigger conditions requiring a model refresh

• threat model produced once at design and never revisited
• model covers the application but not the pipeline that deploys it
• threats enumerated with no owner for the mitigations

Secure the DevOps infrastructure and pipeline across build, test and production stages, including the repositories that hold source code, packages and images.

• access control on source and artefact repositories
• branch protection and required review settings
• build agent hardening and isolation configuration
• audit logging of pipeline configuration changes

• pipeline permissions broader than production permissions
• shared build agents across trust boundaries
• pipeline definitions editable without review

Integrate static application security testing into the delivery workflow as a gating control, so results can block vulnerable code from being committed, built or deployed.

• static analysis tool integrated in the pipeline
• gate thresholds and the action taken when exceeded
• finding triage and suppression records with justification
• coverage across repositories in scope

• scanning runs but never blocks a build
• findings suppressed in bulk to clear the backlog
• only the main repository scanned

Integrate dynamic application security testing into the delivery workflow as a gating control, so results can prevent vulnerable builds reaching production.

• dynamic testing tool and the environment it runs against
• gate configuration and threshold
• finding remediation records
• coverage across externally reachable applications

• dynamic testing run manually before major releases only
• tests point at a stub environment unrepresentative of production
• authenticated paths never tested

Extend logging and monitoring to non-production environments and to the delivery workflow itself, because compromise of those environments carries risk into production.

• log collection from build systems and non-production environments
• detection rules covering pipeline activity such as unexpected credential use
• alert routing for pipeline events
• retention applied to these logs

• monitoring scoped to production only
• build system logs kept locally and never collected
• no detection rules written for pipeline abuse

Maintain inventory of open source and third party components in code using Software Composition Analysis tools.

• SBOM per application
• SCA scan results
• Vulnerable dependency tracker
• License compliance report

• No SBOM produced
• SCA not in pipeline
• Vulnerable dependencies unaddressed

Integrate security controls into CI/CD pipelines including SAST, secret scanning, and IaC scanning with pipeline failure on critical findings.

• Pipeline security configuration
• SAST scan results
• Secret scanning alerts
• IaC scan reports

• Security gates as warnings only
• Secrets in repos not blocked
• IaC misconfigurations deployed

Ensure anti-malware signatures and the anti-malware solution itself are updated rapidly and consistently across the endpoint estate.

• signature version reporting across endpoints
• update schedule and its enforcement mechanism
• alerting on endpoints whose signatures are stale
• exception register for endpoints that cannot auto-update

• signature age never reported so stale endpoints go unnoticed
• updates blocked by network restrictions on isolated subnets
• exceptions granted with no compensating control

Deploy Microsoft Defender for Endpoint on Azure VMs with continuous monitoring, alerting, and automated response.

• EDR coverage report
• Onboarding script
• Alert response statistics
• Tamper protection enabled

• Coverage below 95%
• Legacy OS not supported
• Tamper protection disabled

Deploy modern anti-malware solutions with cloud-delivered protection, real-time scanning, and behaviour monitoring.

• Anti-malware deployment inventory
• Signature/cloud protection status
• Detection event log

• Real-time protection disabled
• Cloud-delivered protection off
• Legacy AV without behavioural analysis

Mandate security controls as part of the organisation's DevOps engineering and operating standard, defining security objectives, control requirements and tooling specifications.

• DevOps engineering standard containing the mandated security controls
• defined security objectives and control requirements for pipelines
• approved tooling specification
• conformance reporting across delivery teams

• security expectations communicated informally rather than in the standard
• standard published with no conformance measurement
• each team selecting its own security tooling with no baseline

Define and implement an enterprise segmentation and separation of duties strategy that segments access to assets using a combination of identity, network, application and subscription or account controls.

• documented segmentation strategy and the boundaries it defines
• mapping of controls used at each boundary
• separation of duties matrix for sensitive functions
• review record confirming the strategy still matches the estate

• segmentation decided per project with no enterprise view
• boundaries defined on network only, ignoring identity
• strategy documented once and never revisited as the estate grew

Define and implement an enterprise data protection strategy covering classification and protection standards, key and certificate management, access control and lifecycle handling.

