Rules by pillar
March 30, 2026 ยท View on GitHub
PSRule for Azure includes the following rules across five pillars of the Microsoft Azure Well-Architected Framework.
Cost Optimization
CO:03 Cost data and reporting
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Resource.UseTags | Azure resources should be tagged using a standard convention. | Awareness | Error |
CO:04 Spending guardrails
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.DevBox.ProjectLimit | Limit the number of Dev Boxes a single user can create for a project. | Important | Error |
CO:05 Rate optimization
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.VM.MultiTenantHosting | Deploy Windows 10 and 11 virtual machines in Azure using Multi-tenant Hosting Rights to leverage your existing Windows licenses. | Awareness | Error |
| Azure.VM.PromoSku | Virtual machines (VMs) should not use expired promotional SKU. | Awareness | Error |
| Azure.VM.UseHybridUseBenefit | Use Azure Hybrid Benefit for applicable virtual machine (VM) workloads. | Awareness | Error |
CO:06 Usage and billing increments
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Alert.HighFrequencyQuery | High frequency scheduled queries are changed as a higher rate than low frequency queries. | Important | Error |
| Azure.ML.ComputeIdleShutdown | Configure an idle shutdown timeout for Machine Learning compute instances. | Critical | Error |
| Azure.VM.DiskSizeAlignment | Align to the Managed Disk billing increments to improve cost efficiency. | Awareness | Error |
CO:07 Component costs
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.Usage | Regularly remove deprecated and unneeded images to reduce storage usage. | Important | Error |
| Azure.AKS.AuditAdmin | Use kube-audit-admin instead of kube-audit to capture administrative actions in AKS clusters. | Important | Error |
| Azure.VM.DiskAttached | Managed disks should be attached to virtual machines or removed. | Important | Error |
| Azure.VM.ShouldNotBeStopped | Azure Virtual Machines in a stopped state are still allocated and billed for compute usage. | Important | Error |
CO:10 Data costs
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.Retention | Use a retention policy to cleanup untagged manifests. | Important | Error |
CO:13 Personnel time
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Alert.MetricAutoMitigate | Alerts that require manual intervention for mitigation can lead to increased personnel time and effort. | Important | Error |
| Azure.NIC.Attached | Network interfaces (NICs) that are not used should be removed. | Awareness | Error |
| Azure.NSG.Associated | Network Security Groups (NSGs) should be associated to a subnet or network interface. | Awareness | Error |
CO:14 Consolidation
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ADX.Usage | Regularly remove unused resources to reduce costs. | Important | Error |
| Azure.EventHub.Usage | Regularly remove unused resources to reduce costs. | Important | Error |
| Azure.FrontDoor.State | Enable Azure Front Door Classic instance. | Important | Error |
| Azure.PublicIP.IsAttached | Public IP addresses should be attached or cleaned up if not in use. | Important | Error |
| Azure.ServiceBus.Usage | Regularly remove unused resources to reduce costs. | Important | Error |
Operational Excellence
Configuration
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.APIM.ProductTerms | Set legal terms for each product registered in API Management. | Important | Error |
Deployment
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppGw.MinSku | Application Gateway should use a minimum instance size of Medium. | Important | Error |
Infrastructure provisioning
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppGw.MigrateV2 | Use a Application Gateway v2 SKU. | Important | Error |
| Azure.ASE.MigrateV3 | Use ASEv3 as replacement for the classic app service environment versions ASEv1 and ASEv2. | Important | Error |
Monitoring
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.ContainerInsights | Enable Container insights to monitor AKS cluster workloads. | Important | Error |
| Azure.AKS.PlatformLogs | AKS clusters should collect platform diagnostic logs to monitor the state of workloads. | Important | Error |
| Azure.Automation.PlatformLogs | Ensure automation account platform diagnostic logs are enabled. | Important | Error |
| Azure.VM.MigrateAMA | Use Azure Monitor Agent as replacement for Log Analytics Agent. | Important | Error |
| Azure.VMSS.MigrateAMA | Use Azure Monitor Agent as replacement for Log Analytics Agent. | Important | Error |
OE:04 Continuous integration
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.Name | Container registry names should meet naming requirements. | Awareness | Error |
| Azure.AKS.DNSPrefix | Azure Kubernetes Service (AKS) cluster DNS prefix should meet naming requirements. | Awareness | Error |
| Azure.AKS.Name | Azure Kubernetes Service (AKS) cluster names should meet naming requirements. | Awareness | Error |
| Azure.APIM.Name | API Management service names should meet naming requirements. | Awareness | Error |
| Azure.AppConfig.Name | App Configuration store names should meet naming requirements. | Awareness | Error |
| Azure.AppGw.Name | Application Gateways should meet naming requirements. | Awareness | Error |
| Azure.AppInsights.Name | Azure Resource Manager (ARM) has requirements for Application Insights resource names. | Awareness | Error |
| Azure.ContainerApp.Name | Container Apps should meet naming requirements. | Awareness | Error |
| Azure.Cosmos.AccountName | Cosmos DB account names should meet naming requirements. | Awareness | Error |
| Azure.Group.Name | Azure Resource Manager (ARM) has requirements for Resource Groups names. | Awareness | Error |
| Azure.KeyVault.KeyName | Key Vault Key names should meet naming requirements. | Awareness | Error |
| Azure.KeyVault.SecretName | Key Vault Secret names should meet naming requirements. | Awareness | Error |
| Azure.LB.Name | Load Balancer names should meet naming requirements. | Awareness | Error |
| Azure.Log.Name | Azure Resource Manager (ARM) has requirements for Azure Monitor Log workspace names. | Awareness | Error |
| Azure.MariaDB.DatabaseName | Azure Database for MariaDB databases should meet naming requirements. | Awareness | Error |
| Azure.MySQL.ServerName | Azure MySQL DB server names should meet naming requirements. | Awareness | Error |
| Azure.NIC.Name | Network Interface (NIC) names should meet naming requirements. | Awareness | Error |
| Azure.NSG.Name | Azure Resource Manager (ARM) has requirements for Network Security Group (NSG) names. | Awareness | Error |
| Azure.PostgreSQL.ServerName | Azure PostgreSQL DB server names should meet naming requirements. | Awareness | Error |
| Azure.PublicIP.Name | Azure Resource Manager (ARM) has requirements for Public IP address names. | Awareness | Error |
| Azure.Route.Name | Azure Resource Manager (ARM) has requirements for Route table names. | Awareness | Error |
| Azure.Search.Name | Azure Resource Manager (ARM) has requirements for AI Search service names. | Awareness | Error |
| Azure.SQL.DBName | Azure SQL Database names should meet naming requirements. | Awareness | Error |
| Azure.SQL.ServerName | Azure SQL logical server names should meet naming requirements. | Awareness | Error |
| Azure.Storage.Name | Azure Resource Manager (ARM) has requirements for Storage Account names. | Awareness | Error |
| Azure.VM.ComputerName | Virtual Machine (VM) computer name should meet naming requirements. | Awareness | Error |
| Azure.VM.Name | Virtual Machine (VM) names should meet naming requirements. | Awareness | Error |
| Azure.VM.PPGName | Proximity Placement Group (PPG) names should meet naming requirements. | Awareness | Error |
| Azure.VNET.Name | Azure Resource Manager (ARM) has requirements for Virtual Network names. | Awareness | Error |
| Azure.VNET.SubnetName | Azure Resource Manager (ARM) has requirements for Virtual Network Subnet names. | Awareness | Error |
| Azure.VNG.ConnectionName | Virtual Network Gateway (VNG) connection names should meet naming requirements. | Awareness | Error |
| Azure.VNG.Name | Virtual Network Gateway (VNG) names should meet naming requirements. | Awareness | Error |
