| 💼 2 AI + Machine Learning Services (reference) | | | | | no data |
| 💼 3 Compute Services (reference) | | | | | no data |
| 💼 4 Database Services (reference) | | | | | no data |
| 💼 5 Identity Services | 12 | | 20 | | no data |
| 　💼 5.1 Security Defaults (Per-User MFA) | 4 | | 4 | | no data |
| 　　💼 5.1.1 Ensure that 'security defaults' is Enabled in Microsoft Entra ID (Automated) | | | 1 | | no data |
| 　　💼 5.1.2 Ensure that 'Require Multifactor Authentication to register or join devices with Microsoft Entra' is set to 'Yes' (Manual) | | | 1 | | no data |
| 　　💼 5.1.3 Ensure that 'Per-user MFA' Status is 'Enabled' or 'Enforced' for All Users (Automated) | | | 1 | | no data |
| 　　💼 5.1.4 Ensure that 'Allow users to remember multifactor authentication on devices they trust' is Disabled (Manual) | | | 1 | | no data |
| 　💼 5.2 Conditional Access (reference) | | | | | no data |
| 　💼 5.3 Periodic Identity Reviews | 7 | | 7 | | no data |
| 　　💼 5.3.1 Ensure that Azure Admin Accounts Are Not Used for Daily Operations (Manual) | | | 1 | | no data |
| 　　💼 5.3.2 Ensure that Guest Users are Reviewed on a Regular Basis (Manual) | | | 1 | | no data |
| 　　💼 5.3.3 Ensure That Use of the 'User Access Administrator' Role is Restricted (Automated) | | | 1 | | no data |
| 　　💼 5.3.4 Ensure that All 'Privileged' Role Assignments are Periodically Reviewed (Manual) | | | 1 | | no data |
| 　　💼 5.3.5 Ensure Disabled User Accounts do not Have Read, Write, or Owner Permissions (Manual) | | | 1 | | no data |
| 　　💼 5.3.6 Ensure 'Tenant Creator' Role Assignments are Periodically Reviewed (Manual) | | | 1 | | no data |
| 　　💼 5.3.7 Ensure All Non-privileged Role Assignments are Periodically Reviewed (Manual) | | | 1 | | no data |
| 　💼 5.4 Ensure that No Custom Subscription Administrator Roles Exist (Automated) | | | 1 | | no data |
| 　💼 5.5 Ensure that a Dedicated Role is Assigned Permissions for Administering Resource Locks (Manual) | | | 1 | | no data |
| 　💼 5.6 Ensure that 'Subscription leaving Microsoft Entra tenant' and 'Subscription entering Microsoft Entra tenant' is set to 'Permit no one' (Manual) | | | 1 | | no data |
| 　💼 5.7 Ensure there are between 2 and 3 Subscription Owners (Automated) | | | 1 | | no data |
| 　💼 5.8 Ensure the default management group for new subscriptions is not the root management group (Automated) | | | 1 | | no data |
| 　💼 5.9 Ensure creating management groups requires write permission on the root management group (Automated) | | | 1 | | no data |
| 　💼 5.10 Ensure Emergency Access Accounts Can Regain Azure Resource Access (Manual) | | | 1 | | no data |
| 　💼 5.11 Ensure Service Principals Holding Azure Role Assignments Do Not Use Client Secrets (Automated) | | | 1 | | no data |
| 　💼 5.12 Ensure Role Assignment Management is Delegated with the 'Role Based Access Control Administrator' Role and Conditions (Automated) | | | 1 | | no data |
| 💼 6 Management and Governance Services | 2 | | 31 | | no data |
| 　💼 6.1 Logging and Monitoring | 6 | | 30 | | no data |
| 　　💼 6.1.1 Configuring Diagnostic Settings | 9 | | 9 | | no data |
| 　　　💼 6.1.1.1 Ensure that a 'Diagnostic Setting' Exists for Subscription Activity Logs (Automated) | | | 1 | | no data |
| 　　　💼 6.1.1.2 Ensure Diagnostic Setting Captures Appropriate Categories (Automated) | | | 1 | | no data |
| 　　　💼 6.1.1.3 Ensure the Storage Account Containing the Container with Activity Logs is Encrypted with Customer-managed Key (CMK) (Manual) | | | 1 | | no data |
| 　　　💼 6.1.1.4 Ensure that Logging for Azure Key Vault is 'Enabled' (Automated) | | | 1 | | no data |