• enterprise data protection strategy document
• classification and protection standard it mandates
• named accountable owner
• evidence the strategy drives the technical controls in place

• strategy written for on-premises and not extended to cloud
• no owner so it is never updated
• strategy and deployed controls diverge with no reconciliation

Define and implement a network security strategy with documented guidance, policy and standards covering network design, segmentation, perimeter controls and monitoring.

• network security strategy document and its approval
• reference network designs derived from it
• policy and standards covering segmentation and perimeter controls
• periodic review record

• network patterns decided per workload with no reference design
• strategy exists but no standard makes it enforceable
• no review after major architecture change

Define and implement a security posture management strategy establishing policy, procedure and standards for security configuration management and vulnerability management.

• posture management strategy and the policies under it
• defined baselines and the tooling that measures against them
• vulnerability management standard with remediation timeframes
• posture reporting to accountable owners

• posture scores watched but no policy defines acceptable levels
• configuration and vulnerability management owned by different teams with no joint standard
• no remediation timeframes so findings age indefinitely

Define and implement an identity and privileged access strategy with documented guidance, policy and standards for the identity system, authentication strength, privileged access and entitlement lifecycle.

• identity and privileged access strategy document
• authentication standard including strength requirements
• privileged access model and its governing policy
• joiner, mover and leaver process aligned to the strategy

• strategy covers employees only, omitting workload and partner identities
• privileged access approach differs per platform with no unifying policy
• strategy silent on entitlement review cadence

Define and implement a logging, threat detection and incident response strategy so threats are detected and remediated rapidly and compliance requirements for logging are met.

• combined logging, detection and response strategy
• log source and retention requirements derived from it
• detection coverage objectives and how they are measured
• incident response responsibilities defined in the strategy

• logging strategy written for compliance only with no detection objective
• detection and response owned separately with no shared strategy
• no measurable coverage objective so gaps are invisible

Define and implement a backup and recovery strategy with documented guidance, policy and standards including recovery time and recovery point objectives.

• backup and recovery strategy document
• recovery time and recovery point objectives per service tier
• backup policy and standard derived from the objectives
• evidence recovery testing is scheduled against those objectives

• backups configured with no stated recovery objective
• objectives set but never tested against actual restore times
• strategy omits platform and software service data

Define and implement an endpoint security strategy covering endpoint detection and response, anti-malware capability and integration with threat detection and security operations.

• endpoint security strategy document
• standard defining required endpoint capability by device class
• integration design connecting endpoint telemetry to security operations
• coverage reporting against the standard

• strategy covers corporate laptops but not cloud compute endpoints
• endpoint telemetry not integrated into central detection
• coverage never measured so gaps persist

Define and document cloud security roles, responsibilities, and accountabilities at strategic and operational levels with senior leadership endorsement.

• Cloud security RACI
• Roles and responsibilities document
• Executive sponsor sign-off
• Communication artefacts

• RACI absent
• Operations and security responsibilities unclear
• No exec sponsor

Treat the identity and authentication system as a high priority asset, restricting privileged roles, requiring strong authentication for privileged access and monitoring high risk activity.

• privileged directory role assignment list and review records
• strong authentication enforcement for all privileged roles
• identity secure score or equivalent posture measurement
• alerting on high risk identity activity

• directory admin roles held permanently by many accounts
• privileged accounts exempt from strong authentication for convenience
• identity system telemetry not monitored separately from workload logs

Use single sign-on so users authenticate once to reach applications and data across cloud and on-premises environments rather than maintaining separate credentials per application.

• application inventory showing which are integrated with single sign-on
• onboarding standard requiring single sign-on for new applications
• exception register for applications that cannot integrate
• count of standalone application credentials remaining

• single sign-on adopted for new applications only, legacy left standalone
• exceptions granted permanently
• shared local accounts persisting alongside single sign-on

Ensure developers handle credentials and secrets securely, keeping them out of code and configuration files, storing them in a secure key store and scanning source for exposed credentials.