OE:04 Tools and processes
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACI.Naming | Container Instance resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.ACR.Naming | Container Registry resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.AI.FoundryNaming | Azure AI Foundry accounts without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.AKS.Naming | AKS cluster resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.AKS.SystemPoolNaming | AKS system node pool resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.AKS.UserPoolNaming | AKS user node pool resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.APIM.APIDescriptors | APIs should have a display name and description. | Awareness | Warning |
| Azure.APIM.ProductDescriptors | API Management products should have a display name and description. | Awareness | Warning |
| Azure.AppInsights.Naming | Application Insights resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.ContainerApp.APIVersion | Migrate from retired API version to a supported version. | Important | Error |
| Azure.ContainerApp.EnvNaming | Container App Environment resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.ContainerApp.JobNaming | Container App Job resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.ContainerApp.Naming | Container App resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Cosmos.CassandraNaming | Cosmos DB for Apache Cassandra account resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Cosmos.DatabaseNaming | Cosmos DB database resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Cosmos.GremlinNaming | Cosmos DB for Apache Gremlin account resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Cosmos.MongoNaming | Cosmos DB for MongoDB account resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Cosmos.NoSQLNaming | Cosmos DB for NoSQL account resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Cosmos.PostgreSQLNaming | Cosmos DB PostgreSQL cluster resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Cosmos.TableNaming | Cosmos DB for Table account resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.EventGrid.DomainNaming | Event Grid domains without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.EventGrid.SystemTopicNaming | Event Grid system topics without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.EventGrid.TopicNaming | Event Grid topics without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Group.Naming | Resource Groups without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Group.RequiredTags | Resource groups without a standard tagging convention may be difficult to identify and manage. | Awareness | Error |
| Azure.LB.Naming | Load balancer names should use a standard prefix. | Awareness | Error |
| Azure.Log.Naming | Azure Monitor Log workspaces without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.MySQL.ServerNaming | MySQL database server resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.NSG.Naming | Network security group (NSG) without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Policy.AssignmentDescriptors | Policy assignments should use a display name and description. | Awareness | Error |
| Azure.Policy.Descriptors | Policy and initiative definitions should use a display name, description, and category. | Awareness | Error |
| Azure.Policy.ExemptionDescriptors | Policy exemptions should use a display name and description. | Awareness | Error |
| Azure.PostgreSQL.ServerNaming | PostgreSQL database server resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.PublicIP.Naming | Public IP addresses without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Redis.Naming | Azure Cache for Redis resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.RedisEnterprise.Naming | Azure Cache for Redis Enterprise resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Resource.RequiredTags | Resources without a standard tagging convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Route.Naming | Route tables without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Search.Naming | Azure AI Search services without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.ServiceFabric.ManagedNaming | Service Fabric managed cluster resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.ServiceFabric.Naming | Service Fabric cluster resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.SQL.DBNaming | Azure SQL database resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.SQL.ElasticPoolNaming | Azure SQL Elastic Pool resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.SQL.JobAgentNaming | Azure SQL Elastic Job agent resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.SQL.ServerNaming | Azure SQL Database server resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.SQLMI.Naming | SQL Managed Instance resources without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Storage.Naming | Storage Accounts without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.Subscription.RequiredTags | Subscriptions without a standard tagging convention may be difficult to identify and manage. | Awareness | Error |
| Azure.VM.Naming | Virtual machines without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.VNET.Naming | Virtual Networks without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.VNET.PeerState | VNET peering connections must be connected. | Important | Error |
| Azure.VNET.SubnetNaming | Virtual Network subnets without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.VNG.ConnectionNaming | Virtual network gateway connections without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
| Azure.VNG.Naming | Virtual network gateway without a standard naming convention may be difficult to identify and manage. | Awareness | Error |
OE:05 Infrastructure as code
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Redis.MigrateAMR | Azure Cache for Redis is being retired. Migrate to Azure Managed Redis. | Important | Error |
| Azure.RedisEnterprise.MigrateAMR | Azure Cache for Redis Enterprise and Enterprise Flash are being retired. Migrate to Azure Managed Redis. | Important | Error |
| Azure.Template.ResourceLocation | Resource locations should be an expression or global. | Awareness | Error |
| Azure.Template.TemplateFile | Use ARM template files that are valid. | Important | Error |
| Azure.Template.ValidSecretRef | Use a valid secret reference within parameter files. | Awareness | Error |
OE:07 Monitoring system
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppInsights.Workspace | Configure Application Insights resources to store data in a workspace. | Important | Error |
| Azure.VM.AMA | Use Azure Monitor Agent for collecting monitoring data from VMs. | Important | Error |
| Azure.VMSS.AMA | Use Azure Monitor Agent for collecting monitoring data from VM scale sets. | Important | Error |
OE:09 Task automation
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.AutoUpgrade | New versions of Kubernetes are released regularly. Upgrading each release manually can add operational overhead without realizing equivalent value. | Important | Error |
OE:10 Automation design
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.VM.Agent | Virtual Machines (VMs) without an agent provisioned are unable to use monitoring, management, and security extensions. | Important | Error |
Release engineering
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Template.DebugDeployment | Use default deployment detail level for nested deployments. | Awareness | Error |
| Azure.Template.DefineParameters | Each Azure Resource Manager (ARM) template file should contain a minimal number of parameters. | Awareness | Error |
| Azure.Template.LocationType | Location parameters should use a string value. | Important | Error |
| Azure.Template.MetadataLink | Configure a metadata link for each parameter file. | Important | Error |
| Azure.Template.ParameterDataTypes | Set the parameter default value to a value of the same type. | Important | Error |
| Azure.Template.ParameterMetadata | Set metadata descriptions in Azure Resource Manager (ARM) template for each parameter. | Awareness | Error |
