+
+| Policy | Description |
|---|
+
+| Audit remote debugging state for an API App | Remote debugging requires inbound ports to be opened on an API app. Remote debugging should be turned off. |
+
+| Audit remote debugging state for a Function App | Remote debugging requires inbound ports to be opened on a function app. Remote debugging should be turned off. |
+
+| Audit remote debugging state for a Web Application | Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off. |
+
+| Audit HTTPS only access for an API App | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |
+
+| Audit HTTPS only access for a Function App | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |
+
+| Audit HTTPS only access for a Web Application | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. |
+
+| Audit enabling of only secure connections to your Redis Cache | Audit enabling of only connections via SSL to Redis Cache. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking |
+
+| Audit usage of Azure Active Directory for client authentication in Service Fabric | Audit usage of client authentication only via Azure Active Directory in Service Fabric |
+
+| Audit the setting of ClusterProtectionLevel property to EncryptAndSign in Service Fabric | Service Fabric provides three levels of protection (None, Sign and EncryptAndSign) for node-to-node communication using a primary cluster certificate. Set the protection level to ensure that all node-to-node messages are encrypted and digitally signed |
+
+| Audit SQL servers without Advanced Data Security | Audit SQL servers without Advanced Data Security |
+
+| Audit provisioning of an Azure Active Directory administrator for SQL server | Audit provisioning of an Azure Active Directory administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services |
+
+| Monitor unencrypted SQL databases in Azure Security Center | Unencrypted SQL databases will be monitored by Azure Security Center as recommendations |
+
+| Audit unrestricted network access to storage accounts | Audit unrestricted network access in your storage account firewall settings. Instead, configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific internet or on-premise clients, access can be granted to traffic from specific Azure virtual networks or to public internet IP address ranges |
+
+| Audit secure transfer to storage accounts | Audit requirment of Secure transfer in your storage account. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking |
+
+| Audit external accounts with owner permissions on a subscription | External accounts with owner permissions should be removed from your subscription in order to prevent unmonitored access. |
+
+| Audit external accounts with write permissions on a subscription | External accounts with write privileges should be removed from your subscription in order to prevent unmonitored access. |
+
+| Audit external accounts with read permissions on a subscription | External accounts with read privileges should be removed from your subscription in order to prevent unmonitored access. |
+
+| Audit deprecated accounts on a subscription | Deprecated accounts should be removed from your subscriptions. Deprecated accounts are accounts that have been blocked from signing in. |
+
+| Audit use of classic storage accounts | Use new Azure Resource Manager v2 for your storage accounts to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management |
+
+| Audit use of classic virtual machines | Use new Azure Resource Manager v2 for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, ARM-based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management |
+
+| Monitor unencrypted VM Disks in Azure Security Center | VMs without an enabled disk encryption will be monitored by Azure Security Center as recommendations |
+
+| Monitor OS vulnerabilities in Azure Security Center | Servers which do not satisfy the configured baseline will be monitored by Azure Security Center as recommendations |
+
+| Monitor VM Vulnerabilities in Azure Security Center | Monitors vulnerabilities detected by Vulnerability Assessment solution and VMs without a Vulnerability Assessment solution in Azure Security Center as recommendations. |
+
+| Monitor missing Endpoint Protection in Azure Security Center | Servers without an installed Endpoint Protection agent will be monitored by Azure Security Center as recommendations |
+
+| Monitor missing system updates in Azure Security Center | Missing security system updates on your servers will be monitored by Azure Security Center as recommendations |
+
+| Audit OS vulnerabilities on your virtual machine scale sets in Azure Security Center | Audit the OS vulnerabilities on your virtual machine scale sets to protect them from attacks. |
+
+| Audit the endpoint protection solution on virtual machine scale sets in Azure Security Center | Audit the existence and health of an endpoint protection solution on your virtual machines scale sets, to protect them from threats and vulnerabilities. |
+
+| Audit any missing system updates on virtual machine scale sets in Azure Security Center | Audit whether there are any missing system security updates and critical updates that should be installed to ensure that your Windows and Linux virtual machine scale sets are secure. |
+
+| Monitor SQL vulnerability assessment results in Azure Security Center | Monitor Vulnerability Assessment scan results and recommendations for how to remediate database vulnerabilities. |
+
+| Audit accounts with owner permissions who are not MFA enabled on a subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with owner permissions to prevent a breach of accounts or resources. |
+
+| Audit accounts with write permissions who are not MFA enabled on a subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with write privileges to prevent a breach of accounts or resources. |
+
+| Audit accounts with read permissions who are not MFA enabled on a subscription | Multi-Factor Authentication (MFA) should be enabled for all subscription accounts with read privileges to prevent a breach of accounts or resources. |
+
+| Audit standard tier of DDoS protection is enabled for a virtual network | DDoS protection standard should be enabled for all virtual networks with a subnet that is part of an application gateway with a public IP. |
+
+| Audit SQL managed instances without Advanced Data Security | Audit SQL managed instances without Advanced Data Security |
+
+
+
+
+
+| Policy | Description |
|---|
+
+| Audit CORS resource access restrictions for an API App | Cross origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app. |
+
+| Audit CORS resource access restrictions for a Function App | Cross origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app. |
+
+| Audit CORS resource access restrictions for a Web Application | Cross origin Resource Sharing (CORS) should not allow all domains to access your web application. Allow only required domains to interact with your web app. |