• secret store in use and application integration pattern
• secret scanning enabled on repositories and its findings history
• pre-commit or pipeline gate blocking committed secrets
• rotation records for any credential found exposed

• connection strings in configuration files committed to source control
• secret scanning enabled but findings never triaged
• exposed credentials removed from the current commit but never rotated

Govern user access to legacy and non-native applications in hybrid environments using solutions such as an access security broker, application proxy or single sign-on.

• inventory of applications using legacy authentication
• proxy or broker configuration fronting those applications
• conditional access or equivalent policy applied to that path
• plan and progress for retiring legacy authentication

• legacy authentication endpoints left directly exposed
• no inventory so legacy protocols cannot be blocked safely
• broker deployed for some applications while direct paths remain open

Standardise on Microsoft Entra ID as the central identity system for Azure resources and integrated applications.

• Entra ID tenant inventory
• Federation configuration
• Local account exception list with justification

• Local accounts on VMs not inventoried
• Multiple disconnected tenants
• Legacy authentication still allowed

Use managed identities, service principals, or federated credentials for application authentication instead of stored secrets.

• Managed identity inventory
• Service principal credential rotation log
• Workload identity federation configuration

• Service principal secrets unrotated
• Credentials in code repositories
• Over-permissioned managed identities

Use strong authentication methods including mutual TLS, certificates, and federated trust for server-to-server communication.

• mTLS configuration
• Certificate inventory and expiry tracking
• Server authentication design documentation

• Self-signed certificates in production
• Expiry not monitored
• Anonymous service-to-service calls

Enforce phishing-resistant multi-factor authentication for all users with Conditional Access policies and risk-based controls.

• Conditional Access policy export
• MFA coverage report
• Authentication methods policy
• Sign-in risk policy

• Legacy authentication not blocked
• MFA bypassed by service accounts
• SMS used as primary factor

Apply Conditional Access policies to restrict access based on user, device, location, and risk signals.

• Conditional Access policy library
• Named locations
• Device compliance policies
• Policy effectiveness reports

• Report-only policies never enforced
• Break-glass accounts overly broad
• No location-based controls

Develop and maintain processes and plans for responding to security incidents on cloud platforms, accounting for the shared responsibility model and how it varies across infrastructure, platform and software service models.

• incident response plan covering cloud platforms
• shared responsibility analysis per service model in use
• named roles and escalation paths
• plan review and update history

• an on-premises plan reused unchanged for cloud
• no analysis of what the provider handles versus the customer
• plan never reviewed after the service estate changed

Set up incident notification so security alerts from the cloud platform and from the environment reach the correct contact in the incident response organisation.

• security contact configured on each subscription or account
• distribution list or on-call rota behind that contact
• test records confirming notifications are received
• review cadence for contact accuracy

• contact set to an individual who has left
• notifications routed to a mailbox with no on-call coverage
• contacts configured on some subscriptions only

Establish a process to create high quality alerts and measure their quality, so analysts prioritise real incidents rather than spending time on false positives.

• alert quality metrics such as true positive rate per rule
• detection rule review and retirement process
• lessons learned feeding new or tuned rules
• analyst feedback loop on alert usefulness

• no measurement so poor rules are never retired
• rules added continuously and never removed
• analyst feedback collected informally and lost

Ensure the security operations team can query and use diverse data sources when investigating potential incidents, collecting logs broadly enough to track activity across the attack chain without blind spots.

• log source inventory mapped to attack chain stages
• analyst query access to those sources
• documented gap analysis identifying blind spots
• investigation records demonstrating cross-source correlation

• only alert data retained, not the underlying telemetry
• analysts must request log access per investigation, costing hours
• identity, network and endpoint logs held in separate systems that cannot be joined

Give security operations the context to prioritise incidents, combining alert severity with the sensitivity of the affected asset as defined in the incident response plan.

• asset criticality or sensitivity tagging visible to responders
• documented prioritisation matrix combining severity and asset value
• triage records showing the priority assigned and why
• review of whether priority matched actual impact

• prioritisation on alert severity alone so a critical asset is treated like a test box
• criticality data exists in a register responders cannot see
• matrix defined but not applied in practice

Automate manual and repetitive incident handling tasks to shorten response time, increase the number of incidents an analyst can handle and reduce the error rate that comes with fatigue.