| Azure.Template.ParameterMinMaxValue | Template parameters minValue and maxValue constraints must be valid. | Important | Error |
| Azure.Template.Resources | Each Azure Resource Manager (ARM) template file should deploy at least one resource. | Awareness | Error |
| Azure.Template.UseLocationParameter | Template should reference a location parameter to specify resource location. | Awareness | Warning |
| Azure.Template.UseParameters | Each Azure Resource Manager (ARM) template parameter should be used or removed from template files. | Awareness | Error |
| Azure.Template.UseVariables | Each Azure Resource Manager (ARM) template variable should be used or removed from template files. | Awareness | Error |
Repeatable infrastructure
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.APIM.MinAPIVersion | API Management instances should limit control plane API calls to API Management with version '2021-08-01' or newer. | Important | Error |
| Azure.Arc.Server.MaintenanceConfig | Use a maintenance configuration for Arc-enabled servers. | Important | Error |
| Azure.ASG.Name | Application Security Group (ASG) names should meet naming requirements. | Awareness | Error |
| Azure.Bastion.Name | Bastion hosts should meet naming requirements. | Awareness | Error |
| Azure.CDN.EndpointName | Azure CDN Endpoint names should meet naming requirements. | Awareness | Error |
| Azure.Deployment.Name | Nested deployments should meet naming requirements of deployments. | Awareness | Error |
| Azure.Firewall.Name | Firewall names should meet naming requirements. | Awareness | Error |
| Azure.Firewall.PolicyName | Firewall policy names should meet naming requirements. | Awareness | Error |
| Azure.FrontDoor.Name | Front Door names should meet naming requirements. | Awareness | Error |
| Azure.FrontDoor.WAF.Name | Front Door WAF policy names should meet naming requirements. | Awareness | Error |
| Azure.Identity.UserAssignedName | Managed Identity names should meet naming requirements. | Awareness | Error |
| Azure.KeyVault.Name | Key Vault names should meet naming requirements. | Awareness | Error |
| Azure.MariaDB.FirewallRuleName | Azure Database for MariaDB firewall rules should meet naming requirements. | Awareness | Error |
| Azure.MariaDB.ServerName | Azure Database for MariaDB servers should meet naming requirements. | Awareness | Error |
| Azure.MariaDB.VNETRuleName | Azure Database for MariaDB VNET rules should meet naming requirements. | Awareness | Error |
| Azure.NSG.AKSRules | AKS Network Security Group (NSG) should not have custom rules. | Awareness | Error |
| Azure.Policy.AssignmentAssignedBy | Policy assignments should use assignedBy metadata. | Awareness | Error |
| Azure.PrivateEndpoint.Name | Private Endpoint names should meet naming requirements. | Awareness | Error |
| Azure.PublicIP.DNSLabel | Public IP domain name labels should meet naming requirements. | Awareness | Error |
| Azure.PublicIP.MigrateStandard | Use the Standard SKU for Public IP addresses as the Basic SKU will be retired. | Important | Error |
| Azure.RSV.Name | Recovery Services vaults should meet naming requirements. | Awareness | Error |
| Azure.SignalR.Name | SignalR service instance names should meet naming requirements. | Awareness | Error |
| Azure.SQL.FGName | Azure SQL failover group names should meet naming requirements. | Awareness | Error |
| Azure.SQLMI.Name | SQL Managed Instance names should meet naming requirements. | Awareness | Error |
| Azure.Template.ExpressionLength | Template expressions should not exceed the maximum length. | Awareness | Error |
| Azure.Template.ParameterFile | Use ARM template parameter files that are valid. | Important | Error |
| Azure.Template.ParameterScheme | Use an Azure template parameter file schema with the https scheme. | Awareness | Error |
| Azure.Template.ParameterStrongType | Set the parameter value to a value that matches the specified strong type. | Awareness | Error |
| Azure.Template.ParameterValue | Specify a value for each parameter in template parameter files. | Awareness | Error |
| Azure.Template.TemplateSchema | Use a more recent version of the Azure template schema. | Awareness | Error |
| Azure.Template.TemplateScheme | Use an Azure template file schema with the https scheme. | Awareness | Error |
| Azure.Template.UseComments | Use comments for each resource in ARM template to communicate purpose. | Awareness | Information |
| Azure.Template.UseDescriptions | Use descriptions for each resource in generated template(bicep, psarm, AzOps) to communicate purpose. | Awareness | Information |
| Azure.VM.ASName | Availability Set names should meet naming requirements. | Awareness | Error |
| Azure.VM.DiskName | Managed Disk names should meet naming requirements. | Awareness | Error |
| Azure.VMSS.ComputerName | Virtual Machine Scale Set (VMSS) computer name should meet naming requirements. | Awareness | Error |
| Azure.VMSS.Name | Virtual Machine Scale Set (VMSS) names should meet naming requirements. | Awareness | Error |
| Azure.vWAN.Name | Virtual WAN (vWAN) names should meet naming requirements. | Awareness | Error |
Performance Efficiency
Application capacity
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppService.MinPlan | Use at least a Standard App Service Plan. | Important | Error |
Application scalability
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.PoolScaleSet | Deploy AKS clusters with nodes pools based on VM scale sets. | Important | Error |
| Azure.AKS.StandardLB | Azure Kubernetes Clusters (AKS) should use a Standard load balancer SKU. | Important | Error |
Design for performance
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.VM.SQLServerDisk | Use Premium SSD disks or greater for data and log files for production SQL Server workloads. | Important | Error |
PE:02 Capacity planning
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Search.SKU | Use the basic and standard tiers for entry level workloads. | Critical | Error |
PE:03 Selecting services
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Databricks.SKU | Ensure Databricks workspaces are non-trial SKUs for production workloads. | Critical | Error |
| Azure.Redis.MinSKU | Use Azure Cache for Redis instances of at least Standard C1. | Important | Error |
PE:05 Scaling and partitioning
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.AutoScaling | Use autoscaling to scale clusters based on workload requirements. | Important | Error |
| Azure.AKS.NodeMinPods | Azure Kubernetes Cluster (AKS) nodes should use a minimum number of pods. | Important | Error |
| Azure.AppService.ARRAffinity | Disable client affinity for stateless services. | Awareness | Error |
| Azure.ContainerApp.DisableAffinity | Disable session affinity to prevent unbalanced distribution. | Awareness | Error |
| Azure.Redis.MaxMemoryReserved | Configure maxmemory-reserved to reserve memory for non-cache operations. | Important | Error |
PE:07 Code and infrastructure
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppService.HTTP2 | Use HTTP/2 instead of HTTP/1.x to improve protocol efficiency. | Awareness | Error |
| Azure.VM.AcceleratedNetworking | Use accelerated networking for supported operating systems and VM types. | Important | Error |
| Azure.VM.DiskCaching | Check disk caching is configured correctly for the workload. | Important | Error |
PE:08 Data performance
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.FrontDoor.UseCaching | Use caching to reduce retrieving contents from origins. | Important | Error |
Performance efficiency checklist
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.EphemeralOSDisk | AKS clusters should use ephemeral OS disks which can provide lower read/write latency, along with faster node scaling and cluster upgrades. | Important | Warning |
| Azure.CDN.UseFrontDoor | Use Azure Front Door Standard or Premium SKU to improve the performance of web pages with dynamic content and overall capabilities. | Important | Error |
Reliability
Application design
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppService.AlwaysOn | Configure Always On for App Service apps. | Important | Error |
Best practices