| 　　　💼 6.1.1.5 Ensure that Network Security Group Flow Logs are Captured and Sent to Log Analytics (LEGACY) (Manual) | | | 1 | | no data |
| 　　　💼 6.1.1.6 Ensure that Virtual Network Flow Logs are Captured and Sent to Log Analytics (Manual) | | | 1 | | no data |
| 　　　💼 6.1.1.7 Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Graph Activity Logs to an Appropriate Destination (Manual) | | | 1 | | no data |
| 　　　💼 6.1.1.8 Ensure that a Microsoft Entra Diagnostic Setting Exists to Send Microsoft Entra Activity Logs to an Appropriate Destination (Manual) | | | 1 | | no data |
| 　　　💼 6.1.1.9 Ensure that Intune Logs are Captured and Sent to Log Analytics (Manual) | | | 1 | | no data |
| 　　💼 6.1.2 Monitoring Using Activity Log Alerts | 17 | | 17 | | no data |
| 　　　💼 6.1.2.1 Ensure that Activity Log Alert Exists for Create Policy Assignment (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.3 Ensure that Activity Log Alert Exists for Create or Update Network Security Group (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.4 Ensure that Activity Log Alert Exists for Delete Network Security Group (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.5 Ensure that Activity Log Alert Exists for Create or Update Security Solution (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.6 Ensure that Activity Log Alert Exists for Delete Security Solution (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.7 Ensure that Activity Log Alert Exists for Create or Update SQL Server Firewall Rule (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.8 Ensure that Activity Log Alert Exists for Delete SQL Server Firewall Rule (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.9 Ensure that Activity Log Alert Exists for Create or Update Public IP Address (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.10 Ensure that Activity Log Alert Exists for Delete Public IP Address (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.11 Ensure that an Activity Log Alert Exists for Service Health (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.12 Ensure that Activity Log Alert Exists for Create Role Assignment (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.13 Ensure that Activity Log Alert Exists for Delete Role Assignment (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.14 Ensure that Activity Log Alert Exists for Create or Update Policy Exemption (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.15 Ensure that Activity Log Alert Exists for Delete Diagnostic Setting (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.16 Ensure that Activity Log Alert Exists for Delete Resource Lock (Automated) | | | 1 | | no data |
| 　　　💼 6.1.2.17 Ensure that Activity Log Alert Exists for Update Key Vault Access Policy (Automated) | | | 1 | | no data |
| 　　💼 6.1.3 Configuring Application Insights | 1 | | 1 | | no data |
| 　　　💼 6.1.3.1 Ensure Application Insights are Configured (Automated) | | | 1 | | no data |
| 　　💼 6.1.4 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it (Manual) | | | 1 | | no data |
| 　　💼 6.1.5 Ensure Basic, Free, and Consumption SKUs are not used on Production artifacts requiring monitoring and SLA (Manual) | | | 1 | | no data |
| 　　💼 6.1.6 Ensure that 'Public Network Access' for Ingestion and Queries is 'Disabled' for Log Analytics Workspaces (Automated) | | | 1 | | no data |
| 　💼 6.2 Ensure that Resource Locks are set for Mission-Critical Azure Resources (Manual) | | | 1 | | no data |
| 💼 7 Networking Services | 12 | | 28 | | no data |