+
+| Audit enabling of diagnostic logs in App Services | Audit enabling of diagnostic logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised |
+
+| Audit enablement of encryption of Automation account variables | It is important to enable encryption of Automation account variable assets when storing sensitive data |
+
+| Audit enabling of diagnostic logs in Batch accounts | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit configuration of metric alert rules on Batch accounts | Audit configuration of metric alert rules on Batch account to enable the required metric |
+
+| Audit enabling of diagnostic logs in Data Lake Analytics | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit enabling of diagnostic logs in Azure Data Lake Store | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit enabling of diagnostic logs in Event Hub | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit authorization rules on Event Hub namespaces | Event Hub clients should not use a namespace level access policy that provides access to all queues and topics in a namespace. To align with the least privilege security model, you shoud create access policies at the entity level for queues and topics to provide access to only the specific entity |
+
+| Audit existence of authorization rules on Event Hub entities | Audit existence of authorization rules on Event Hub entities to grant least-privileged access |
+
+| Audit enabling of diagnostic logs in Key Vault | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit enabling of diagnostic logs in Logic Apps | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit enabling of diagnostic logs for Search service | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit enabling of diagnostic logs in Service Bus | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit authorization rules on Service Bus namespaces | Service Bus clients should not use a namespace level access policy that provides access to all queues and topics in a namespace. To align with the least privilege security model, you shoud create access policies at the entity level for queues and topics to provide access to only the specific entity |
+
+| Audit enabling of diagnostics logs in Service Fabric and Virtual Machine Scale Sets | It is recommended to enable Logs so that activity trail can be recreated when investigations are required in the event of an incident or a compromise. |
+
+| Audit SQL server level Auditing settings | Audits the existence of SQL Auditing at the server level |
+
+| Monitor unaudited SQL servers in Azure Security Center | SQL servers which don't have SQL auditing turned on will be monitored by Azure Security Center as recommendations |
+
+| Audit enabling of diagnostic logs in Azure Stream Analytics | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Audit usage of custom RBAC rules | Audit built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles, which are error prone. Using custom roles is treated as an exception and requires a rigorous review and threat modeling |
+
+| Audit maximum number of owners for a subscription | It is recommended to designate up to 3 subscription owners in order to reduce the potential for breach by a compromised owner. |
+
+| Audit minimum number of owners for subscription | It is recommended to designate more than one subscription owner in order to have administrator access redundancy. |
+
+| Audit deprecated accounts with owner permissions on a subscription | Deprecated accounts with owner permissions should be removed from your subscription. Deprecated accounts are accounts that have been blocked from signing in. |
+
+| [Preview]: Monitor open management ports on Virtual Machines | Open remote management ports are exposing your VM to a high level of risk from Internet-based attacks. These attacks attempt to brute force credentials to gain admin access to the machine. |
+
+| Monitor Internet-facing virtual machines for Network Security Group traffic hardening recommendations | Azure Security Center analyzes the traffic patterns of Internet facing virtual machines and provides Network Security Group rule recommendations that reduce the potential attack surface |
+
+| Monitor permissive network access in Azure Security Center | Network Security Groups with too permissive rules will be monitored by Azure Security Center as recommendations |
+
+| [Preview]: Monitor IP forwarding on virtual machines | Enabling IP forwarding on a virtual machine's NIC allows the machine to receive traffic addressed to other destinations. IP forwarding is rarely required (e.g., when using the VM as a network virtual appliance), and therefore, this should be reviewed by the network security team. |
+
+| Audit enabling of diagnostic logs in IoT Hubs | Audit enabling of diagnostic logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised |
+
+| Monitor possible network Just In Time (JIT) access in Azure Security Center | Possible network Just In Time (JIT) access will be monitored by Azure Security Center as recommendations |
+
+| Monitor possible app Whitelisting in Azure Security Center | Possible Application Whitelist configuration will be monitored by Azure Security Center |
+
+| Monitor permissive network access of VMs running web-apps in Azure Security Center | Azure security center has discovered that some of your virtual machines are running web applications, and the NSGs associated to these virtual machines are overly permissive with regards to the web application ports |
+
+| Monitor unprotected network endpoints in Azure Security Center | Network endpoints without a Next Generation Firewall's protection will be monitored by Azure Security Center as recommendations |
+
+| [Preview]: Monitor SQL data discovery and classification recommendations in Azure Security Center | Azure Security Center monitors the data discovery and classification scan results for your SQL databases and provides recommendations to classify the sensitive data in your databases for better monitoring and security |
+
+| Audit SQL servers without Vulnerability Assessment | Audit Azure SQL servers which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities. |
+
+| Audit SQL managed instances without Vulnerability Assessment | Audit SQL managed instances which do not have recurring vulnerability assessment scans enabled. Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities. |
+
+| [Preview]: Monitor permissive network access to app-services | Azure security center has discovered that the networking configuration of some of your app services are overly permissive and allow inbound traffic from ranges that are too broad |
+
+
+
+
+
diff --git a/01-Subscription-Security/PIMSampleScript.ps1 b/01-Subscription-Security/PIMSampleScript.ps1
new file mode 100644
index 00000000..73682b17
--- /dev/null
+++ b/01-Subscription-Security/PIMSampleScript.ps1
@@ -0,0 +1,80 @@
+
+
+ $subid = '