• automated response playbooks and their trigger conditions
• execution history with outcomes
• measured change in mean time to contain
• approval gates for automated actions with material impact

• automation built but never enabled for fear of false positives
• automated containment with no approval gate on high impact actions
• no measurement so the value of automation is unknown

Conduct lessons learned periodically and after major incidents, and retain incident evidence for the period defined in the incident handling standard.

• post-incident review records with actions and owners
• tracking of those actions through to closure
• evidence retention standard and storage location
• chain of custody handling for retained evidence

• reviews held but actions never tracked
• evidence deleted with normal log retention before the retention period
• reviews only after major incidents so recurring small incidents teach nothing

Monitor all known resource types for expected threats and anomalies, and configure alert filtering and analytics rules so high quality alerts are extracted from log data and false positives are reduced.

• detection coverage matrix across resource types
• analytics and filtering rules in use
• false positive rate and alert volume trend
• review records for detection rule tuning

• detection enabled on compute only
• every rule left at default so analysts drown in noise
• no measurement of alert quality so tuning never happens

Detect identity and access threats by monitoring user and application sign-in and access anomalies, alerting on patterns such as excessive failed logins and deprecated accounts.

• sign-in and audit log collection from the identity provider
• detection rules for failed login bursts, impossible travel and dormant account use
• alert routing to the security operations team
• triage records for identity alerts

• identity logs collected but no detection rules written
• service principal and application sign-ins excluded from monitoring
• alerts fire but no responder owns identity incidents

Plan and configure log retention at each logging service according to compliance, regulatory and business requirements so logs are archived for the required period.

• retention requirement analysis per log type citing the obligation
• retention policy configured at each logging service
• archive tier configuration and its access procedure
• evidence logs older than the retention floor are still retrievable

• default retention accepted without checking the obligation
• retention set on the central workspace but not on individual services
• archived logs retained but no tested retrieval path

Use approved time synchronisation sources for log timestamps so recorded date, time and time zone are consistent and correlatable across systems.

• approved time source list and configuration on hosts and services
• drift monitoring results
• timestamp and time zone convention applied in logging
• evidence of correlation across systems during an investigation

• hosts pointing at arbitrary public time servers
• time zone recorded as local rather than a fixed reference
• drift unmonitored so correlation silently fails

Enable diagnostic logging for all critical Azure resources with sufficient retention to support investigation and forensics.

• Diagnostic settings inventory
• Log Analytics workspace configuration
• Retention policy
• Activity log archive

• Diagnostic logs disabled by default
• Retention under regulatory minimums
• Logs not sent to immutable storage

Enable NSG flow logs, firewall logs, and DNS query logging to support network forensics and threat hunting.

• NSG flow log configuration
• Firewall logging settings
• Traffic Analytics enablement

• Flow logs not enabled
• Traffic Analytics off
• DNS logging absent

Aggregate security logs in Microsoft Sentinel or equivalent SIEM with documented detection rules and analyst workflows.

• Sentinel workspace configuration
• Detection rule library
• Analyst playbooks
• Coverage metrics (MITRE mapping)

• Logs ingested but no detections
• Custom rules absent
• No MITRE coverage tracking

Configure Domain Name System security so clients resolve through trusted authoritative and recursive services and the zones are protected against hijack and dangling records.

• list of authoritative and recursive resolvers in use and their trust basis
• DNS zone access control and change audit records
• dangling or stale record scan results
• DNSSEC or equivalent integrity configuration where supported

• decommissioned resources leaving dangling CNAMEs open to subdomain takeover
• clients allowed to use arbitrary public resolvers
• zone changes made without audit trail

Deploy network intrusion detection and prevention capability that inspects traffic and payload to and from the workload, tuned so the alerts it raises are usable by the security operations team.

• IDS/IPS deployment topology showing inspected traffic paths
• rule set and tuning history
• alert forwarding configuration into the SIEM
• false positive rate trend

• IDS deployed but alerts never routed to an analyst
• default rule set never tuned so alerts are ignored
• encrypted traffic paths not inspected and not compensated

Deploy a web application firewall in front of web applications and APIs and configure rules appropriate to the application-layer attacks those endpoints face.

