SECID
SECURITY ASSESSMENT REPORT
Technology: Azure Database Services CIS
Tenant: e14edd6b-c47d-47ab-89fc-cc731581dfc2_Azure-Database-CIS
Assessment Date: 02/21/2026 10:27:53
This Introduction contains a global summary of the security scans performed on the company infrastructure. Detailed information about the scans can be found in the corresponding section in this report. The assessment was performed according to settings recommended by CIS. More Information about CIS can be found here: CIS Benchmarks. There are tests that also recommended by vendor have been performed too.
0Critical
0High
0Medium
0Low
18Passed
10Manual Check
Overall Security Score: 54.55%
OVERALL TENANT STATUS
64.29%
Shows overall score settings that need to be configured correctly in Tenant as per CIS Benchmark. These settings are recommended by CIS.
CIS SECURITY SCORE
Technology Categories and Status
CRTIICAL
HIGH
MEDIUM
LOW
PASSED
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 2.1 | Ensure Microsoft Entra Authentication is Enabled | Manual Check | NONE | By default, Microsoft Entra Authentication is `Checked` during setup. | Level 1 | CIS v1.0.0 | NO |
X 
TEST NAME Ensure Microsoft Entra Authentication is Enabled Description Ensuring that Microsoft Entra Authentication is ?Enabled? provides a natively integrated use of identities already defined with Microsoft Entra ID. Rationale The use of a centralized Identity and Access Management (IAM) solution such as Microsoft Entra ID is highly recommended for all activity related to Identity, Authentication, Authorization, and Accountability. Decentralized IAM ? such as local authentication methods ? may present additional vulnerability and introduce avoidable administrative complexity. Impact Free tiers exist for the licensing of Microsoft Entra ID if required. Recommendation and Steps **From Azure Portal** 1. Search for and open the `Azure Cache for Redis` service 1. For each instance, repeat the remaining steps 1. Click on the name of the instance 1. In the blade menu on the left, click on `Authentication` 1. `Check` the checkbox next to `Enable Microsoft Entra Authentication` Associated Items 
Affected Objects
|
| 2.2 | Ensure that Allow access only via SSL is set to Yes | Manual Check | NONE | By default, 'Allow access only via SSL' is set to 'Yes.' | Level 1 | CIS v1.0.0 | NO |
X
TEST NAME Ensure that Allow access only via SSL is set to Yes Description Setting ?Allow access only via SSL? to ?Yes? ensures that data in transit to and from Azure Cache for Redis is encrypted using TLS. Rationale Data in transit which is not encrypted is vulnerable to attacks including adversary-in-the-middle (AITM or MITM), eavesdropping, or session hijack. These attacks can result in the compromise and exfiltration of data. Impact No additional cost is required to implement this recommendation. Aside from expected network changes (no unencrypted communications), performance should not be impacted. Recommendation and Steps **From Azure Portal** 1. Search for and open the `Azure Cache for Redis` service 1. For each instance, repeat the remaining steps 1. Click on the name of the instance 1. In the blade menu on the left, under Settings, click on `Advanced Settings` 1. Select `Yes` under the `Allow access only via SSL` heading Associated Items
Affected Objects
|
| 2.3 | Ensure that Minimum TLS version is set to TLS v1.2 or higher | Manual Check | NONE | N/A | Level 1 | CIS v1.0.0 | NO |
X
TEST NAME Ensure that Minimum TLS version is set to TLS v1.2 or higher Description Setting the 'Minimum TLS version' helps reduce (but not eliminate) TLS protocol vulnerabilities by preventing the use of significantly outdated versions of TLS. Rationale Older versions of the TLS protocol have demonstrated vulnerabilities and should be avoided where possible. While TLS Protocol Version 1.3 is the most recent and preferred version in cases where it is available, version 1.2 is most broadly available and implemented by vendors. When it is configured to avoid specific vulnerable features of the protocol, version 1.2 of TLS can provide a secure implementation. Versions 1.0 and 1.1 of TLS are no longer considered secure. These versions should not be used or permitted where data integrity and confidentiality are required. Impact This configuration setting should not result in any perceptible changes to cost or performance. Recommendation and Steps **From Azure Portal** 1. Search for and open the `Azure Cache for Redis` service 1. For each instance listed, repeat the remaining steps 1. Click on the name of the instance 1. In the blade menu on the left, under Settings, click on `Advanced Settings` 1. Click the drop-down menu under `Minimum TLS version` 1. Select `1.2 (Recommended)` (higher versions are preferred when available) Associated Items
Affected Objects
More Information TEST ID
|
| 2.4 | Ensure that Access Policies are implemented and reviewed periodically | Manual Check | NONE | By default, no Access Policies exist. | Level 2 | CIS v1.0.0 | NO |
X
TEST NAME Ensure that Access Policies are implemented and reviewed periodically Description Access Policies provide an Access Control List (ACL) functionality allowing administrators to define which identities or identity groups have access to what data and commands. This is an implementation of the Role Based Access Control (RBAC) concept and will require careful consideration to deploy and maintain. Rationale Role Based Access Control (RBAC) using Access Control Lists (ACLs) is a method of implementing the principle of least privilege by ensuring that users and user groups with differing needs are presented with the privilege that fulfills their needs and any unnecessary access or functionality is prevented. Impact Implementing RBAC for any system requires a careful analysis of 'who' needs access to the system, and 'what' privileges or functionality they need to perform. The time required to implement RBAC will increase based on the complexity and size of an environment. If RBAC is deployed without careful analysis, it may prevent users from accessing data or functionality that they require from the system. Conversely, it may present privilege which is unnecessary and introduce vulnerability to a system. Once RBAC has been deployed, there should be periodically scheduled access review. During the access review, all entries in the Access Control List and all identities are reviewed for fitness and necessity. Recommendation and Steps No prescriptive remediation is available due to the specific and unique nature of implementing RBAC for any given system. Implementing RBAC for any system requires a careful analysis of 'who' needs access to the system, and 'what' privileges or functionality they require. The time required to implement RBAC will increase based on the complexity and size of an environment. Associated Items
Affected Objects
More Information TEST ID
|
| 2.5 | Ensure that System Assigned Managed Identity is set to On | Manual Check | NONE | By default, System Assigned Managed Identity of `Off.` | Level 1 | CIS v1.0.0 | NO |
X
TEST NAME Ensure that System Assigned Managed Identity is set to On Description System Assigned Managed Identities provide the Azure Cache for Redis instance with a unique account like a service principle but automatically assigned and managed by Azure. These identities are unique to the resource instance they are created for, and removed when the resource is deleted. Rationale The System Assigned Managed Identity is authenticated with Entra ID, and allows for privileges required for the instance of Azure Cache for Redis to be granted or restricted using Azure Role Based Access Control (RBAC). Additionally, the managed identity provides a means for the Azure Cache for Redis instance to authenticate without storing credentials in code. Impact Recommendation and Steps **From Azure Portal** 1. Search for and open the `Azure Cache for Redis` service 1. For each instance, repeat the remaining steps 1. Click on the name of the instance 1. In the blade menu on the left, under Settings, click on `Identity` 1. Under the `System assigned` tab, toggle the status to `On` 1. Click the `Save` button 1. In the pop-up dialog titled `Enable system assigned managed identity` that appears after clicking save, click the `Yes` button. Associated Items