| 　💼 7.1 Inbound Port Traffic Filters | 6 | | 12 | | no data |
| 　　💼 7.1.1 Ensure that RDP Access from the Internet is Evaluated and Restricted (Automated)🔴 | | | 3 | 🔴 | no data |
| 　　💼 7.1.2 Ensure that WinRM Access from the Internet is Evaluated and Restricted (Automated) | | | 1 | | no data |
| 　　💼 7.1.3 Ensure that HTTP(S) access from the Internet is evaluated and restricted (Automated)🔴 | | | 3 | 🔴 | no data |
| 　　💼 7.1.4 Ensure that UDP Port Access from the Internet is Evaluated and Restricted (Automated) | | | 1 | | no data |
| 　　💼 7.1.5 Ensure that SSH Access from the Internet is Evaluated and Restricted (Automated)🔴 | | | 3 | 🔴 | no data |
| 　　💼 7.1.6 Ensure that Database Port Access from the Internet is Evaluated and Restricted (Automated) | | | 1 | | no data |
| 　💼 7.2 Azure Application Gateway | 6 | | 6 | | no data |
| 　　💼 7.2.1 Ensure 'HTTP2' is Set to 'Enabled' on Azure Application Gateway (Automated) | | | 1 | | no data |
| 　　💼 7.2.2 Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_2' or Higher on Azure Application Gateway (Automated) | | | 1 | | no data |
| 　　💼 7.2.3 Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_3' on Azure Application Gateway (Automated) | | | 1 | | no data |
| 　　💼 7.2.4 Ensure Bot Protection is Enabled in Azure Web Application Firewall Policy on Azure Application Gateway (Automated) | | | 1 | | no data |
| 　　💼 7.2.5 Ensure Request Body Inspection is Enabled in Azure Web Application Firewall policy on Azure Application Gateway (Automated) | | | 1 | | no data |
| 　　💼 7.2.6 Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Application Gateway (Automated) | | | 1 | | no data |
| 　💼 7.3 Ensure that Public IP Addresses are Evaluated on a Periodic Basis (Manual) | | | 1 | | no data |
| 　💼 7.4 Ensure Subnets Are Associated with Network Security Groups (Automated) | | | 1 | | no data |
| 　💼 7.5 Ensure that Network Watcher is 'Enabled' for Azure Regions That are in Use (Automated) | | | 1 | | no data |
| 　💼 7.6 Ensure that Virtual Network Flow Log Retention Days is Set to Greater than or Equal to 90 (Automated) | | | 1 | | no data |
| 　💼 7.7 Ensure 'Authentication type' is Set to 'Microsoft Entra ID' Only for Azure VPN Gateway Point-to-Site Configuration (Automated) | | | 1 | | no data |
| 　💼 7.8 Ensure that Network Security Groups override the default 'VirtualNetwork' allow rules (Automated) | | | 1 | | no data |
| 　💼 7.9 Ensure Azure Network Security Perimeter is Used to Secure Azure Platform-as-a-service Resources (Manual) | | | 1 | | no data |
| 　💼 7.10 Ensure Azure Web Application Firewall (WAF) is Enabled on Azure Front Door (Automated) | | | 1 | | no data |
| 　💼 7.11 Ensure 'Default outbound access' is Set to 'Disabled' for Virtual Network Subnets (Automated) | | | 1 | | no data |
| 　💼 7.12 Ensure that Network Security Group Flow Log Retention Days is Set to Greater than or equal to 90 (LEGACY) (Automated) | | | 1 | | no data |
| 💼 8 Security Services | 6 | | 48 | | no data |
| 　💼 8.1 Microsoft Defender for Cloud | 18 | | 26 | | no data |
| 　　💼 8.1.1 Microsoft Cloud Security Posture Management (CSPM) | 1 | | 1 | | no data |
| 　　　💼 8.1.1.1 Ensure Microsoft Defender CSPM is Set to 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.2 Defender Plan: APIs | 1 | | 1 | | no data |
| 　　　💼 8.1.2.1 Ensure Microsoft Defender for APIs is Set to 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.3 Defender Plan: Servers | 5 | | 5 | | no data |
| 　　　💼 8.1.3.1 Ensure that Defender for Servers is Set to 'On' (Automated) | | | 1 | | no data |