• WAF deployment inventory covering all public web and API endpoints
• rule set and managed rule version in use
• record of rules moved from detection to prevention mode
• tuning and exclusion register

• WAF left in detection-only mode indefinitely
• endpoints published that bypass the WAF
• managed rule sets never updated

Use centralised tooling to simplify and manage network security configuration across a complex environment rather than maintaining rules device by device.

• central network security management tooling in use
• policy hierarchy showing inherited and local rules
• change process for network rules
• report of rules deviating from the central policy

• rules maintained per subnet by different teams
• no central view so conflicting rules coexist
• manual rule edits outside the management tool

Detect insecure services and protocols at operating system, application and package layers and disable them, applying compensating controls where they cannot be disabled.

• scan results listing insecure services and protocols detected
• disablement records or hardening baseline entries
• compensating control register for exceptions with expiry dates
• re-scan evidence confirming remediation

• legacy protocols left enabled for one dependency and forgotten
• exceptions granted with no expiry
• scanning limited to the network layer, missing application and package layers

Use private connectivity for communication between networks, such as between provider datacentres and on-premises or colocation infrastructure, rather than traversing the public internet.

• inventory of inter-network links and the connectivity type of each
• private link or dedicated circuit configuration
• routing configuration showing traffic does not egress publicly
• encryption applied over the private path

• site-to-site traffic over the public internet with only transport encryption
• private circuits provisioned but routes still prefer public paths
• no inventory so shadow public paths persist

Establish network segmentation boundaries using virtual networks, subnets, and network security groups to isolate workloads based on sensitivity and function.

• VNet topology diagram
• NSG rule export
• Segmentation policy
• Hub-spoke architecture documentation

• Flat VNet topology
• Default-allow NSG rules
• No micro-segmentation for sensitive workloads

Use Private Endpoints, Service Endpoints, and firewall rules to restrict access to PaaS services from authorised networks only.

• Private Endpoint inventory
• Storage account firewall configuration
• SQL firewall rules
• Public access disabled evidence

• PaaS services with public endpoints
• Allow-all firewall rules
• DNS not configured for Private Endpoints

Deploy Azure Firewall or third party NVA at the edge to inspect and control inbound and outbound traffic with documented rules.

• Firewall deployment architecture
• Rule set export
• Threat intelligence configuration
• Change management for rule changes

• No egress filtering
• Threat intel feature disabled
• Rules unreviewed for months

Enable DDoS Protection Standard on public-facing virtual networks and configure alerts for attack detection.

• DDoS Protection Standard enabled evidence
• Alert configuration
• Mitigation playbook

• Only Basic DDoS enabled
• No alerts configured
• No tested playbook

Define secure configuration baselines for each resource type in the cloud, or establish them automatically through configuration management before or during deployment so environments are compliant by default.

• baseline definition per resource type
• policy or template implementing the baseline at deployment
• exception register with owner and expiry
• coverage report showing resource types with and without a baseline

• baselines documented in prose but not encoded in policy
• baseline exists for virtual machines only
• new resource types deployed with no baseline defined

Define secure configuration baselines specifically for compute resources such as virtual machines and containers, established automatically at or before deployment.

• compute hardening standard referencing a recognised benchmark
• hardened image build pipeline and its output catalogue
• container base image standard and admission policy
• baseline coverage across virtual machine and container estates

• hardening applied post-deployment by script that sometimes fails
• container workloads exempt from the compute baseline
• hardened images built once and never refreshed

Continuously monitor compute resources for deviation from the defined configuration baseline, alert on drift and enforce the desired configuration by denying or remediating non-compliant configuration.

• configuration compliance dashboard for compute resources
• alert rules for baseline deviation
• deny or remediate policy assignments and their effect history
• remediation records with time to correct

• compliance measured but enforcement left in audit mode
• drift alerts routed to a mailbox nobody reads
• remediation manual and therefore inconsistent

Deploy patches and updates rapidly and automatically to remediate vulnerabilities in cloud resources, prioritising by risk so severe vulnerabilities on high value assets are addressed first.

