Skip to content

Azure configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On Azure, Black Cat runs 38 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Azure connector needs.

Checks (38)

severity: critical NSG Unrestricted SSH fix difficulty: easy #

Restrict inbound SSH (port 22) in the NSG to specific trusted IP ranges

  1. Navigate to the Azure Portal and open Network security groups
  2. Select the flagged NSG and click Inbound security rules
  3. Locate the rule allowing TCP port 22 from source Any or 0.0.0.0/0
  4. Click the rule and change the Source from Any to a specific IP address or CIDR range
  5. If SSH access is not required, delete the rule entirely
  6. Save the changes and verify connectivity from the allowed source only

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical NSG Unrestricted RDP fix difficulty: easy #

Restrict inbound RDP (port 3389) in the NSG to specific trusted IP ranges

  1. Navigate to the Azure Portal and open Network security groups
  2. Select the flagged NSG and click Inbound security rules
  3. Locate the rule allowing TCP port 3389 from source Any or 0.0.0.0/0
  4. Click the rule and change the Source to a specific IP address or CIDR range
  5. Consider using Azure Bastion instead of exposing RDP directly
  6. Save the changes and verify RDP is no longer accessible from the internet

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical NSG All Ports Open fix difficulty: medium #

Remove or restrict NSG inbound rules that allow all ports from any source

  1. Navigate to the Azure Portal and open Network security groups
  2. Select the flagged NSG and click Inbound security rules
  3. Identify rules with Destination port ranges set to * or Any from source 0.0.0.0/0
  4. Delete the overly permissive rule or narrow the port range to only required ports
  5. Add specific allow rules for each required port and protocol
  6. Verify the default Deny All inbound rule is active at lowest priority

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high NSG UDP Open fix difficulty: easy #

Restrict or remove NSG inbound rules that allow UDP traffic from internet sources

  1. Navigate to the Azure Portal and open Network security groups
  2. Select the flagged NSG and click Inbound security rules
  3. Locate rules allowing UDP protocol from source Any or 0.0.0.0/0
  4. Click each rule and restrict the source to specific IP ranges or delete if not required
  5. Ensure only necessary UDP ports (e.g. VPN, DNS) are permitted from trusted sources
  6. Save changes and test connectivity to confirm services are unaffected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high NSG Permissive Outbound fix difficulty: medium #

Restrict overly permissive outbound NSG rules to only necessary destinations and ports

  1. Navigate to the Azure Portal and open Network security groups
  2. Select the flagged NSG and click Outbound security rules
  3. Locate rules with Destination port ranges set to * and destination Any
  4. Replace each broad allow-all rule with specific rules for required destinations and ports
  5. Remove rules that allow unrestricted outbound traffic to the internet
  6. Save changes and validate that application outbound connectivity still works

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Network Watcher Disabled fix difficulty: easy #

Enable Azure Network Watcher in all regions where virtual networks are deployed

  1. Navigate to the Azure Portal and open Network Watcher
  2. Click Overview to see the status across all regions
  3. Identify regions showing as Not enabled where VNets are deployed
  4. Click the three-dot menu for each disabled region and select Enable network watcher
  5. Confirm the enabling action for each region
  6. Verify all active regions now show Enabled status

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Storage HTTPS Not Required fix difficulty: easy #

Enable Secure transfer required on the storage account to enforce HTTPS-only access

  1. Navigate to the Azure Portal and open Storage accounts
  2. Select the flagged storage account and click Configuration
  3. Locate the Secure transfer required setting
  4. Set the toggle to Enabled
  5. Click Save to apply the change
  6. Verify all existing clients connect over HTTPS to avoid breaking changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.i GDPR (SaaS Security) GDPR-44.2 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Storage Network Default Allow fix difficulty: medium #

Restrict storage account network access to selected virtual networks or disable public access

  1. Navigate to the Azure Portal and open Storage accounts
  2. Select the flagged storage account and click Networking
  3. Under Public network access, select Enabled from selected virtual networks and IP addresses
  4. Add the virtual networks or IP ranges that require access
  5. Alternatively set to Disabled if access is only via private endpoints
  6. Click Save and verify that applications can still reach the storage account