| 　　　💼 8.1.3.2 Ensure that 'Vulnerability assessment for machines' Component Status is set to 'On' (Manual) | | | 1 | | no data |
| 　　　💼 8.1.3.3 Ensure that 'Endpoint protection' Component Status is set to 'On' (Automated) | | | 1 | | no data |
| 　　　💼 8.1.3.4 Ensure that 'Agentless scanning for machines' Component Status is Set to 'On' (Automated) | | | 1 | | no data |
| 　　　💼 8.1.3.5 Ensure that 'File Integrity Monitoring' Component Status is Set to 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.4 Defender Plan: Containers | 1 | | 1 | | no data |
| 　　　💼 8.1.4.1 Ensure That Microsoft Defender for Containers Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.5 Defender Plan: Storage | 1 | | 1 | | no data |
| 　　　💼 8.1.5.1 Ensure That Microsoft Defender for Storage Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.6 Defender Plan: App Service | 1 | | 1 | | no data |
| 　　　💼 8.1.6.1 Ensure That Microsoft Defender for App Services Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.7 Defender Plan: Databases | 4 | | 4 | | no data |
| 　　　💼 8.1.7.1 Ensure That Microsoft Defender for Azure Cosmos DB Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　　💼 8.1.7.2 Ensure That Microsoft Defender for Open-Source Relational Databases Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　　💼 8.1.7.3 Ensure That Microsoft Defender for (Managed Instance) Azure SQL Databases Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　　💼 8.1.7.4 Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.8 Defender Plan: Key Vault | 1 | | 1 | | no data |
| 　　　💼 8.1.8.1 Ensure That Microsoft Defender for Key Vault Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.9 Defender Plan: Resource Manager | 1 | | 1 | | no data |
| 　　　💼 8.1.9.1 Ensure That Microsoft Defender for Resource Manager Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.10 Defender Plan: Data & AI Security | 2 | | 2 | | no data |
| 　　　💼 8.1.10.1 Ensure That Microsoft Defender for AI Services Is Set To 'On' (Automated) | | | 1 | | no data |
| 　　　💼 8.1.10.2 Ensure that 'Suspicious prompt evidence' Component Status is Set to 'On' (Automated) | | | 1 | | no data |
| 　　💼 8.1.11 Ensure that Microsoft Defender for Cloud is Configured to Check VM Operating Systems for Updates (Automated) | | | 1 | | no data |
| 　　💼 8.1.12 Ensure Continuous Export of Microsoft Defender for Cloud alerts is configured to a SIEM (Manual) | | | 1 | | no data |
| 　　💼 8.1.13 Ensure that non-deprecated Microsoft Cloud Security Benchmark policies are not set to 'Disabled' (Manual) | | | 1 | | no data |
| 　　💼 8.1.14 Ensure that Microsoft Defender for Cloud Sends Security Alert Emails to Users with the 'Owner' Role (Automated) | | | 1 | | no data |
| 　　💼 8.1.15 Ensure 'Additional email addresses' is Configured with a Security Contact Email (Automated) | | | 1 | | no data |
| 　　💼 8.1.16 Ensure that 'Notify about alerts with the following severity (or higher)' is Enabled (Automated) | | | 1 | | no data |
| 　　💼 8.1.17 Ensure that 'Notify about attack paths with the following risk level (or higher)' is Enabled (Automated) | | | 1 | | no data |
| 　　💼 8.1.18 Ensure that Microsoft Defender External Attack Surface Monitoring (EASM) is Enabled (Manual) | | | 1 | | no data |
| 　💼 8.2 Microsoft Defender for IoT | 1 | | 1 | | no data |
| 　　💼 8.2.1 Ensure That Microsoft Defender for IoT Hub Is Set To 'On' (Manual) | | | 1 | | no data |
| 　💼 8.3 Key Vault | 12 | | 17 | | no data |
| 　　💼 8.3.1 Hardware Security Module (HSM) | 6 | | 6 | | no data |
