Azure Security Checks

Azure Scanners

Cloudsploit's Azure detectors analyze your Azure tenant for security misconfigurations across Active Directory, Storage, Virtual Machines, SQL Database, Key Vault, AKS, and more.

Scanning Azure Tenant

Run a full Azure security scan:

bash

1cloudsploit scan azure

List all Azure detectors:

bash

1cloudsploit detectors --provider azure --list

Identity & Access

Azure AD Password Policy

AZURE_AD_PASSWORD_POLICY

Checks Azure AD password protection settings

Azure AD MFA Enforcement

AZURE_AD_MFA_ENFORCEMENT

Verifies MFA is enabled for all users

Azure AD Guest Users

AZURE_AD_GUEST_USERS

Identifies external guest users and their access

Azure AD Privileged Role Assignments

AZURE_AD_PRIVILEGED_ROLES

Checks for excessive privileged role assignments

Service Principal Credential Age

AZURE_SP_CREDENTIAL_AGE

Service principal credentials older than 90 days

Storage

Storage Account Public Access

STORAGE_ACCOUNT_PUBLIC_ACCESS

Storage container or blob public access enabled

Storage Account Secure Transfer

STORAGE_ACCOUNT_SECURE_TRANSFER

HTTPS only not enforced for storage

Storage Account Encryption

STORAGE_ACCOUNT_ENCRYPTION

Customer-managed keys or Microsoft-managed encryption

Storage Account Network Rules

STORAGE_ACCOUNT_NETWORK_RULES

Network restrictions missing (default allow all)

Storage Account Logging Enabled

STORAGE_ACCOUNT_LOGGING_ENABLED

Read/write/delete logging not configured

Storage Account Blob Versioning

STORAGE_ACCOUNT_BLOB_VERSIONING

Blob versioning disabled (data retention risk)

Compute

VM Public IP Address

VM_PUBLIC_IP_ADDRESS

Virtual machine has public IP assigned

VM Disk Encryption

VM_DISK_ENCRYPTION

OS/data disks not encrypted with Azure Disk Encryption

VM Backup Enabled

VM_BACKUP_ENABLED

Azure Backup not configured for VM

VM Anti-Malware Extension

VM_ANTI_MALWARE_EXTENSION

Microsoft Antimalware extension not installed

App Service HTTPS Only

APP_SERVICE_HTTPS_ONLY

HTTPS-only setting not enabled for web app

App Service Authentication

APP_SERVICE_AUTHENTICATION

Authentication/Authorization not enabled

App Service Always On

APP_SERVICE_ALWAYS_ON

Always On setting disabled (affects reliability)

Database

SQL Server Auditing

SQL_SERVER_AUDITING

Auditing not enabled for Azure SQL Database

SQL Server Encryption

SQL_SERVER_ENCRYPTION

Transparent Data Encryption (TDE) not enabled

SQL Server Threat Detection

SQL_SERVER_THREAT_DETECTION

Advanced Threat Protection not enabled

SQL Server Firewall Rules

SQL_SERVER_FIREWALL_RULES

Overly permissive firewall rules (0.0.0.0)

Cosmos DB Firewall

COSMOS_DB_FIREWALL

Cosmos DB firewall rules too permissive

Redis Cache Firewall

REDIS_FIREWALL

Azure Cache for Redis firewall configuration

Security & Key Vault

Key Vault Soft Delete

KEY_VAULT_SOFT_DELETE

Soft delete not enabled (permanent loss risk)

Key Vault Purge Protection

KEY_VAULT_PURGE_PROTECTION

Purge protection disabled

Key Vault Firewall

KEY_VAULT_FIREWALL

Key Vault network rules too permissive

Security Center Standard Tier

SECURITY_CENTER_STANDARD

Using Free tier instead of Standard

Security Center Auto Provisioning

SECURITY_CENTER_AUTO_PROVISIONING

Auto-provisioning of security agents disabled

Defender for Storage Enabled

DEFENDER_FOR_STORAGE_ENABLED

Microsoft Defender for Storage not enabled

Container & Kubernetes

AKS RBAC Enabled

AKS_RBAC_ENABLED

RBAC not enabled for AKS cluster

AKS Network Policy

AKS_NETWORK_POLICY

Network policy not enabled (Calico/Azure)

AKS OMS Agent

AKS_OMS_AGENT

Log Analytics agent not installed on AKS

Container Registry Admin User

CONTAINER_REGISTRY_ADMIN_USER

Admin user enabled on ACR (security risk)

Container Registry Firewall

CONTAINER_REGISTRY_FIREWALL

ACR network rules not configured

Monitoring & Governance

Activity Log Retention

ACTIVITY_LOG_RETENTION

Activity log retention less than 365 days

Resource Locks Missing

RESOURCE_LOCKS_MISSING

Critical resources lack resource locks

Policy Assignment Missing

POLICY_ASSIGNMENT_MISSING

Azure Policy not assigned to subscription

Cost Anomaly Detection

COST_ANOMALY_DETECTION

Cost Management anomaly detection disabled

Scan Specific Subscription

Target specific Azure subscriptions when you have multi-tenant access:

bash

1# Scan single subscription
2cloudsploit scan azure --subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
3 
4# Scan multiple subscriptions
5cloudsploit scan azure --subscriptions sub1,sub2,sub3
6 
7# Exclude subscription
8cloudsploit scan azure --exclude-subscriptions old-sub-id

Next: GCP Scanners