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Storage Minimum TLS fix difficulty: easy #

Set the minimum TLS version to 1.2 on the storage account

  1. Navigate to the Azure Portal and open Storage accounts
  2. Select the flagged storage account and click Configuration
  3. Locate the Minimum TLS version setting
  4. Change the value to Version 1.2 from the dropdown
  5. Click Save to apply the change
  6. Update any clients using TLS 1.0 or 1.1 to use TLS 1.2 before this change

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Storage Infrastructure Encryption Disabled fix difficulty: hard #

Create a new storage account with infrastructure encryption enabled (cannot be enabled post-creation)

  1. Navigate to the Azure Portal and open Storage accounts
  2. Click Create to provision a new storage account
  3. On the Encryption tab, enable Infrastructure encryption
  4. Complete the creation wizard and migrate data from the non-compliant account
  5. Update application connection strings to reference the new storage account
  6. Delete the old storage account once data migration is confirmed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.ii GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Storage Shared Key Enabled fix difficulty: medium #

Disable shared key (storage account key) access and require Azure AD authentication

  1. Navigate to the Azure Portal and open Storage accounts
  2. Select the flagged storage account and click Configuration
  3. Locate the Allow storage account key access setting
  4. Set the toggle to Disabled
  5. Ensure all applications use Azure AD identity-based authentication (managed identities or service principals)
  6. Click Save and monitor for any authentication failures after the change

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Storage Blob Soft Delete Disabled fix difficulty: easy #

Enable soft delete for blobs to allow recovery of accidentally deleted or overwritten data

  1. Navigate to the Azure Portal and open Storage accounts
  2. Select the flagged storage account and click Data protection
  3. Under Recovery, locate Enable soft delete for blobs
  4. Check the checkbox and set the retention period in days (minimum 7 recommended)
  5. Click Save to apply the change
  6. Verify soft delete is active by checking a test blob deletion in the storage browser

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Storage Container Soft Delete Disabled fix difficulty: easy #

Enable soft delete for containers to allow recovery of accidentally deleted containers

  1. Navigate to the Azure Portal and open Storage accounts
  2. Select the flagged storage account and click Data protection
  3. Under Recovery, locate Enable soft delete for containers
  4. Check the checkbox and set the retention period in days (minimum 7 recommended)
  5. Click Save to apply the change
  6. Verify container soft delete is active by testing a container deletion and recovery

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Key Vault Soft Delete Disabled fix difficulty: easy #

Enable soft delete on the Key Vault to allow recovery of deleted secrets, keys, and certificates

  1. Navigate to the Azure Portal and open Key vaults
  2. Select the flagged Key Vault and click Properties
  3. Locate the Soft-delete setting under Deletion protection
  4. Click Enable soft delete (note: this cannot be disabled once enabled)
  5. Set the retention period to at least 7 days (90 days recommended)
  6. Click Save and verify the soft delete status shows Enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Key Vault Purge Protection Disabled fix difficulty: easy #

Enable purge protection on the Key Vault to prevent permanent deletion during the soft-delete retention period

  1. Navigate to the Azure Portal and open Key vaults
  2. Select the flagged Key Vault and click Properties
  3. Locate the Purge protection setting under Deletion protection
  4. Click Enable purge protection (requires soft delete to be enabled first)
  5. Note that purge protection cannot be disabled once enabled
  6. Click Save and verify purge protection shows Enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Key Vault Network ACLs Allow fix difficulty: medium #

Set the Key Vault network default action to Deny and allow only specific networks

  1. Navigate to the Azure Portal and open Key vaults
  2. Select the flagged Key Vault and click Networking
  3. Under Firewalls and virtual networks, set Allow access from to Selected networks
  4. Add the virtual networks and IP ranges that require access
  5. Ensure the Default action is set to Deny
  6. Click Save and verify that authorized clients can still access the vault

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Key Vault No Private Endpoint fix difficulty: medium #

Add a private endpoint to the Key Vault to restrict access to within the virtual network