Affected Objects
More Information TEST ID
|
| 2.6 | Ensure that Public Network Access is Disabled | Manual Check | NONE | By default Public Network Access is `Disabled` when creating an Azure Cache for Redis instance. | Level 1 | CIS v1.0.0 | NO |
X
TEST NAME Ensure that Public Network Access is Disabled Description Disabling public network access restricts the service from accessing public networks. Rationale A secure network architecture requires carefully constructed network segmentation. Public Network Access tends to be overly permissive and introduces unintended vectors for threat activity. Impact Some architectural consideration may be necessary to ensure that required network connectivity is still made available. No additional cost or performance impact is required to deploy this recommendation. **IMPORTANT NOTE:** If Azure Cache for Redis has been deployed in a VNet, this recommendation cannot be implemented. See additional information below for more detail. Recommendation and Steps **From Azure Portal** **NOTE:** A Private Endpoint must exist before the ?Disable public network access? button allows the configuration change to be performed via Portal. 1. Search for and open the `Azure Cache for Redis` service 1. For each instance, repeat the remaining steps 1. Click on the name of the instance 1. In the blade menu on the left, click on `Private Endpoint` 1. Click the `Disable public network access` button. Associated Items
Affected Objects
More Information TEST ID
LINK
https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-network-security#ns-2-secure-cloud-services-with-network-controls https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-network-isolation https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-private-link#how-can-i-change-my-private-endpoint-to-be-disabled-or-enabled-from-public-network-access
|
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 3.2 | Ensure That Private Endpoints Are Used Where Possible | Passed | Status:Configured Correctly | By default Cosmos DB does not have private endpoints enabled and its traffic is public to the network. | Level 2 | CIS v1.0.0 | YES |
X
TEST NAME Ensure That Private Endpoints Are Used Where Possible Description Private endpoints limit network traffic to approved sources. Rationale For sensitive data, private endpoints allow granular control of which services can communicate with Cosmos DB and ensure that this network traffic is private. You set this up on a case by case basis for each service you wish to be connected. Impact Only whitelisted services will have access to communicate with the Cosmos DB. Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoints https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-cosmosdb-portal https://docs.microsoft.com/en-us/cli/azure/cosmosdb/private-endpoint-connection?view=azure-cli-latest https://docs.microsoft.com/en-us/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-create https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls
|
| 3.3 | Use Entra ID Client Authentication and Azure RBAC where possible | Passed | Status:Configured correctly | The default is to use tokens/keys for client authentication. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Use Entra ID Client Authentication and Azure RBAC where possible Description Cosmos DB can use tokens or Entra ID for client authentication which in turn will use Azure RBAC for authorization. Using Entra ID is significantly more secure because Entra ID handles the credentials and allows for MFA and centralized management, and the Azure RBAC better integrated with the rest of Azure. Rationale Entra ID client authentication is considerably more secure than token-based authentication because the tokens must be persistent at the client. Entra ID does not require this. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
|
| 3.1 | Ensure That Firewalls and Networks Is Limited to Use Selected Networks Instead of All Networks | Manual Check | NONE | By default, Cosmos DBs are set to have access all networks. | Level 2 | CIS v1.0.0 | NO |
X
TEST NAME Ensure That Firewalls and Networks Is Limited to Use Selected Networks Instead of All Networks Description Limiting your Cosmos DB to only communicate on whitelisted networks lowers its attack footprint. Rationale Selecting certain networks for your Cosmos DB to communicate restricts the number of networks including the internet that can interact with what is stored within the database. Impact **WARNING:** Failure to whitelist the correct networks will result in a connection loss. **WARNING:** Changes to Cosmos DB firewalls may take up to 15 minutes to apply. Ensure that sufficient time is planned for remediation or changes to avoid disruption. Recommendation and Steps **From Azure Portal** 1. Open the portal menu. 2. Select the Azure Cosmos DB blade. 3. Select a Cosmos DB account to audit. 4. Select `Networking`. 5. Under `Public network access`, select `Selected networks`. 6. Under `Virtual networks`, select `+ Add existing virtual network` or `+ Add a new virtual network`. 7. For existing networks, select subscription, virtual network, subnet and click `Add`. For new networks, provide a name, update the default values if required, and click `Create`. 8. Click `Save`. Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoints https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-configure-vnet-service-endpoint https://docs.microsoft.com/en-us/cli/azure/cosmosdb?view=azure-cli-latest#az-cosmosdb-show https://docs.microsoft.com/en-us/cli/azure/cosmosdb/database?view=azure-cli-latest#az-cosmosdb-database-list https://docs.microsoft.com/en-us/powershell/module/az.cosmosdb/?view=azps-8.1.0 https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls
|
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 6.1 | Ensure Enforce SSL connection is set to Enabled for Standard MySQL Database Server | Passed | Status:Enforce SSL is set | Azure Database for MySQL when provisioned through the Azure portal or CLI will require SSL connections by default. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure Enforce SSL connection is set to Enabled for Standard MySQL Database Server Description Enable `SSL connection` on `MYSQL` Servers. Rationale SSL connectivity helps to provide a new layer of security by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against man in the middle attacks by encrypting the data stream between the server and application. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
|
| 6.3 | Ensure server parameter audit_log_enabled is set to ON for MySQL Database Server | Passed | Status:Configured | `audit_log_enabled` is set to `OFF` by default | Level 2 | CIS v1.0.0 | YES |
X
TEST NAME Ensure server parameter audit_log_enabled is set to ON for MySQL Database Server Description Enable audit_log_enabled on MySQL Servers. Rationale Enabling audit_log_enabled helps MySQL Database to log items such as connection attempts to the server, DDL/DML access, and more. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance. Impact There are further costs incurred for storage of logs. For high traffic databases these logs will be significant. Determine your organization's needs before enabling. Recommendation and Steps Associated Items
Affected Objects
|