• automated patch deployment configuration and schedule
• risk-based prioritisation criteria combining severity and asset value
• mean time to remediate by severity
• exception register for assets excluded from automated patching

• patching scheduled monthly regardless of severity
• asset value not factored so critical systems queue behind test systems
• automation covers operating systems only, leaving platform services unpatched

Conduct red team operations and penetration testing on a regular basis to simulate real-world attacks and reveal risks that vulnerability scanning does not surface.

• test scope, rules of engagement and provider notification where required
• test reports with findings and severity
• remediation tracking for findings through to closure
• cadence showing tests repeated on a defined interval

• a single test performed at launch and never repeated
• scope narrowed until the test cannot find anything
• findings reported but not tracked to closure

Use Azure Policy and Defender for Cloud secure score to audit and enforce configuration baselines across subscriptions.

• Secure Score trend
• Policy compliance dashboard
• Drift remediation log

• Secure Score declining
• Policies in audit mode never enforced
• Non-compliant resources unremediated

Use Defender Vulnerability Management or equivalent to identify vulnerabilities in VMs, containers, and databases on a continuous basis.

• Vulnerability assessment coverage report
• Critical/high vulnerability ageing
• Patch management evidence

• VAs not scheduled regularly
• Coverage gaps for containers
• Critical findings exceed SLA

Review privileged account entitlements on a regular cycle and confirm the access granted remains valid for control plane, management plane and workload administration.

• access review schedule and completed review records
• reviewer attestations per privileged role
• removal records for access not recertified
• exception handling for accounts retained

• reviews completed by bulk approval with no scrutiny
• reviews cover directory roles but not resource-level assignments
• findings recorded but removals never executed

Set up emergency access accounts so an outage of the normal identity path cannot lock the organisation out of critical cloud infrastructure, and protect and monitor those accounts tightly.

• emergency access account inventory and their exclusion scope
• credential custody and split-knowledge procedure
• alerting on any use of an emergency account
• periodic test records confirming the accounts still work

• emergency accounts created but never tested and now expired
• no alert fires when an emergency account signs in
• emergency credentials stored in the same system they are meant to bypass

Provide secured, isolated workstations for sensitive roles such as administrators, developers and critical service operators, so administrative sessions do not originate from general-purpose endpoints.

• privileged access workstation build standard
• list of roles required to use them and the enforcement mechanism
• conditional access or network policy restricting administration to those devices
• compliance reporting on workstation state

• administration performed from the same laptop used for mail and browsing
• workstation standard defined but not enforced at sign-in
• contractors administering from unmanaged devices

Apply just enough administration by managing permissions at fine granularity, using role-based access control to grant only the access a role needs.

• role definitions in use with their permission scope
• assignment inventory showing scope of each assignment
• evidence of custom roles replacing broad built-in roles
• report on unused permissions identified and removed

• owner or contributor granted at subscription scope as a default
• custom roles never created so broad built-ins are the only option
• permission usage never analysed so grants only ever grow

Establish an approval process and secure access path for cloud provider support requests that involve temporary access to organisational data.

• documented approval process for provider support access
• customer lockbox or equivalent configuration and approver list
• log of support access requests, approvers and durations
• post-access review records

• support access approved ad hoc by whoever is on the ticket
• lockbox capability available but not enabled
• no record of what the provider accessed or for how long

Limit and separate highly privileged accounts including Global Administrators with documented role assignments and break-glass procedures.

• Global Admin inventory (target less than 5)
• Privileged role assignment review
• Break-glass account procedure

• Too many Global Admins
• Standing privileged access
• Break-glass accounts not monitored

Use Privileged Identity Management (PIM) for just-in-time access elevation with approval workflows and time-bound activation.

• PIM configuration
• JIT activation logs
• Approval workflow records
• Access review history

• Permanent role assignments
• PIM not configured for Azure RBAC
• No approval required for sensitive roles

Manage identity lifecycle including joiner/mover/leaver processes and periodic access reviews via Entra ID Access Reviews.

• Access review schedule and outcomes
• Leaver removal SLAs
• Entitlement management package configuration

• Reviews completed without scrutiny
• Leaver access not revoked promptly
• Movers retain old access