  1. Navigate to the Azure Portal and open Key vaults
  2. Select the flagged Key Vault and click Networking
  3. Click the Private endpoint connections tab and then Add
  4. Follow the Create a private endpoint wizard selecting the target virtual network and subnet
  5. Configure DNS integration so the vault resolves via the private endpoint
  6. After creation, set the Default action to Deny under Firewalls and virtual networks

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Defender Servers Disabled fix difficulty: easy #

Enable Microsoft Defender for Servers on the subscription

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu
  3. Select the affected subscription
  4. Locate the Servers plan and toggle it to On
  5. Choose the plan tier (Plan 1 or Plan 2 based on requirements)
  6. Click Save to enable the Defender for Servers plan

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Defender App Service Disabled fix difficulty: easy #

Enable Microsoft Defender for App Service on the subscription

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu
  3. Select the affected subscription
  4. Locate the App Service plan and toggle it to On
  5. Click Save to enable the Defender for App Service plan
  6. Review any alerts generated by Defender in the Security alerts section

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Defender SQL Disabled fix difficulty: easy #

Enable Microsoft Defender for SQL on the subscription

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu
  3. Select the affected subscription
  4. Locate the SQL servers on machines plan and toggle it to On
  5. Click Save to enable the Defender for SQL plan
  6. Verify SQL resources appear in the Defender for Cloud inventory

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Defender Storage Disabled fix difficulty: easy #

Enable Microsoft Defender for Storage on the subscription

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu
  3. Select the affected subscription
  4. Locate the Storage plan and toggle it to On
  5. Click Save to enable the Defender for Storage plan
  6. Review the Defender for Storage settings to enable malware scanning if required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Defender Containers Disabled fix difficulty: easy #

Enable Microsoft Defender for Containers on the subscription

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu
  3. Select the affected subscription
  4. Locate the Containers plan and toggle it to On
  5. Click Save to enable the Defender for Containers plan
  6. Deploy the Defender sensor to Kubernetes clusters as prompted

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Defender Key Vault Disabled fix difficulty: easy #

Enable Microsoft Defender for Key Vault on the subscription

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu
  3. Select the affected subscription
  4. Locate the Key Vault plan and toggle it to On
  5. Click Save to enable the Defender for Key Vault plan
  6. Review security alerts for suspicious access patterns in Key vaults

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Defender Resource Manager Disabled fix difficulty: easy #

Enable Microsoft Defender for Resource Manager on the subscription

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu
  3. Select the affected subscription
  4. Locate the Resource Manager plan and toggle it to On
  5. Click Save to enable the Defender for Resource Manager plan
  6. Review security alerts for unusual ARM operations in the Security alerts section

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Security Contact Email Missing fix difficulty: easy #

Configure a security contact email address in Microsoft Defender for Cloud

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu and select the affected subscription
  3. Click Email notifications
  4. Enter one or more email addresses in the Additional email addresses field
  5. Ensure Send me notifications about the following alert severity is set to High or All
  6. Click Save to persist the security contact configuration

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Security Contact Phone Missing fix difficulty: easy #

Configure a security contact phone number in Microsoft Defender for Cloud

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu and select the affected subscription
  3. Click Email notifications
  4. Enter a phone number in the Phone number field
  5. Click Save to persist the security contact configuration
  6. Verify the phone number is correct and reachable for security incident notifications

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Security Alert Notifications Disabled fix difficulty: easy #

Enable email alert notifications for security contacts in Defender for Cloud

  1. Navigate to the Azure Portal and open Microsoft Defender for Cloud
  2. Click Environment settings in the left menu and select the affected subscription
  3. Click Email notifications
  4. Under Notification types, ensure Send me notifications about the following alert severity is set to High or All
  5. Confirm that a valid email address is configured in the Additional email addresses field
  6. Click Save to enable alert notifications

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d GDPR (SaaS Security) GDPR-33.2 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high SQL TDE Disabled fix difficulty: easy #

Enable Transparent Data Encryption (TDE) on the Azure SQL Database

  1. Navigate to the Azure Portal and open SQL databases
  2. Select the flagged SQL database and click Transparent data encryption under Security
  3. Set Data encryption to On
  4. Click Save to enable TDE
  5. Verify that the encryption state shows as Encrypted
  6. Optionally configure customer-managed keys (CMK) in Key Vault for enhanced control