| 6.4 | Ensure server parameter audit_log_events has CONNECTION set for MySQL Database Server | Passed | Status:Configured Correctly | By default `audit_log_events` is disabled. | Level 2 | CIS v1.0.0 | YES |
X
TEST NAME Ensure server parameter audit_log_events has CONNECTION set for MySQL Database Server Description Set `audit_log_enabled` to include CONNECTION on MySQL Servers. Rationale Enabling CONNECTION helps MySQL Database to log items such as successful and failed connection attempts to the server. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance. Impact There are further costs incurred for storage of logs. For high traffic databases these logs will be significant. Determine your organization's needs before enabling. Recommendation and Steps Associated Items
Affected Objects
|
| 6.2 | Ensure TLS Version is set to TLSV1.2 or higher for MySQL flexible Database Server | Manual Check | NONE | By default, TLS is set to v1.2 for MySQL Flexible servers. | Level 1 | CIS v1.0.0 | NO |
X
TEST NAME Ensure TLS Version is set to TLSV1.2 or higher for MySQL flexible Database Server Description Ensure `TLS version` on `MySQL flexible` servers is set to use TLS version 1.2 or higher. Rationale TLS connectivity helps to provide a new layer of security by connecting database server to client applications using Transport Layer Security (TLS). Enforcing TLS connections between database server and client applications helps protect against man in the middle attacks by encrypting the data stream between the server and application. Impact Recommendation and Steps **From Azure Portal** 1. Login to Azure Portal using https://portal.azure.com 2. Go to `Azure Database for MySQL flexible servers` 3. For each database, click on `Server parameters` under `Settings` 4. In the search box, type in `tls_version` 5. Click on the VALUE dropdown, and ensure only `TLSV1.2` (or higher) is selected for `tls_version` **From Azure CLI** Use the below command to set MYSQL flexible databases to used version 1.2 for the `tls_version` parameter. ``` az mysql flexible-server parameter set --name tls_version --resource-group Associated Items
Affected Objects
|
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 7.1 | Ensure Enforce SSL connection is set to ENABLED for PostgreSQL Database Server | Passed | Status:Configured | By default, secure connectivity is enforced, but some application frameworks may not enable it during deployment. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure Enforce SSL connection is set to ENABLED for PostgreSQL Database Server Description Enable `SSL connection` on `PostgreSQL` Servers. Rationale `SSL connectivity` helps to provide a new layer of security by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against man in the middle attacks by encrypting the data stream between the server and application. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/postgresql/concepts-ssl-connection-security https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-4-enable-data-at-rest-encryption-by-default https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlserver?view=azps-9.2.0#example-2-get-postgresql-server-by-resource-group-and-server-name https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlserver?view=azps-9.2.0#example-1-update-postgresql-server-by-resource-group-and-server-name
|
| 7.2 | Ensure Server Parameter log_checkpoints is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_checkpoints` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure Server Parameter log_checkpoints is set to ON for PostgreSQL Database Server Description Enable `log_checkpoints` on `PostgreSQL Servers`. Rationale Enabling `log_checkpoints` helps the PostgreSQL Database to `Log each checkpoint` in turn generates query and error logs. However, access to transaction logs is not supported. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation https://learn.microsoft.com/en-us/azure/postgresql/single-server/concepts-server-logs#configure-logging https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlconfiguration?view=azps-9.2.0#example-2-get-specified-postgresql-configuration-by-name https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlconfiguration?view=azps-9.2.0#example-1-update-postgresql-configuration-by-name
|
| 7.3 | Ensure server parameter log_connections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_connections` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure server parameter log_connections is set to ON for PostgreSQL Database Server Description Enable `log_connections` on `PostgreSQL Servers`. Rationale Enabling `log_connections` helps PostgreSQL Database to log attempted connection to the server, as well as successful completion of client authentication. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/rest/api/postgresql/configurations/listbyserver https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlconfiguration?view=azps-9.2.0#example-2-get-specified-postgresql-configuration-by-name https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlconfiguration?view=azps-9.2.0#example-1-update-postgresql-configuration-by-name
|
| 7.4 | Ensure server parameter log_disconnections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_disconnections` is disabled (set to `off`). | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure server parameter log_disconnections is set to ON for PostgreSQL Database Server Description Enable `log_disconnections` on `PostgreSQL Servers`. Rationale Enabling `log_disconnections` helps PostgreSQL Database to `Logs end of a session`, including duration, which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. Impact Enabling this setting will enable a log of all disconnections. If this is enabled for a high traffic server, the log may grow exponentially. Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlconfiguration?view=azps-9.2.0#example-2-get-specified-postgresql-configuration-by-name https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlconfiguration?view=azps-9.2.0#example-1-update-postgresql-configuration-by-name
|
| 7.5 | Ensure server parameter connection_throttling is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default, `connection_throttling` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure server parameter connection_throttling is set to ON for PostgreSQL Database Server Description Enable `connection_throttling` on `PostgreSQL Servers`. Rationale Enabling `connection_throttling` helps the PostgreSQL Database to `Set the verbosity of logged messages`. This in turn generates query and error logs with respect to concurrent connections that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlconfiguration?view=azps-9.2.0#example-2-get-specified-postgresql-configuration-by-name https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlconfiguration?view=azps-9.2.0#example-1-update-postgresql-configuration-by-name
|
| 7.6 | Ensure Server Parameter log_retention_days is greater than 3 days for PostgreSQL Database Server | Passed | Status:Log Retention configured correctly | By default `log_retention_days` is set to `3`. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure Server Parameter log_retention_days is greater than 3 days for PostgreSQL Database Server Description Ensure `log_retention_days` on `PostgreSQL Servers` is set to an appropriate value. Rationale Configuring `log_retention_days` determines the duration in days that `Azure Database for PostgreSQL` retains log files. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance. Impact Configuring this setting will result in logs being retained for the specified number of days. If this is configured on a high traffic server, the log may grow quickly to occupy a large amount of disk space. In this case you may want to set this to a lower number. Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-6-configure-log-storage-retention https://learn.microsoft.com/en-us/powershell/module/az.postgresql/get-azpostgresqlconfiguration?view=azps-9.2.0#example-2-get-specified-postgresql-configuration-by-name https://learn.microsoft.com/en-us/powershell/module/az.postgresql/update-azpostgresqlconfiguration?view=azps-9.2.0#example-1-update-postgresql-configuration-by-name
|
| 7.7 | Ensure Allow access to Azure services for PostgreSQL Database Server is disabled | Passed | Status:Disabled | The Azure Postgres firewall is set to block all access by default. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure Allow access to Azure services for PostgreSQL Database Server is disabled Description Disable access from Azure services to PostgreSQL Database Server. Rationale If access from Azure services is enabled, the server's firewall will accept connections from all Azure resources, including resources not in your subscription. This is usually not a desired configuration. Instead, set up firewall rules to allow access from specific network ranges or VNET rules to allow access from specific virtual networks. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules https://docs.microsoft.com/en-us/azure/postgresql/howto-manage-firewall-using-cli https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-1-establish-network-segmentation-boundaries https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-6-deploy-web-application-firewall
|
| 7.8 | Ensure Infrastructure double encryption for PostgreSQL Database Server is Enabled | Passed | Status:Enabled | By Default, Double Encryption is disabled. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure Infrastructure double encryption for PostgreSQL Database Server is Enabled Description Azure Database for PostgreSQL servers should be created with 'infrastructure double encryption' enabled. **NOTE:** This recommendation currently only applies to Single Server, not Flexible Server. See additional information below for details about the planned retirement of Azure PostgreSQL Single Server. Rationale If Double Encryption is enabled, another layer of encryption is implemented at the hardware level before the storage or network level. Information will be encrypted before it is even accessed, preventing both interception of data in motion if the network layer encryption is broken and data at rest in system resources such as memory or processor cache. Encryption will also be in place for any backups taken of the database, so the key will secure access the data in all forms. For the most secure implementation of key based encryption, it is recommended to use a Customer Managed asymmetric RSA 2048 Key in Azure Key Vault. Impact The read and write speeds to the database will be impacted if both default encryption and Infrastructure Encryption are checked, as a secondary form of encryption requires more resource overhead for the cryptography of information. This cost is justified for information security. Customer managed keys are recommended for the most secure implementation, leading to overhead of key management. The key will also need to be backed up in a secure location, as loss of the key will mean loss of the information in the database. Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/postgresql/howto-double-encryption https://docs.microsoft.com/en-us/azure/postgresql/concepts-infrastructure-double-encryption https://docs.microsoft.com/en-us/azure/postgresql/concepts-data-encryption-postgresql https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification https://docs.microsoft.com/en-us/azure/postgresql/howto-double-encryption https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-4-enable-data-at-rest-encryption-by-default
|
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 10.1 | Ensure that Auditing is set to On | Passed | Status:Configured | By default, `Enable Azure SQL Auditing` is set to `Off`. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure that Auditing is set to On Description Enable auditing on SQL Servers. Rationale The Azure platform allows a SQL server to be created as a service. Enabling auditing at the server level ensures that all existing and newly created databases on the SQL server instance are audited. Auditing policy applied on the SQL database does not override auditing policy and settings applied on the particular SQL server where the database is hosted. Auditing tracks database events and writes them to an audit log in the Azure storage account. It also helps to maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-auditing-on-sql-servers https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/get-azurermsqlserverauditing?view=azurermps-5.2.0 https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserverauditingpolicy?view=azurermps-5.2.0 https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation
|
| 10.3 | Ensure SQL servers Transparent Data Encryption -TDE- protector is encrypted with Customer-managed key | Passed | Status:Configured | By Default, Microsoft managed TDE protector is enabled for a SQL server. | Level 2 | CIS v1.0.0 | YES |
X
TEST NAME Ensure SQL servers Transparent Data Encryption -TDE- protector is encrypted with Customer-managed key Description Transparent Data Encryption (TDE) with Customer-managed key support provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. With TDE, data is encrypted at rest with a symmetric key (called the database encryption key) stored in the database or data warehouse distribution. To protect this data encryption key (DEK) in the past, only a certificate that the Azure SQL Service managed could be used. Now, with Customer-managed key support for TDE, the DEK can be protected with an asymmetric key that is stored in the Azure Key Vault. The Azure Key Vault is a highly available and scalable cloud-based key store which offers central key management, leverages FIPS 140-2 Level 2 validated hardware security modules (HSMs), and allows separation of management of keys and data for additional security. Based on business needs or criticality of data/databases hosted on a SQL server, it is recommended that the TDE protector is encrypted by a key that is managed by the data owner (Customer-managed key). Rationale Customer-managed key support for Transparent Data Encryption (TDE) allows user control of TDE encryption keys and restricts who can access them and when. Azure Key Vault, Azure?s cloud-based external key management system, is the first key management service where TDE has integrated support for Customer-managed keys. With Customer-managed key support, the database encryption key is protected by an asymmetric key stored in the Key Vault. The asymmetric key is set at the server level and inherited by all databases under that server. Impact Once TDE protector is encrypted with a Customer-managed key, it transfers entire responsibility of respective key management on to you, and hence you should be more careful about doing any operations on the particular key in order to keep data from corresponding SQL server and Databases hosted accessible. When deploying Customer Managed Keys, it is prudent to ensure that you also deploy an automated toolset for managing these keys (this should include discovery and key rotation), and Keys should be stored in an HSM or hardware backed keystore, such as Azure Key Vault. As far as toolsets go, check with your cryptographic key provider, as they may well provide one as an add-on to their service. Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption-byok-azure-sql https://azure.microsoft.com/en-in/blog/preview-sql-transparent-data-encryption-tde-with-bring-your-own-key-support/ https://winterdom.com/2017/09/07/azure-sql-tde-protector-keyvault https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-5-use-customer-managed-key-option-in-data-at-rest-encryption-when-required https://docs.microsoft.com/en-us/azure/key-vault/general/basic-concepts https://docs.microsoft.com/en-us/cli/azure/sql/server/tde-key?view=azure-cli-latest https://learn.microsoft.com/en-us/powershell/module/az.sql/get-azsqlservertransparentdataencryptionprotector?view=azps-9.2.0 https://learn.microsoft.com/en-us/powershell/module/az.sql/set-azsqlservertransparentdataencryptionprotector?view=azps-9.2.0
|
| 10.4 | Ensure that Microsoft Entra authentication is Configured for SQL Servers | Passed | Status:Configured | Entra ID Authentication for SQL Database/Server is not enabled by default | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure that Microsoft Entra authentication is Configured for SQL Servers Description Use Microsoft Entra authentication for authentication with SQL Database to manage credentials in a single place. Rationale Microsoft Entra authentication is a mechanism to connect to Microsoft Azure SQL Database and SQL Data Warehouse by using identities in the Microsoft Entra ID directory. With Entra ID authentication, identities of database users and other Microsoft services can be managed in one central location. Central ID management provides a single place to manage database users and simplifies permission management. - It provides an alternative to SQL Server authentication. - Helps stop the proliferation of user identities across database servers. - Allows password rotation in a single place. - Customers can manage database permissions using external (Entra ID) groups. - It can eliminate storing passwords by enabling integrated Windows authentication and other forms of authentication supported by Microsoft Entra. - Entra ID authentication uses contained database users to authenticate identities at the database level. - Entra ID supports token-based authentication for applications connecting to SQL Database. - Entra ID authentication supports ADFS (domain federation) or native user/password authentication for a local Active Directory without domain synchronization. - Entra ID supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options ? phone call, text message, smart cards with pin, or mobile app notification. Impact This will create administrative overhead with user account and permission management. For further security on these administrative accounts, you may want to consider licensing which supports features like Multi Factor Authentication. Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/get-azurermsqlserveractivedirectoryadministrator?view=azurermps-5.2.0 https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-1-use-centralized-identity-and-authentication-system https://docs.microsoft.com/en-us/cli/azure/sql/server/ad-admin?view=azure-cli-latest#az_sql_server_ad_admin_list
|
| 10.5 | Ensure that Data encryption is set to On on a SQL Database | Passed | Status:Configured | By default, `Data encryption` is set to `On`. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure that Data encryption is set to On on a SQL Database Description Enable Transparent Data Encryption on every SQL server. Rationale Azure SQL Database transparent data encryption helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption-with-azure-sql-database https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-4-enable-data-at-rest-encryption-by-default https://learn.microsoft.com/en-us/powershell/module/az.sql/set-azsqldatabasetransparentdataencryption?view=azps-9.2.0
|
| 10.6 | Ensure that Auditing Retention is greater than 90 days | Passed | Status:Configured | By default, SQL Server audit storage is `disabled`. | Level 1 | CIS v1.0.0 | YES |
X
TEST NAME Ensure that Auditing Retention is greater than 90 days Description SQL Server Audit Retention should be configured to be greater than 90 days. Rationale Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access. Impact Recommendation and Steps Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/get-azurermsqlserverauditing?view=azurermps-5.2.0 https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-6-configure-log-storage-retention
|
| 10.2 | Ensure no Azure SQL Databases allow ingress from 0.0.0.0-0 | Manual Check | NONE | By default, `Allow access to Azure Services` is set to `NO`. | Level 1 | CIS v1.0.0 | NO |
X
TEST NAME Ensure no Azure SQL Databases allow ingress from 0.0.0.0-0 Description Ensure that no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP). Rationale Azure SQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific datacenters. By default, for a SQL server, a Firewall exists with StartIp of 0.0.0.0 and EndIP of 0.0.0.0 allowing access to all the Azure services. Additionally, a custom rule can be set up with StartIp of 0.0.0.0 and EndIP of 255.255.255.255 allowing access from ANY IP over the Internet. In order to reduce the potential attack surface for a SQL server, firewall rules should be defined with more granular IP addresses by referencing the range of addresses available from specific datacenters. Impact Disabling `Allow Azure services and resources to access this server` will break all connections to SQL server and Hosted Databases unless custom IP specific rules are added in Firewall Policy. Recommendation and Steps **From Azure Portal** 1. Go to `SQL servers` 2. For each SQL server 3. Click on `Networking` 4. `Uncheck` the checkbox for `Allow Azure services and resources to access this server` 5. Set firewall rules to limit access to only authorized connections **From Azure CLI** Disable default firewall rule `Allow access to Azure services`: ``` az sql server firewall-rule delete --resource-group Associated Items
Affected Objects
More Information TEST ID
LINK
https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-a-windows-firewall-for-database-engine-access?view=sql-server-2017 https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/get-azurermsqlserverfirewallrule?view=azurermps-5.2.0 https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserverfirewallrule?view=azurermps-5.2.0 https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/remove-azurermsqlserverfirewallrule?view=azurermps-5.2.0 https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-set-database-firewall-rule-azure-sql-database?view=azuresqldb-current https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-2-secure-cloud-native-services-with-network-controls
|
| 10.7 | Ensure Public Network Access is Disabled for SQL Servers | Manual Check | NONE | By default, Azure SQL Server's Public network access is set to `Disable`. | Level 1 | CIS v1.0.0 | NO |
X
TEST NAME Ensure Public Network Access is Disabled for SQL Servers Description Disabling public network access restricts the service from accessing public networks. Rationale A secure network architecture requires carefully constructed network segmentation. Public Network Access tends to be overly permissive and introduces unintended vectors for threat activity. Impact Some architectural consideration may be necessary to ensure that required network connectivity is still made available. No additional cost or performance impact is required to deploy this recommendation. Recommendation and Steps **From Azure Portal** 1. Search for and open the `SQL Server` service 1. For each SQL Server listed, repeat the remaining steps 1. Click on the name of the SQL Server 1. In the blade menu on the left, expand the `Security` section 1. Under the expanded Security section, click on `Networking` 1. Under the `Public access` tab in the networking window, set the `Public network access` setting to `Disable`. Associated Items
Affected Objects
More Information TEST ID
|
#TABLE_Azure-Cache-for-Redis1#TABLE_Azure-Cosmos-DB2#TABLE_Azure-Database-for-MySQL3#TABLE_Azure-Database-for-PostgreSQL4#TABLE_Azure-SQL-Database5
All Tests Table
Assessment Table satus contains status for both CIS Benchmark and Internal Tests.
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 3.2 | Ensure That Private Endpoints Are Used Where Possible | Passed | Status:Configured Correctly | By default Cosmos DB does not have private endpoints enabled and its traffic is public to the network. | Level 2 | CIS v1.0.0 | YES |
| 3.3 | Use Entra ID Client Authentication and Azure RBAC where possible | Passed | Status:Configured correctly | The default is to use tokens/keys for client authentication. | Level 1 | CIS v1.0.0 | YES |
| 6.1 | Ensure Enforce SSL connection is set to Enabled for Standard MySQL Database Server | Passed | Status:Enforce SSL is set | Azure Database for MySQL when provisioned through the Azure portal or CLI will require SSL connections by default. | Level 1 | CIS v1.0.0 | YES |
| 6.3 | Ensure server parameter audit_log_enabled is set to ON for MySQL Database Server | Passed | Status:Configured | `audit_log_enabled` is set to `OFF` by default | Level 2 | CIS v1.0.0 | YES |
| 6.4 | Ensure server parameter audit_log_events has CONNECTION set for MySQL Database Server | Passed | Status:Configured Correctly | By default `audit_log_events` is disabled. | Level 2 | CIS v1.0.0 | YES |
| 7.1 | Ensure Enforce SSL connection is set to ENABLED for PostgreSQL Database Server | Passed | Status:Configured | By default, secure connectivity is enforced, but some application frameworks may not enable it during deployment. | Level 1 | CIS v1.0.0 | YES |
| 7.2 | Ensure Server Parameter log_checkpoints is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_checkpoints` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.3 | Ensure server parameter log_connections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_connections` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.4 | Ensure server parameter log_disconnections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_disconnections` is disabled (set to `off`). | Level 1 | CIS v1.0.0 | YES |
| 7.5 | Ensure server parameter connection_throttling is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default, `connection_throttling` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.6 | Ensure Server Parameter log_retention_days is greater than 3 days for PostgreSQL Database Server | Passed | Status:Log Retention configured correctly | By default `log_retention_days` is set to `3`. | Level 1 | CIS v1.0.0 | YES |
| 7.7 | Ensure Allow access to Azure services for PostgreSQL Database Server is disabled | Passed | Status:Disabled | The Azure Postgres firewall is set to block all access by default. | Level 1 | CIS v1.0.0 | YES |
| 7.8 | Ensure Infrastructure double encryption for PostgreSQL Database Server is Enabled | Passed | Status:Enabled | By Default, Double Encryption is disabled. | Level 1 | CIS v1.0.0 | YES |
| 10.1 | Ensure that Auditing is set to On | Passed | Status:Configured | By default, `Enable Azure SQL Auditing` is set to `Off`. | Level 1 | CIS v1.0.0 | YES |
| 10.3 | Ensure SQL servers Transparent Data Encryption -TDE- protector is encrypted with Customer-managed key | Passed | Status:Configured | By Default, Microsoft managed TDE protector is enabled for a SQL server. | Level 2 | CIS v1.0.0 | YES |
| 10.4 | Ensure that Microsoft Entra authentication is Configured for SQL Servers | Passed | Status:Configured | Entra ID Authentication for SQL Database/Server is not enabled by default | Level 1 | CIS v1.0.0 | YES |
| 10.5 | Ensure that Data encryption is set to On on a SQL Database | Passed | Status:Configured | By default, `Data encryption` is set to `On`. | Level 1 | CIS v1.0.0 | YES |
| 10.6 | Ensure that Auditing Retention is greater than 90 days | Passed | Status:Configured | By default, SQL Server audit storage is `disabled`. | Level 1 | CIS v1.0.0 | YES |
| 2.1 | Ensure Microsoft Entra Authentication is Enabled | Manual Check | NONE | By default, Microsoft Entra Authentication is `Checked` during setup. | Level 1 | CIS v1.0.0 | NO |
| 2.2 | Ensure that Allow access only via SSL is set to Yes | Manual Check | NONE | By default, 'Allow access only via SSL' is set to 'Yes.' | Level 1 | CIS v1.0.0 | NO |
| 2.3 | Ensure that Minimum TLS version is set to TLS v1.2 or higher | Manual Check | NONE | N/A | Level 1 | CIS v1.0.0 | NO |
| 2.4 | Ensure that Access Policies are implemented and reviewed periodically | Manual Check | NONE | By default, no Access Policies exist. | Level 2 | CIS v1.0.0 | NO |
| 2.5 | Ensure that System Assigned Managed Identity is set to On | Manual Check | NONE | By default, System Assigned Managed Identity of `Off.` | Level 1 | CIS v1.0.0 | NO |
| 2.6 | Ensure that Public Network Access is Disabled | Manual Check | NONE | By default Public Network Access is `Disabled` when creating an Azure Cache for Redis instance. | Level 1 | CIS v1.0.0 | NO |
| 3.1 | Ensure That Firewalls and Networks Is Limited to Use Selected Networks Instead of All Networks | Manual Check | NONE | By default, Cosmos DBs are set to have access all networks. | Level 2 | CIS v1.0.0 | NO |
| 6.2 | Ensure TLS Version is set to TLSV1.2 or higher for MySQL flexible Database Server | Manual Check | NONE | By default, TLS is set to v1.2 for MySQL Flexible servers. | Level 1 | CIS v1.0.0 | NO |
| 10.2 | Ensure no Azure SQL Databases allow ingress from 0.0.0.0-0 | Manual Check | NONE | By default, `Allow access to Azure Services` is set to `NO`. | Level 1 | CIS v1.0.0 | NO |
| 10.7 | Ensure Public Network Access is Disabled for SQL Servers | Manual Check | NONE | By default, Azure SQL Server's Public network access is set to `Disable`. | Level 1 | CIS v1.0.0 | NO |
CIS Assessment Status Table
Assessment Table satus contains status for CIS Benchmark Tests.