| 　　　💼 8.3.1.1 Ensure that Azure Key Vault Managed HSM is Used when Required (Manual) | | | 1 | | no data |
| 　　　💼 8.3.1.2 Ensure that Logging for Azure Key Vault Managed HSM is 'Enabled' (Automated) | | | 1 | | no data |
| 　　　💼 8.3.1.3 Ensure Keys in Azure Key Vault Premium are HSM-Protected (Automated) | | | 1 | | no data |
| 　　　💼 8.3.1.4 Ensure 'Purge protection' is Set to 'Enabled' for Azure Key Vault Managed HSM (Automated) | | | 1 | | no data |
| 　　　💼 8.3.1.5 Ensure 'Public Network Access' is 'Disabled' for Azure Key Vault Managed HSM (Automated) | | | 1 | | no data |
| 　　　💼 8.3.1.6 Ensure Private Endpoints are Used to Access Azure Key Vault Managed HSM (Automated) | | | 1 | | no data |
| 　　💼 8.3.2 Ensure that the Expiration Date is Set for all Keys in Key Vaults using RBAC (Automated) | | | 1 | | no data |
| 　　💼 8.3.3 Ensure that the Expiration Date is set for All Keys in Key Vaults using access policies (legacy) (Automated) | | | 1 | | no data |
| 　　💼 8.3.4 Ensure that the Expiration Date is set for All Secrets in Key Vaults using RBAC (Automated) | | | 1 | | no data |
| 　　💼 8.3.5 Ensure that the Expiration Date is set for All Secrets in Key Vaults using access policies (legacy) (Automated) | | | 1 | | no data |
| 　　💼 8.3.6 Ensure Certificate 'Validity Period (in months)' is Less Than or Equal to '12' (Automated) | | | 1 | | no data |
| 　　💼 8.3.7 Ensure Automatic Key Rotation is Enabled within Azure Key Vault (Automated) | | | 1 | | no data |
| 　　💼 8.3.8 Ensure 'Purge protection' is Set to 'Enabled' (Automated) | | | 1 | | no data |
| 　　💼 8.3.9 Ensure that Role Based Access Control for Azure Key Vault is Enabled (Automated) | | | 1 | | no data |
| 　　💼 8.3.10 Ensure the Default Network Access Rule for Key Vaults is Set to Deny (Automated) | | | 1 | | no data |
| 　　💼 8.3.11 Ensure Public Network Access is Disabled (Automated) | | | 1 | | no data |
| 　　💼 8.3.12 Ensure Private Endpoints are Used to Access Azure Key Vault (Automated) | | | 1 | | no data |
| 　💼 8.4 Azure Bastion | 2 | | 2 | | no data |
| 　　💼 8.4.1 Ensure an Azure Bastion Host Exists (Automated) | | | 1 | | no data |
| 　　💼 8.4.2 Ensure 'Shareable Link' is Disabled on Azure Bastion Hosts (Automated) | | | 1 | | no data |
| 　💼 8.5 Ensure Azure DDoS Protection is Enabled on Public IP Addresses (Automated) | | | 1 | | no data |
| 　💼 8.6 Ensure Azure DDoS Network Protection is Enabled on Virtual Networks (Automated) | | | 1 | | no data |
| 💼 9 Storage Services | 2 | | 7 | | no data |
| 　💼 9.1 Azure Blob Storage | 1 | | 1 | | no data |
| 　　💼 9.1.1 Ensure That Soft Delete for Blobs on Azure Blob Storage Storage Accounts is Enabled (Automated) | | | 1 | | no data |
| 　💼 9.2 Storage Accounts | 5 | | 6 | | no data |
| 　　💼 9.2.1 Networking | 2 | | 2 | | no data |
| 　　　💼 9.2.1.1 Ensure that 'Public Network Access' is 'Disabled' for Storage Accounts (Automated) | | | 1 | | no data |
| 　　　💼 9.2.1.2 Ensure Default Network Access Rule for Storage Accounts is Set to Deny (Automated) | | | 1 | | no data |
| 　　💼 9.2.2 Identity and Access Management | 1 | | 1 | | no data |
| 　　　💼 9.2.2.1 Ensure that 'Default to Microsoft Entra authorization in the Azure portal' is Set to 'Enabled' (Automated) | | | 1 | | no data |
| 　　💼 9.2.3 Ensure that 'Secure transfer required' is Set to 'Enabled' (Automated) | | | 1 | | no data |
| 　　💼 9.2.4 Ensure the 'Minimum TLS version' for Storage Accounts is Set to 'Version 1.2' (Automated) | | | 1 | | no data |
| 　　💼 9.2.5 Ensure that 'Allow Blob anonymous access' is Set to 'Disabled' (Automated) | | | 1 | | no data |