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.VNET.BastionSubnet | VNETs with a GatewaySubnet should have an AzureBastionSubnet to allow for out of band remote access to VMs. | Important | Error |
Data management
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppConfig.PurgeProtect | Consider purge protection for app configuration store to ensure store cannot be purged in the retention period. | Important | Error |
Design
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.RSV.ReplicationAlert | Recovery Services Vaults (RSV) without replication alerts configured may be at risk. | Important | Error |
| Azure.RSV.StorageType | Recovery Services Vaults (RSV) not using geo-replicated storage (GRS) may be at risk. | Important | Error |
| Azure.VNG.ERAvailabilityZoneSKU | Use availability zone SKU for virtual network gateways deployed with ExpressRoute gateway type. | Important | Error |
Health modeling
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.FrontDoor.Probe | Use health probes to check the health of each backend. | Important | Error |
| Azure.FrontDoor.ProbeMethod | Configure health probes to use HEAD requests to reduce performance overhead. | Important | Error |
| Azure.FrontDoor.ProbePath | Configure a dedicated path for health probe requests. | Important | Error |
PE:05 Scaling and partitioning
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.CNISubnetSize | AKS clusters using Azure CNI should use large subnets to reduce IP exhaustion issues. | Important | Error |
RE:01 Simplicity and efficiency
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.NIC.UniqueDns | Network interfaces (NICs) should inherit DNS from virtual networks. | Awareness | Error |
| Azure.NSG.DenyAllInbound | When all inbound traffic is denied, some functions that affect the reliability of your service may not work as expected. | Important | Error |
| Azure.VM.UseManagedDisks | Virtual machines (VMs) should use managed disks. | Important | Error |
RE:04 Target metrics
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.MinSku | The Basic SKU provides limited performance and features for production container registry workloads. | Important | Error |
| Azure.ACR.SoftDelete | Container registry artifacts are permanently lost when accidentally deleted without soft delete protection. | Important | Error |
| Azure.ADX.SLA | Use SKUs that include an SLA when configuring Azure Data Explorer (ADX) clusters. | Important | Error |
| Azure.AKS.MaintenanceWindow | Configure customer-controlled maintenance windows for AKS clusters. | Important | Error |
| Azure.AKS.PoolVersion | AKS node pools should match Kubernetes control plane version. | Important | Error |
| Azure.AKS.UptimeSLA | AKS clusters should have Uptime SLA enabled for a financially backed SLA. | Important | Error |
| Azure.AKS.Version | Older versions of Kubernetes may have known bugs or security vulnerabilities, and may have limited support. | Important | Error |
| Azure.APIM.CertificateExpiry | Renew certificates used for custom domain bindings. | Important | Error |
| Azure.AppConfig.SKU | App Configuration should use a minimum size of Standard. | Important | Error |
| Azure.AppGw.MigrateWAFPolicy | Migrate to Application Gateway WAF policy. | Critical | Error |
| Azure.AppGw.MinInstance | Application Gateways should use a minimum of two instances. | Important | Error |
| Azure.AppService.WebProbe | Configure and enable instance health probes. | Important | Error |
| Azure.AppService.WebProbePath | Configure a dedicated path for health probe requests. | Important | Error |
| Azure.AVD.ScheduleAgentUpdate | Define a windows for agent updates to minimize disruptions to users. | Important | Error |
| Azure.Cosmos.SLA | Use a paid tier to qualify for a Service Level Agreement (SLA). | Important | Error |
| Azure.DataFactory.Version | Consider migrating to DataFactory v2. | Awareness | Error |
| Azure.Grafana.Version | Grafana workspaces should be on Grafana version 10. | Important | Error |
| Azure.LB.StandardSKU | Load balancers should be deployed with Standard SKU for production workloads. | Important | Error |
| Azure.MySQL.MaintenanceWindow | Configure a customer-controlled maintenance window for Azure Database for MySQL servers. | Important | Error |
| Azure.PostgreSQL.MaintenanceWindow | Configure a customer-controlled maintenance window for Azure Database for PostgreSQL servers. | Important | Error |
| Azure.PublicIP.StandardSKU | The basic SKU is being retired on 30 September 2025, and does not include several reliability and security features. | Important | Error |
| Azure.Redis.Version | Azure Cache for Redis should use the latest supported version of Redis. | Important | Error |
| Azure.SignalR.SLA | Use SKUs that include an SLA when configuring SignalR Services. | Important | Error |
| Azure.SQL.MaintenanceWindow | Configure a customer-controlled maintenance window for Azure SQL databases. | Important | Error |
| Azure.SQLMI.MaintenanceWindow | Configure a customer-controlled maintenance window for Azure SQL Managed Instances. | Important | Error |
| Azure.Storage.ContainerSoftDelete | Enable container soft delete on Storage Accounts. | Important | Error |
| Azure.Storage.FileShareSoftDelete | Enable soft delete on Storage Accounts file shares. | Important | Error |
| Azure.Storage.SoftDelete | Enable blob soft delete on Storage Accounts. | Important | Error |
| Azure.VM.ASAlignment | Use availability sets aligned with managed disks fault domains. | Important | Error |
| Azure.VM.BasicSku | Virtual machines (VMs) should not use Basic sizes. | Important | Error |
| Azure.VM.MaintenanceConfig | Use a maintenance configuration for virtual machines. | Important | Error |
| Azure.VM.Standalone | Single instance VMs are a single point of failure, however reliability can be improved by using premium storage. | Important | Error |
| Azure.VNG.ERLegacySKU | Migrate from legacy SKUs to improve reliability and performance of ExpressRoute (ER) gateways. | Critical | Error |
| Azure.VNG.MaintenanceConfig | Use a customer-controlled maintenance configuration for virtual network gateways. | Important | Error |
| Azure.VNG.VPNLegacySKU | Migrate from legacy SKUs to improve reliability and performance of VPN gateways. | Critical | Error |
| Azure.WebPubSub.SLA | Use SKUs that include an SLA when configuring Web PubSub Services. | Important | Error |
RE:05 High-availability multi-region design
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.GeoReplica | Applications or infrastructure relying on a container image may fail if the registry is not available at the time they start. | Important | Error |
| Azure.EntraDS.MinReplicas | Applications or infrastructure relying on a managed domain may fail if the domain is not available. | Important | Error |
| Azure.EntraDS.SKU | The default SKU for Microsoft Entra Domain Services supports resiliency in a single region. | Important | Error |
RE:05 Redundancy
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.MinNodeCount | AKS clusters should have minimum number of system nodes for failover and updates. | Important | Error |
| Azure.AKS.MinUserPoolNodes | User node pools in an AKS cluster should have a minimum number of nodes for failover and updates. | Important | Error |
| Azure.AppConfig.GeoReplica | Replicate app configuration store across all points of presence for an application. | Important | Error |
| Azure.ContainerApp.MinReplicas | Use multiple replicas to remove a single point of failure. | Important | Error |
| Azure.ContainerApp.Storage | Use of Azure Files volume mounts to persistent storage container data. | Awareness | Error |
| Azure.Cosmos.AvailabilityZone | Use zone redundant Cosmos DB accounts in supported regions to improve reliability. | Important | Error |
| Azure.Cosmos.MongoAvailabilityZone | Use zone redundant Cosmos DB vCore clusters in supported regions to improve reliability. | Important | Error |
| Azure.EventHub.AvailabilityZone | Use zone redundant Event Hub namespaces in supported regions to improve reliability. | Important | Error |
| Azure.LB.Probe | Use a specific probe for web protocols. | Important | Error |
| Azure.MICassandra.AvailabilityZone | Use zone redundant Managed Instance for Apache Cassandra clusters in supported regions to improve reliability. | Important | Error |