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.ii GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium SQL Firewall Allow Azure Services fix difficulty: easy #

Remove the firewall rule that allows all Azure services to connect to the SQL Server

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Networking under Security
  3. Under Firewall rules, locate the rule with start IP 0.0.0.0 and end IP 0.0.0.0
  4. Toggle Allow Azure services and resources to access this server to Off
  5. Click Save to remove the broad Azure services access rule
  6. Add specific virtual network rules or IP-based rules for required Azure services

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical SQL Firewall Unrestricted fix difficulty: easy #

Remove or restrict the SQL Server firewall rule that allows all IP addresses

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Networking under Security
  3. Locate the firewall rule with start IP 0.0.0.0 and end IP 255.255.255.255 (or similar broad range)
  4. Delete the overly permissive rule by clicking the trash icon
  5. Add specific IP address rules for authorized clients only
  6. Click Save and verify the SQL Server is no longer accessible from unauthorized IPs

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high SQL Minimum TLS fix difficulty: easy #

Set the minimum TLS version to 1.2 on the Azure SQL Server

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Networking under Security
  3. Locate the Minimum TLS version setting
  4. Change the value to 1.2 from the dropdown
  5. Click Save to apply the change
  6. Verify that client applications connecting to the server support TLS 1.2

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.i GDPR (SaaS Security) GDPR-44.2 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high SQL Vulnerability Assessment Disabled fix difficulty: easy #

Enable SQL Vulnerability Assessment on the Azure SQL Server

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Microsoft Defender for SQL under Security
  3. If not enabled, click Enable Microsoft Defender for SQL
  4. Under Vulnerability Assessment, configure a storage account for scan results
  5. Add notification email addresses for periodic scan reports
  6. Click Save and run an initial scan to establish a baseline

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high SQL Threat Detection Disabled fix difficulty: easy #

Enable Microsoft Defender for SQL to activate Advanced Threat Protection on the SQL Server

  1. Navigate to the Azure Portal and open SQL servers
  2. Select the flagged SQL Server and click Microsoft Defender for SQL under Security
  3. Click Enable Microsoft Defender for SQL
  4. Configure a storage account for vulnerability assessment scan results
  5. Add an email address to receive threat detection alerts
  6. Click Save and verify Defender for SQL shows as Enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high App Service HTTPS Disabled fix difficulty: easy #

Enable HTTPS Only on the App Service to redirect all HTTP traffic to HTTPS

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click Configuration
  3. Click the General settings tab
  4. Set HTTPS Only to On
  5. Click Save to apply the change
  6. Verify that HTTP requests to the app are redirected to HTTPS

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.i GDPR (SaaS Security) GDPR-44.2 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high App Service Minimum TLS fix difficulty: easy #

Set the minimum TLS version to 1.2 on the App Service

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click Configuration
  3. Click the General settings tab
  4. Set Minimum inbound TLS version to 1.2
  5. Click Save to apply the change
  6. Test the app to confirm it operates correctly with TLS 1.2

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.i GDPR (SaaS Security) GDPR-44.2 HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high App Service FTP Enabled fix difficulty: easy #

Disable plain FTP or restrict to FTPS only on the App Service

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click Configuration
  3. Click the General settings tab
  4. Set FTP state to FTPS Only or Disabled
  5. Click Save to apply the change
  6. If deployment pipelines use FTP, migrate them to Git-based or ZIP deployment methods

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high App Service Remote Debugging Enabled fix difficulty: easy #

Disable remote debugging on the App Service to remove the open debug port

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click Configuration
  3. Click the General settings tab
  4. Set Remote debugging to Off
  5. Click Save to apply the change
  6. Verify the app is functioning normally without the debug endpoint active

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low App Service HTTP/2 Disabled fix difficulty: easy #

Enable HTTP/2 on the App Service for improved performance and security

  1. Navigate to the Azure Portal and open App Services
  2. Select the flagged web app and click Configuration
  3. Click the General settings tab
  4. Set HTTP version to 2.0
  5. Click Save to apply the change
  6. Test the application to confirm HTTP/2 is being negotiated by clients

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More Azure checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial