Azure

59 checks36 High20 Medium3 Low

Network security25Microsoft Sentinel22Subscriptions6Access management4Backup1Management groups1

Run theseInvoke-Maester -Product azureCopy

59 checks

Group byFeatureAreaSeveritySuiteNone

IDCheckFeatureSeverity

MT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scopeAccess managementHighMT.1065Ensure all Recovery Services Vaults have soft delete enabledBackupHighZTA.21788Global Administrators don't have standing access to Azure subscriptionsZTAAccess managementHighZTA.21881Azure subscriptions used by Identity Governance are secured consistently with Identity Governance rolesZTAAccess managementHighZTA.21912Azure resources used by Microsoft Entra only allow access from privileged rolesZTAAccess managementHighZTA.25533DDoS Protection is enabled for all Public IP Addresses in VNETsZTANetwork securityHighZTA.25535Outbound traffic from VNET integrated workloads is routed through Azure FirewallZTANetwork securityHighZTA.25537Threat intelligence is Enabled in Deny Mode on Azure FirewallZTANetwork securityHighZTA.25539IDPS Inspection is Enabled in Deny Mode on Azure FirewallZTANetwork securityHighZTA.25541Application Gateway WAF is Enabled in Prevention modeZTANetwork securityHighZTA.25543Azure Front Door WAF is Enabled in Prevention ModeZTANetwork securityHighZTA.25550Inspection of Outbound TLS Traffic is Enabled on Azure FirewallZTANetwork securityHighZTA.26879Request Body Inspection is enabled in Application Gateway WAFZTANetwork securityHighZTA.26880Request Body Inspection is enabled in Azure Front Door WAFZTANetwork securityHighZTA.26881Default Ruleset is enabled in Application Gateway WAFZTANetwork securityHighZTA.26882Bot protection ruleset is enabled and assigned in Application Gateway WAFZTANetwork securityHighZTA.26883Default rule set is assigned in Azure Front Door WAFZTANetwork securityHighZTA.26884Bot protection rule set is enabled and assigned in Azure Front Door WAFZTANetwork securityHighZTA.26887Diagnostic logging is enabled in Azure FirewallZTANetwork securityHighZTA.26888Diagnostic logging is enabled in Application Gateway WAFZTANetwork securityHighZTA.26889Diagnostic logging is enabled in Azure Front Door WAFZTANetwork securityHighZTA.27015HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAFZTANetwork securityHighZTA.27016Rate Limiting is Enabled in Application Gateway WAFZTANetwork securityHighZTA.27018Rate Limiting is Enabled in Azure Front Door WAFZTANetwork securityHighZTA.27024HTTP DDoS protection rule set is enabled in Azure Front Door WAFZTANetwork securityHighZTA.41201At least one Microsoft (first-party) data connector is configured in every Microsoft Sentinel workspaceZTAMicrosoft SentinelHighZTA.41207Active analytics rules are configured in Microsoft Sentinel to detect threatsZTAMicrosoft SentinelHighZTA.50001Microsoft Defender for Cloud RecommendationsZTASubscriptionsHighZTA.61002Microsoft Sentinel is onboarded on at least one Log Analytics workspaceZTAMicrosoft SentinelHighZTA.61004Microsoft Defender for Cloud CSPM plan is enabled on all Azure subscriptionsZTASubscriptionsHighZTA.61016Microsoft Entra ID Protection risk events are flowing to the Microsoft Sentinel workspaceZTAMicrosoft SentinelHighZTA.61017Microsoft Defender for AI Services alerts are flowing to the Microsoft Sentinel workspace via a single connector pathZTAMicrosoft SentinelHighZTA.61021Microsoft 365 Copilot data connector is enabled on the Microsoft Sentinel workspaceZTAMicrosoft SentinelHighZTA.61022Microsoft Defender for AI Services is enabled on every Azure subscription that hosts Azure OpenAI or Azure AI Services accountsZTASubscriptionsHighZTA.61023Agent 365 data connector is enabled on the Microsoft Sentinel workspaceZTAMicrosoft SentinelHighZTA.61024Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspaceZTAMicrosoft SentinelHighMT.1064Ensure that write permissions are required to create new management groupsManagement groupsMediumMT.1227Subscriptions should be blocked from leaving and entering the tenantNew in 3.0SubscriptionsMediumZTA.26885Metrics are enabled for DDoS-protected public IPsZTANetwork securityMediumZTA.26886Diagnostic logging is enabled for DDoS-protected public IPsZTANetwork securityMediumZTA.27017JavaScript Challenge is Enabled in Application Gateway WAFZTANetwork securityMediumZTA.27019JavaScript Challenge is Enabled in Azure Front Door WAFZTANetwork securityMediumZTA.27020CAPTCHA challenge is enabled in Azure Front Door WAFZTANetwork securityMediumZTA.41202Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scopeZTAMicrosoft SentinelMediumZTA.41204Interactive and long-term retention duration meets the security baseline on every Microsoft Sentinel workspaceZTAMicrosoft SentinelMediumZTA.41205Data collection rules (DCRs) are used to control ingestion into Microsoft Sentinel workspacesZTAMicrosoft SentinelMediumZTA.41209User and Entity Behavior Analytics (UEBA) is enabled in Microsoft SentinelZTAMicrosoft SentinelMediumZTA.41210Microsoft Threat Intelligence feeds are integrated into Microsoft SentinelZTAMicrosoft SentinelMediumZTA.41211Auditing and health monitoring is enabled for Microsoft SentinelZTAMicrosoft SentinelMediumZTA.41212Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarksZTAMicrosoft SentinelMediumZTA.41213At least one automation rule is configured in Microsoft Sentinel to manage incident responseZTAMicrosoft SentinelMediumZTA.41214At least one Microsoft Sentinel automation rule executes a playbook for automated threat responseZTAMicrosoft SentinelMediumZTA.41215Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenantZTASubscriptionsMediumZTA.41216Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost ManagementZTASubscriptionsMediumZTA.41217Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)ZTAMicrosoft SentinelMediumZTA.61018Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspaceZTAMicrosoft SentinelMediumZTA.41203Custom data connectors are configured in Microsoft Sentinel for in-scope sources without a built-in connectorZTAMicrosoft SentinelLowZTA.41206At least one workbook is deployed in every Microsoft Sentinel workspace for visualization and operational reportingZTAMicrosoft SentinelLowZTA.41208At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entitiesZTAMicrosoft SentinelLow