| Azure.MySQL.UseFlexible | Use Azure Database for MySQL Flexible Server deployment model. | Important | Warning |
| Azure.ServiceBus.GeoReplica | Enhance resilience to regional outages by replicating namespaces. | Important | Error |
| Azure.TrafficManager.Endpoints | Traffic Manager should use at lest two enabled endpoints. | Important | Error |
| Azure.VM.ASDistributeTraffic | Ensure high availability by distributing traffic among members in an availability set. | Important | Error |
| Azure.VM.ASMinMembers | Availability sets should be deployed with at least two virtual machines (VMs). | Important | Error |
| Azure.VNET.FirewallSubnetNAT | Zonal-deployed Azure Firewalls should consider using an Azure NAT Gateway for outbound access. | Awareness | Warning |
| Azure.VNG.VPNActiveActive | Use VPN gateways configured to operate in an Active-Active configuration to reduce connectivity downtime. | Important | Error |
| Azure.VNG.VPNAvailabilityZoneSKU | Use availability zone SKU for virtual network gateways deployed with VPN gateway type. | Important | Error |
RE:05 Regions and availability zones
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.AvailabilityZone | AKS clusters deployed with virtual machine scale sets should use availability zones in supported regions for high availability. | Important | Error |
| Azure.APIM.AvailabilityZone | API Management instances should use availability zones in supported regions for high availability. | Important | Error |
| Azure.APIM.MultiRegion | Enhance service availability and resilience by deploying API Management instances across multiple regions. | Important | Error |
| Azure.AppGw.AvailabilityZone | Application Gateway (App Gateway) should use availability zones in supported regions for improved resiliency. | Important | Error |
| Azure.AppService.AvailabilityZone | Deploy app service plan instances using availability zones in supported regions to ensure high availability and resilience. | Important | Error |
| Azure.ASE.AvailabilityZone | Deploy app service environments using availability zones in supported regions to ensure high availability and resilience. | Important | Error |
| Azure.ContainerApp.AvailabilityZone | Use Container Apps environments that are zone redundant to improve reliability. | Important | Error |
| Azure.Firewall.AvailabilityZone | Deploy firewall instances using availability zones in supported regions to ensure high availability and resilience. | Important | Error |
| Azure.Grafana.AvailabilityZone | Use zone redundant Grafana workspaces in supported regions to improve reliability. | Important | Error |
| Azure.LB.AvailabilityZone | Load balancers deployed with Standard SKU should be zone-redundant for high availability. | Important | Error |
| Azure.Log.Replication | Log Analytics workspaces should have workspace replication enabled to improve service availability. | Important | Error |
| Azure.MySQL.ZoneRedundantHA | Deploy Azure Database for MySQL servers using zone-redundant high availability (HA) in supported regions to ensure high availability and resilience. | Important | Error |
| Azure.PostgreSQL.ZoneRedundantHA | Deploy Azure Database for PostgreSQL servers using zone-redundant high availability (HA) in supported regions to ensure high availability and resilience. | Important | Error |
| Azure.PublicIP.AvailabilityZone | Public IP addresses deployed with Standard SKU should use availability zones in supported regions for high availability. | Important | Error |
| Azure.Redis.AvailabilityZone | Premium Redis cache should be deployed with availability zones for high availability. | Important | Error |
| Azure.RedisEnterprise.Zones | Enterprise Redis cache should be zone-redundant for high availability. | Important | Error |
| Azure.Storage.UseReplication | Storage Accounts using the LRS SKU are only replicated within a single zone. | Important | Error |
| Azure.VMSS.AvailabilityZone | Deploy virtual machine scale set instances using availability zones in supported regions to ensure high availability and resilience. | Important | Error |
RE:06 Data partitioning
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Cosmos.ContinuousBackup | Enable continuous backup on Cosmos DB accounts. | Important | Error |
| Azure.Search.IndexSLA | Use a minimum of 3 replicas to receive an SLA for query and index updates. | Important | Error |
| Azure.Search.QuerySLA | Use a minimum of 2 replicas to receive an SLA for index queries. | Important | Error |
RE:07 Self-preservation
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ContainerApp.HealthProbe | Container app ingress that uses HTTP should have HTTP health probes configured for liveness and readiness checks. | Important | Error |
| Azure.KeyVault.PurgeProtect | Enable Purge Protection on Key Vaults to prevent early purge of vaults and vault items. | Important | Error |
| Azure.KeyVault.SoftDelete | Enable Soft Delete on Key Vaults to protect vaults and vault items from accidental deletion. | Important | Error |
| Azure.VMSS.AutoInstanceRepairs | Applications or infrastructure relying on a virtual machine scale sets may fail if VM instances are unhealthy. | Important | Error |
| Azure.VMSS.ZoneBalance | Deploy virtual machine scale set instances using the best-effort zone balance in supported regions. | Important | Error |
RE:10 Monitoring and alerting
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Monitor.ServiceHealth | Configure Service Health alerts to notify administrators. | Important | Error |
Resiliency and dependencies
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.APIM.MultiRegionGateway | API Management instances should have multi-region deployment gateways enabled. | Important | Error |
| Azure.AppService.PlanInstanceCount | App Service Plan should use a minimum number of instances for failover. | Important | Error |
| Azure.VNET.LocalDNS | Virtual networks (VNETs) should use DNS servers deployed within the same Azure region. | Important | Error |
| Azure.VNET.SingleDNS | Virtual networks (VNETs) should have at least two DNS servers assigned. | Important | Error |
Resource deployment
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Template.LocationDefault | Set the default value for the location parameter within an ARM template to resource group location. | Awareness | Error |
Target and non-functional requirements
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.MariaDB.GeoRedundantBackup | Azure Database for MariaDB should store backups in a geo-redundant storage. | Important | Error |
| Azure.MySQL.GeoRedundantBackup | Azure Database for MySQL should store backups in a geo-redundant storage. | Important | Error |
| Azure.PostgreSQL.GeoRedundantBackup | Azure Database for PostgreSQL should store backups in a geo-redundant storage. | Important | Error |
Security
Authentication
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Automation.ManagedIdentity | Ensure Managed Identity is used for authentication. | Important | Error |
| Azure.FrontDoor.ManagedIdentity | Ensure Front Door uses a managed identity to authorize access to Azure resources. | Important | Error |
| Azure.ML.DisableLocalAuth | Azure Machine Learning compute resources should have local authentication methods disabled. | Critical | Error |
| Azure.SignalR.ManagedIdentity | Configure SignalR Services to use managed identities to access Azure resources securely. | Important | Error |
| Azure.SQLMI.AAD | Use Azure Active Directory (AAD) authentication with Azure SQL Managed Instance. | Critical | Error |
| Azure.SQLMI.ManagedIdentity | Ensure managed identity is used to allow support for Azure AD authentication. | Important | Error |
| Azure.WebPubSub.ManagedIdentity | Configure Web PubSub Services to use managed identities to access Azure resources securely. | Important | Error |
Azure resources
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.Quarantine | Enable container image quarantine, scan, and mark images as verified. | Important | Error |
| Azure.AKS.DefenderProfile | Enable the Defender profile with Azure Kubernetes Service (AKS) cluster. | Important | Error |
Connectivity
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ML.ComputeVnet | Azure Machine Learning Computes should be hosted in a virtual network (VNet). | Critical | Error |
| Azure.ML.PublicAccess | Disable public network access from a Azure Machine Learning workspace. | Critical | Error |
Data protection
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.APIM.EncryptValues | Encrypt all API Management named values with Key Vault secrets. | Important | Error |
| Azure.Automation.EncryptVariables | Azure Automation variables should be encrypted. | Important | Error |
| Azure.MariaDB.UseSSL | Azure Database for MariaDB servers should only accept encrypted connections. | Critical | Error |
| Azure.VM.ADE | Use Azure Disk Encryption (ADE). | Important | Error |
Design
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.APIM.CORSPolicy | Avoid using wildcard for any configuration option in CORS policies. | Important | Error |
| Azure.APIM.PolicyBase | Base element for any policy element in a section should be configured. | Important | Error |
Encryption
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ADX.DiskEncryption | Use disk encryption for Azure Data Explorer (ADX) clusters. | Important | Error |
| Azure.APIM.Protocols | API Management should only accept a minimum of TLS 1.2 for client and backend communication. | Critical | Error |
| Azure.IoTHub.MinTLS | IoT Hubs should reject TLS versions older than 1.2. | Critical | Error |
Identity and access management
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.UseRBAC | Deploy AKS cluster with role-based access control (RBAC) enabled. | Important | Error |
| Azure.Automation.WebHookExpiry | Do not create webhooks with an expiry time greater than 1 year (default). | Awareness | Error |
| Azure.ML.UserManagedIdentity | ML workspaces should use user-assigned managed identity, rather than the default system-assigned managed identity. | Important | Error |
| Azure.RBAC.CoAdministrator | Delegate access to manage Azure resources using role-based access control (RBAC). | Important | Error |
| Azure.RBAC.LimitMGDelegation | Limit Role-Base Access Control (RBAC) inheritance from Management Groups. | Important | Error |
| Azure.RBAC.LimitOwner | Limit the number of subscription Owners. | Important | Error |
| Azure.RBAC.PIM | Use just-in-time (JiT) activation of roles instead of persistent role assignment. | Important | Error |
| Azure.RBAC.UseGroups | Use groups for assigning permissions instead of individual user accounts. | Important | Error |
| Azure.RBAC.UseRGDelegation | Use RBAC assignments on resource groups instead of individual resources. | Important | Error |
| Azure.SQLMI.AADOnly | Ensure Azure AD-only authentication is enabled with Azure SQL Managed Instance. | Important | Error |
Key and secret management
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.SecretStore | Deploy AKS clusters with Secrets Store CSI Driver and store Secrets in Key Vault. | Important | Error |
| Azure.AKS.SecretStoreRotation | Enable autorotation of Secrets Store CSI Driver secrets for AKS clusters. | Important | Error |
Monitor
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Automation.AuditLogs | Ensure automation account audit diagnostic logs are enabled. | Important | Error |
| Azure.ServiceBus.AuditLogs | Ensure namespaces audit diagnostic logs are enabled. | Important | Error |
Network security and containment
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppGw.OWASP | Application Gateway Web Application Firewall (WAF) should use OWASP 3.x rules. | Important | Error |
| Azure.AppGw.Prevention | Internet exposed Application Gateways should use prevention mode to protect backend resources. | Critical | Error |
| Azure.AppGw.WAFRules | Application Gateway Web Application Firewall (WAF) should have all rules enabled. | Important | Error |
| Azure.AppGwWAF.Enabled | Application Gateway Web Application Firewall (WAF) must be enabled to protect backend resources. | Critical | Error |
| Azure.AppGwWAF.Exclusions | Application Gateway Web Application Firewall (WAF) should have all rules enabled. | Critical | Error |
| Azure.AppGwWAF.PreventionMode | Use protection mode in Application Gateway Web Application Firewall (WAF) policies to protect back end resources. | Critical | Error |
| Azure.MariaDB.AllowAzureAccess | Determine if access from Azure services is required. | Important | Error |
Network segmentation
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.VNET.FirewallSubnet | Use Azure Firewall to filter network traffic to and from Azure resources. | Important | Error |
SE:01 Security Baseline
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.ReplicaLocation | The replication location determines the country or region where container images and metadata are stored and processed. | Important | Error |
| Azure.AKS.NodeAutoUpgrade | Operating system (OS) security updates should be applied to AKS nodes and rebooted as required to address security vulnerabilities. | Important | Error |
| Azure.AppConfig.ReplicaLocation | The replication location determines the country or region where configuration data is stored and processed. | Important | Error |
| Azure.EntraDS.ReplicaLocation | The location of a replica set determines the country or region where the data is stored and processed. | Important | Error |
| Azure.Log.ReplicaLocation | The replication location determines the country or region where the data is stored and processed. | Important | Error |
| Azure.Policy.WaiverExpiry | Configure policy waiver exemptions to expire. | Awareness | Error |
| Azure.Resource.AllowedRegions | The deployment location of a resource determines the country or region where metadata and data is stored and processed. | Important | Error |
| Azure.ServiceBus.ReplicaLocation | The replica location determines the country or region where the data is stored and processed. | Important | Error |
SE:02 Secured development lifecycle
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.ContentTrust | Docker content trust allows images to be signed and verified when pulled from a container registry. | Important | Error |
| Azure.ACR.ImageHealth | Remove container images with known vulnerabilities. | Critical | Error |
| Azure.AppService.NETVersion | Configure applications to use newer .NET versions. | Important | Error |
| Azure.AppService.NodeJsVersion | Configure applications to use supported Node.js runtime versions. | Important | Error |
| Azure.AppService.PHPVersion | Configure applications to use newer PHP runtime versions. | Important | Error |
| Azure.Deployment.AdminUsername | A sensitive property set from deterministic or hardcoded values is not secure. | Awareness | Error |
| Azure.Deployment.OuterSecret | Outer evaluation deployments may leak secrets exposed as secure parameters into logs and nested deployments. | Critical | Error |
| Azure.Deployment.OutputSecretValue | Outputting a sensitive value from deployment may leak secrets into deployment history or logs. | Critical | Error |
| Azure.Deployment.SecretLeak | Sensitive parameters that have been not been marked as secure may leak the secret into deployment history or logs. | Critical | Error |
| Azure.Deployment.SecureParameter | Sensitive parameters that have been not been marked as secure may leak the secret into deployment history or logs. | Critical | Error |
| Azure.Deployment.SecureValue | A secret property set from a non-secure value may leak the secret into deployment history or logs. | Critical | Error |
| Azure.ImageBuilder.CustomizeHash | External scripts that are not pinned may be modified to execute privileged actions by an unauthorized user. | Important | Error |
| Azure.ImageBuilder.ValidateHash | External scripts that are not pinned may be modified to execute privileged actions by an unauthorized user. | Important | Error |
| Azure.VM.ScriptExtensions | Custom Script Extensions scripts that reference secret values must use the protectedSettings. | Important | Error |
| Azure.VMSS.ScriptExtensions | Custom Script Extensions scripts that reference secret values must use the protectedSettings. | Important | Error |
SE:04 Segmentation