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 3.2 | Ensure That Private Endpoints Are Used Where Possible | Passed | Status:Configured Correctly | By default Cosmos DB does not have private endpoints enabled and its traffic is public to the network. | Level 2 | CIS v1.0.0 | YES |
| 3.3 | Use Entra ID Client Authentication and Azure RBAC where possible | Passed | Status:Configured correctly | The default is to use tokens/keys for client authentication. | Level 1 | CIS v1.0.0 | YES |
| 6.1 | Ensure Enforce SSL connection is set to Enabled for Standard MySQL Database Server | Passed | Status:Enforce SSL is set | Azure Database for MySQL when provisioned through the Azure portal or CLI will require SSL connections by default. | Level 1 | CIS v1.0.0 | YES |
| 6.3 | Ensure server parameter audit_log_enabled is set to ON for MySQL Database Server | Passed | Status:Configured | `audit_log_enabled` is set to `OFF` by default | Level 2 | CIS v1.0.0 | YES |
| 6.4 | Ensure server parameter audit_log_events has CONNECTION set for MySQL Database Server | Passed | Status:Configured Correctly | By default `audit_log_events` is disabled. | Level 2 | CIS v1.0.0 | YES |
| 7.1 | Ensure Enforce SSL connection is set to ENABLED for PostgreSQL Database Server | Passed | Status:Configured | By default, secure connectivity is enforced, but some application frameworks may not enable it during deployment. | Level 1 | CIS v1.0.0 | YES |
| 7.2 | Ensure Server Parameter log_checkpoints is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_checkpoints` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.3 | Ensure server parameter log_connections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_connections` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.4 | Ensure server parameter log_disconnections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_disconnections` is disabled (set to `off`). | Level 1 | CIS v1.0.0 | YES |
| 7.5 | Ensure server parameter connection_throttling is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default, `connection_throttling` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.6 | Ensure Server Parameter log_retention_days is greater than 3 days for PostgreSQL Database Server | Passed | Status:Log Retention configured correctly | By default `log_retention_days` is set to `3`. | Level 1 | CIS v1.0.0 | YES |
| 7.7 | Ensure Allow access to Azure services for PostgreSQL Database Server is disabled | Passed | Status:Disabled | The Azure Postgres firewall is set to block all access by default. | Level 1 | CIS v1.0.0 | YES |
| 7.8 | Ensure Infrastructure double encryption for PostgreSQL Database Server is Enabled | Passed | Status:Enabled | By Default, Double Encryption is disabled. | Level 1 | CIS v1.0.0 | YES |
| 10.1 | Ensure that Auditing is set to On | Passed | Status:Configured | By default, `Enable Azure SQL Auditing` is set to `Off`. | Level 1 | CIS v1.0.0 | YES |
| 10.3 | Ensure SQL servers Transparent Data Encryption -TDE- protector is encrypted with Customer-managed key | Passed | Status:Configured | By Default, Microsoft managed TDE protector is enabled for a SQL server. | Level 2 | CIS v1.0.0 | YES |
| 10.4 | Ensure that Microsoft Entra authentication is Configured for SQL Servers | Passed | Status:Configured | Entra ID Authentication for SQL Database/Server is not enabled by default | Level 1 | CIS v1.0.0 | YES |
| 10.5 | Ensure that Data encryption is set to On on a SQL Database | Passed | Status:Configured | By default, `Data encryption` is set to `On`. | Level 1 | CIS v1.0.0 | YES |
| 10.6 | Ensure that Auditing Retention is greater than 90 days | Passed | Status:Configured | By default, SQL Server audit storage is `disabled`. | Level 1 | CIS v1.0.0 | YES |
| 2.1 | Ensure Microsoft Entra Authentication is Enabled | Manual Check | NONE | By default, Microsoft Entra Authentication is `Checked` during setup. | Level 1 | CIS v1.0.0 | NO |
| 2.2 | Ensure that Allow access only via SSL is set to Yes | Manual Check | NONE | By default, 'Allow access only via SSL' is set to 'Yes.' | Level 1 | CIS v1.0.0 | NO |
| 2.3 | Ensure that Minimum TLS version is set to TLS v1.2 or higher | Manual Check | NONE | N/A | Level 1 | CIS v1.0.0 | NO |
| 2.4 | Ensure that Access Policies are implemented and reviewed periodically | Manual Check | NONE | By default, no Access Policies exist. | Level 2 | CIS v1.0.0 | NO |
| 2.5 | Ensure that System Assigned Managed Identity is set to On | Manual Check | NONE | By default, System Assigned Managed Identity of `Off.` | Level 1 | CIS v1.0.0 | NO |
| 2.6 | Ensure that Public Network Access is Disabled | Manual Check | NONE | By default Public Network Access is `Disabled` when creating an Azure Cache for Redis instance. | Level 1 | CIS v1.0.0 | NO |
| 3.1 | Ensure That Firewalls and Networks Is Limited to Use Selected Networks Instead of All Networks | Manual Check | NONE | By default, Cosmos DBs are set to have access all networks. | Level 2 | CIS v1.0.0 | NO |
| 6.2 | Ensure TLS Version is set to TLSV1.2 or higher for MySQL flexible Database Server | Manual Check | NONE | By default, TLS is set to v1.2 for MySQL Flexible servers. | Level 1 | CIS v1.0.0 | NO |
| 10.2 | Ensure no Azure SQL Databases allow ingress from 0.0.0.0-0 | Manual Check | NONE | By default, `Allow access to Azure Services` is set to `NO`. | Level 1 | CIS v1.0.0 | NO |
| 10.7 | Ensure Public Network Access is Disabled for SQL Servers | Manual Check | NONE | By default, Azure SQL Server's Public network access is set to `Disable`. | Level 1 | CIS v1.0.0 | NO |
SmartProfiler Assessment Tests Status Table
Assessment Table satus contains status for SmartProfiler Tests.
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
All Passed Checks Table
Contains Passed Checks for both CIS Benchmark and SmartProfiler Tests.
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 3.2 | Ensure That Private Endpoints Are Used Where Possible | Passed | Status:Configured Correctly | By default Cosmos DB does not have private endpoints enabled and its traffic is public to the network. | Level 2 | CIS v1.0.0 | YES |
| 3.3 | Use Entra ID Client Authentication and Azure RBAC where possible | Passed | Status:Configured correctly | The default is to use tokens/keys for client authentication. | Level 1 | CIS v1.0.0 | YES |
| 6.1 | Ensure Enforce SSL connection is set to Enabled for Standard MySQL Database Server | Passed | Status:Enforce SSL is set | Azure Database for MySQL when provisioned through the Azure portal or CLI will require SSL connections by default. | Level 1 | CIS v1.0.0 | YES |
| 6.3 | Ensure server parameter audit_log_enabled is set to ON for MySQL Database Server | Passed | Status:Configured | `audit_log_enabled` is set to `OFF` by default | Level 2 | CIS v1.0.0 | YES |
| 6.4 | Ensure server parameter audit_log_events has CONNECTION set for MySQL Database Server | Passed | Status:Configured Correctly | By default `audit_log_events` is disabled. | Level 2 | CIS v1.0.0 | YES |
| 7.1 | Ensure Enforce SSL connection is set to ENABLED for PostgreSQL Database Server | Passed | Status:Configured | By default, secure connectivity is enforced, but some application frameworks may not enable it during deployment. | Level 1 | CIS v1.0.0 | YES |
| 7.2 | Ensure Server Parameter log_checkpoints is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_checkpoints` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.3 | Ensure server parameter log_connections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_connections` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.4 | Ensure server parameter log_disconnections is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default `log_disconnections` is disabled (set to `off`). | Level 1 | CIS v1.0.0 | YES |
| 7.5 | Ensure server parameter connection_throttling is set to ON for PostgreSQL Database Server | Passed | Status:Configured | By default, `connection_throttling` is enabled (set to `on`). | Level 1 | CIS v1.0.0 | YES |
| 7.6 | Ensure Server Parameter log_retention_days is greater than 3 days for PostgreSQL Database Server | Passed | Status:Log Retention configured correctly | By default `log_retention_days` is set to `3`. | Level 1 | CIS v1.0.0 | YES |
| 7.7 | Ensure Allow access to Azure services for PostgreSQL Database Server is disabled | Passed | Status:Disabled | The Azure Postgres firewall is set to block all access by default. | Level 1 | CIS v1.0.0 | YES |
| 7.8 | Ensure Infrastructure double encryption for PostgreSQL Database Server is Enabled | Passed | Status:Enabled | By Default, Double Encryption is disabled. | Level 1 | CIS v1.0.0 | YES |
| 10.1 | Ensure that Auditing is set to On | Passed | Status:Configured | By default, `Enable Azure SQL Auditing` is set to `Off`. | Level 1 | CIS v1.0.0 | YES |
| 10.3 | Ensure SQL servers Transparent Data Encryption -TDE- protector is encrypted with Customer-managed key | Passed | Status:Configured | By Default, Microsoft managed TDE protector is enabled for a SQL server. | Level 2 | CIS v1.0.0 | YES |
| 10.4 | Ensure that Microsoft Entra authentication is Configured for SQL Servers | Passed | Status:Configured | Entra ID Authentication for SQL Database/Server is not enabled by default | Level 1 | CIS v1.0.0 | YES |
| 10.5 | Ensure that Data encryption is set to On on a SQL Database | Passed | Status:Configured | By default, `Data encryption` is set to `On`. | Level 1 | CIS v1.0.0 | YES |
| 10.6 | Ensure that Auditing Retention is greater than 90 days | Passed | Status:Configured | By default, SQL Server audit storage is `disabled`. | Level 1 | CIS v1.0.0 | YES |
All Affected Objects Table
Contains Affected Objects Items for both CIS Benchmark and SmartProfiler Tests. You can find tests that have affected objects.
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
All Manual Checks Table
Contains Manual Checks for both CIS Benchmark and SmartProfiler Tests.
| CIS Section | Test | Severity | Items | Default Value | CIS Profile | Control Type | Configured Correctly? |
| 2.1 | Ensure Microsoft Entra Authentication is Enabled | Manual Check | NONE | By default, Microsoft Entra Authentication is `Checked` during setup. | Level 1 | CIS v1.0.0 | NO |
| 2.2 | Ensure that Allow access only via SSL is set to Yes | Manual Check | NONE | By default, 'Allow access only via SSL' is set to 'Yes.' | Level 1 | CIS v1.0.0 | NO |
| 2.3 | Ensure that Minimum TLS version is set to TLS v1.2 or higher | Manual Check | NONE | N/A | Level 1 | CIS v1.0.0 | NO |
| 2.4 | Ensure that Access Policies are implemented and reviewed periodically | Manual Check | NONE | By default, no Access Policies exist. | Level 2 | CIS v1.0.0 | NO |
| 2.5 | Ensure that System Assigned Managed Identity is set to On | Manual Check | NONE | By default, System Assigned Managed Identity of `Off.` | Level 1 | CIS v1.0.0 | NO |
| 2.6 | Ensure that Public Network Access is Disabled | Manual Check | NONE | By default Public Network Access is `Disabled` when creating an Azure Cache for Redis instance. | Level 1 | CIS v1.0.0 | NO |
| 3.1 | Ensure That Firewalls and Networks Is Limited to Use Selected Networks Instead of All Networks | Manual Check | NONE | By default, Cosmos DBs are set to have access all networks. | Level 2 | CIS v1.0.0 | NO |
| 6.2 | Ensure TLS Version is set to TLSV1.2 or higher for MySQL flexible Database Server | Manual Check | NONE | By default, TLS is set to v1.2 for MySQL Flexible servers. | Level 1 | CIS v1.0.0 | NO |
| 10.2 | Ensure no Azure SQL Databases allow ingress from 0.0.0.0-0 | Manual Check | NONE | By default, `Allow access to Azure Services` is set to `NO`. | Level 1 | CIS v1.0.0 | NO |
| 10.7 | Ensure Public Network Access is Disabled for SQL Servers | Manual Check | NONE | By default, Azure SQL Server's Public network access is set to `Disable`. | Level 1 | CIS v1.0.0 | NO |