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AKS.NetworkPolicy | AKS clusters without inter-pod network restrictions may be permit unauthorized lateral movement. | Important | Error |
| Azure.NSG.LateralTraversal | Deny outbound management connections from non-management hosts. | Important | Error |
SE:05 Identity and access management
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.AdminUser | The local admin account allows depersonalized access to a container registry using a shared secret. | Critical | Error |
| Azure.ACR.AnonymousAccess | Anonymous pull access allows unidentified downloading of images and metadata from a container registry. | Important | Error |
| Azure.ADX.ManagedIdentity | Configure Data Explorer clusters to use managed identities to access Azure resources securely. | Important | Error |
| Azure.AI.DisableLocalAuth | Access keys allow depersonalized access to Azure AI using a shared secret. | Important | Error |
| Azure.AI.ManagedIdentity | Configure managed identities to access Azure resources. | Important | Error |
| Azure.AKS.AzureRBAC | Use Azure RBAC for Kubernetes Authorization with AKS clusters. | Important | Error |
| Azure.AKS.LocalAccounts | Enforce named user accounts with RBAC assigned permissions. | Important | Error |
| Azure.AKS.ManagedAAD | Use AKS-managed Azure AD to simplify authorization and improve security. | Important | Error |
| Azure.AKS.ManagedIdentity | Configure AKS clusters to use managed identities for managing cluster infrastructure. | Important | Error |
| Azure.APIM.ManagedIdentity | Configure managed identities to access Azure resources. | Important | Error |
| Azure.APIM.ProductApproval | Configure products to require approval. | Important | Error |
| Azure.APIM.ProductSubscription | Configure products to require a subscription. | Important | Error |
| Azure.AppConfig.DisableLocalAuth | Access keys allow depersonalized access to App Configuration using a shared secret. | Important | Error |
| Azure.AppInsights.LocalAuth | Local authentication allows depersonalized access to store telemetry in Application Insights using a shared identifier. | Critical | Error |
| Azure.AppService.ManagedIdentity | Configure managed identities to access Azure resources. | Important | Error |
| Azure.ContainerApp.ManagedIdentity | Ensure managed identity is used for authentication. | Important | Error |
| Azure.Cosmos.DisableMetadataWrite | Use Entra ID identities for management place operations in Azure Cosmos DB. | Important | Error |
| Azure.Cosmos.MongoEntraID | MongoDB vCore clusters should have Microsoft Entra ID authentication enabled. | Critical | Error |
| Azure.Cosmos.NoSQLLocalAuth | Access keys allow depersonalized access to Cosmos DB NoSQL API accounts using a shared secret. | Critical | Error |
| Azure.EventGrid.DisableLocalAuth | Authenticate publishing clients with Azure AD identities. | Important | Error |
| Azure.EventGrid.ManagedIdentity | Use managed identities to deliver Event Grid Topic events. | Important | Error |
| Azure.EventHub.DisableLocalAuth | Authenticate Event Hub publishers and consumers with Entra ID identities. | Important | Error |
| Azure.KeyVault.AccessPolicy | Use the principal of least privilege when assigning access to Key Vault. | Important | Error |
| Azure.KeyVault.RBAC | Key Vaults should use Azure RBAC as the authorization system for the data plane. | Awareness | Warning |
| Azure.MySQL.AAD | Use Entra ID authentication with Azure Database for MySQL databases. | Critical | Error |
| Azure.MySQL.AADOnly | Ensure Entra ID only authentication is enabled with Azure Database for MySQL databases. | Important | Error |
| Azure.PostgreSQL.AAD | Use Entra ID authentication with Azure Database for PostgreSQL databases. | Critical | Error |
| Azure.PostgreSQL.AADOnly | Ensure Entra ID only authentication is enabled with Azure Database for PostgreSQL databases. | Important | Error |
| Azure.Redis.EntraID | Use Entra ID authentication with cache instances. | Critical | Error |
| Azure.Redis.LocalAuth | Access keys allow depersonalized access to Azure Cache for Redis using a shared secret. | Important | Error |
| Azure.Search.ManagedIdentity | Configure managed identities to access Azure resources. | Important | Error |
| Azure.ServiceBus.DisableLocalAuth | Authenticate Service Bus publishers and consumers with Entra ID identities. | Important | Error |
| Azure.ServiceFabric.AAD | Use Entra ID client authentication for Service Fabric clusters. | Critical | Error |
| Azure.SQL.AAD | Use Entra ID authentication with Azure SQL databases. | Critical | Error |
| Azure.SQL.AADOnly | Ensure Entra ID only authentication is enabled with Azure SQL Database. | Important | Error |
| Azure.Storage.BlobAccessType | Use containers configured with a private access type that requires authorization. | Important | Error |
| Azure.Storage.BlobPublicAccess | Storage Accounts should only accept authorized requests. | Important | Error |
| Azure.Storage.LocalAuth | Access keys allow depersonalized access to Storage Accounts using a shared secret. | Important | Error |
SE:06 Network controls
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.Firewall | Container Registry without restrictions can be accessed from any network location including the Internet. | Important | Error |
| Azure.ADX.PublicAccess | Azure Data Explorer (ADX) clusters should have public network access disabled. | Critical | Error |
| Azure.AI.PrivateEndpoints | Use Private Endpoints to access Azure AI services accounts. | Important | Error |
| Azure.AI.PublicAccess | Restrict access of Azure AI services to authorized virtual networks. | Important | Error |
| Azure.AKS.AuthorizedIPs | Restrict access to API server endpoints to authorized IP addresses. | Important | Error |
| Azure.AKS.HttpAppRouting | Disable HTTP application routing add-on in AKS clusters. | Important | Error |
| Azure.AppGw.UseWAF | Internet accessible Application Gateways should use protect endpoints with WAF. | Critical | Error |
| Azure.AppGw.WAFEnabled | Application Gateway Web Application Firewall (WAF) must be enabled to protect backend resources. | Critical | Error |
| Azure.AppGwWAF.RuleGroups | Application Gateway WAF policies should include both Microsoft Default Rule Set and Bot Manager Rule Set to provide comprehensive protection against web application threats and malicious bot traffic. | Critical | Error |
| Azure.ContainerApp.ExternalIngress | Limit inbound communication for Container Apps is limited to callers within the Container Apps Environment. | Important | Error |
| Azure.ContainerApp.PublicAccess | Ensure public network access for Container Apps environment is disabled. | Important | Error |
| Azure.ContainerApp.RestrictIngress | IP ingress restrictions mode should be set to allow action for all rules defined. | Important | Error |
| Azure.Cosmos.PublicAccess | Azure Cosmos DB should have public network access disabled. | Critical | Error |
| Azure.Databricks.PublicAccess | Azure Databricks workspaces should disable public network access. | Critical | Error |
| Azure.Databricks.SecureConnectivity | Use Databricks workspaces configured for secure cluster connectivity. | Critical | Error |
| Azure.EventGrid.TopicPublicAccess | Use Private Endpoints to access Event Grid topics and domains. | Important | Error |
| Azure.EventHub.Firewall | Access to the namespace endpoints should be restricted to only allowed sources. | Critical | Error |
| Azure.FrontDoor.UseWAF | Enable Web Application Firewall (WAF) policies on each Front Door endpoint. | Critical | Error |
| Azure.FrontDoor.WAF.Enabled | Front Door Web Application Firewall (WAF) policy must be enabled to protect back end resources. | Critical | Error |
| Azure.FrontDoor.WAF.Mode | Use protection mode in Front Door Web Application Firewall (WAF) policies to protect back end resources. | Critical | Error |
| Azure.FrontDoorWAF.Enabled | Front Door Web Application Firewall (WAF) policy must be enabled to protect back end resources. | Critical | Error |
| Azure.FrontDoorWAF.Exclusions | Use recommended rule groups in Front Door Web Application Firewall (WAF) policies to protect back end resources. Avoid configuring rule exclusions. | Critical | Error |
| Azure.FrontDoorWAF.PreventionMode | Use protection mode in Front Door Web Application Firewall (WAF) policies to protect back end resources. | Critical | Error |
| Azure.FrontDoorWAF.RuleGroups | Use recommended rule groups in Front Door Web Application Firewall (WAF) policies to protect back end resources. | Critical | Error |
| Azure.KeyVault.Firewall | Key Vault should only accept explicitly allowed traffic. | Important | Error |
| Azure.LogicApp.LimitHTTPTrigger | Logic Apps using HTTP triggers without restrictions can be accessed from any network location including the Internet. | Critical | Error |
| Azure.MariaDB.FirewallIPRange | Determine if there is an excessive number of permitted IP addresses. | Important | Error |
| Azure.MariaDB.FirewallRuleCount | Determine if there is an excessive number of firewall rules. | Awareness | Error |
| Azure.MySQL.AllowAzureAccess | Determine if access from Azure services is required. | Important | Error |
| Azure.MySQL.FirewallIPRange | Determine if there is an excessive number of permitted IP addresses. | Important | Error |
| Azure.MySQL.FirewallRuleCount | Determine if there is an excessive number of firewall rules. | Awareness | Error |
| Azure.NSG.AnyInboundSource | Network security groups (NSGs) should avoid rules that allow "any" as an inbound source. | Critical | Error |
| Azure.PostgreSQL.AllowAzureAccess | Determine if access from Azure services is required. | Important | Error |
| Azure.PostgreSQL.FirewallIPRange | Determine if there is an excessive number of permitted IP addresses. | Important | Error |
| Azure.PostgreSQL.FirewallRuleCount | Determine if there is an excessive number of firewall rules. | Awareness | Error |
| Azure.Redis.PublicNetworkAccess | Redis cache should disable public network access. | Critical | Error |
| Azure.SQL.AllowAzureAccess | Determine if access from Azure services is required. | Important | Error |
| Azure.SQL.FirewallIPRange | Each IP address in the permitted IP list is allowed network access to any databases hosted on the same logical server. | Important | Error |
| Azure.SQL.FirewallRuleCount | Determine if there is an excessive number of firewall rules. | Awareness | Error |
| Azure.Storage.Firewall | Storage Accounts should only accept explicitly allowed traffic. | Important | Error |
| Azure.VM.PublicIPAttached | Avoid attaching public IPs directly to virtual machines. | Critical | Error |
| Azure.VMSS.PublicIPAttached | Avoid attaching public IPs directly to virtual machine scale set instances. | Critical | Error |
| Azure.VNET.PrivateSubnet | Subnets that allow direct outbound access to the Internet may expose virtual machines to increased security risks. | Critical | Error |
| Azure.VNET.UseNSGs | Virtual network (VNET) subnets should have Network Security Groups (NSGs) assigned. | Critical | Error |
SE:07 Encryption
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.APIM.Ciphers | API Management should not accept weak or deprecated ciphers for client or backend communication. | Critical | Error |
| Azure.APIM.HTTPBackend | Unencrypted communication could allow disclosure of information to an untrusted party. | Critical | Error |
| Azure.APIM.HTTPEndpoint | Unencrypted communication could allow disclosure of information to an untrusted party. | Important | Error |
| Azure.AppGw.SSLPolicy | Application Gateway should only accept a minimum of TLS 1.2. | Critical | Error |
| Azure.AppGw.UseHTTPS | Application Gateways should only expose frontend HTTP endpoints over HTTPS. | Critical | Error |
| Azure.AppService.MinTLS | App Service should not accept weak or deprecated transport protocols for client-server communication. | Critical | Error |
| Azure.AppService.UseHTTPS | Unencrypted communication could allow disclosure of information to an untrusted party. | Important | Error |
| Azure.AppService.WebSecureFtp | Web apps should disable insecure FTP and configure SFTP when required. | Important | Error |
| Azure.CDN.HTTP | Unencrypted communication could allow disclosure of information to an untrusted party. | Important | Error |
| Azure.CDN.MinTLS | Azure CDN endpoints should reject TLS versions older than 1.2. | Important | Error |
| Azure.ContainerApp.Insecure | Ensure insecure inbound traffic is not permitted to the container app. | Important | Error |
| Azure.Cosmos.MinTLS | Cosmos DB accounts should reject TLS versions older than 1.2. | Critical | Error |
| Azure.EntraDS.NTLM | Disable NTLM v1 for Microsoft Entra Domain Services. | Critical | Error |
| Azure.EntraDS.RC4 | Disable RC4 encryption for Microsoft Entra Domain Services. | Critical | Error |
| Azure.EntraDS.TLS | Disable TLS v1 for Microsoft Entra Domain Services. | Critical | Error |
| Azure.EventGrid.DomainTLS | Weak or deprecated transport protocols for client-server communication introduce security vulnerabilities. | Critical | Error |
| Azure.EventGrid.NamespaceTLS | Weak or deprecated transport protocols for client-server communication introduce security vulnerabilities. | Critical | Error |
| Azure.EventGrid.TopicTLS | Weak or deprecated transport protocols for client-server communication introduce security vulnerabilities. | Critical | Error |
| Azure.EventHub.MinTLS | Weak or deprecated transport protocols for client-server communication introduce security vulnerabilities. | Critical | Error |
| Azure.FrontDoor.MinTLS | Front Door Classic instances should reject TLS versions older than 1.2. | Critical | Error |
| Azure.MariaDB.MinTLS | Azure Database for MariaDB servers should reject TLS versions older than 1.2. | Critical | Error |
| Azure.MySQL.MinTLS | MySQL DB servers should reject TLS versions older than 1.2. | Critical | Error |
| Azure.MySQL.UseSSL | Enforce encrypted MySQL connections. | Critical | Error |
| Azure.PostgreSQL.MinTLS | PostgreSQL DB servers should reject TLS versions older than 1.2. | Critical | Error |
| Azure.PostgreSQL.UseSSL | Enforce encrypted PostgreSQL connections. | Critical | Error |
| Azure.Redis.MinTLS | Redis Cache should reject TLS versions older than 1.2. | Critical | Error |
| Azure.Redis.NonSslPort | Azure Cache for Redis should only accept secure connections. | Critical | Error |
| Azure.RedisEnterprise.MinTLS | Redis Cache should reject TLS versions older than 1.2. | Critical | Error |
| Azure.ServiceBus.MinTLS | Service Bus namespaces should reject TLS versions older than 1.2. | Important | Error |
| Azure.ServiceFabric.ProtectionLevel | Node to node communication that is not signed and encrypted may be susceptible to man-in-the-middle attacks. | Important | Error |
| Azure.SQL.MinTLS | Azure SQL Database servers should reject TLS versions older than 1.2. | Critical | Error |
| Azure.SQL.TDE | Use Transparent Data Encryption (TDE) with Azure SQL Database. | Critical | Error |
| Azure.Storage.MinTLS | Storage Accounts should not accept weak or deprecated transport protocols for client-server communication. | Critical | Error |
| Azure.Storage.SecureTransfer | Storage accounts should only accept encrypted connections. | Important | Error |
| Azure.TrafficManager.Protocol | Monitor Traffic Manager web-based endpoints with HTTPS. | Important | Error |
SE:08 Hardening resources
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.ExportPolicy | Export policy on Azure container registry may allow artifact exfiltration. | Important | Error |
| Azure.AKS.AzurePolicyAddOn | Configure Azure Kubernetes Service (AKS) clusters to use Azure Policy Add-on for Kubernetes. | Important | Error |
| Azure.APIM.SampleProducts | API Management Services with default products configured may expose more APIs than intended. | Awareness | Error |
| Azure.AppService.RemoteDebug | Disable remote debugging on App Service apps when not in use. | Important | Error |
| Azure.DNS.DNSSEC | DNS may be vulnerable to several attacks when the DNS clients are not able to verify the authenticity of the DNS responses. | Important | Error |
| Azure.Redis.FirewallIPRange | Determine if there is an excessive number of permitted IP addresses for the Redis cache. | Critical | Error |
| Azure.Redis.FirewallRuleCount | Determine if there is an excessive number of firewall rules for the Redis cache. | Awareness | Error |
| Azure.VM.PublicKey | Linux virtual machines should use public keys. | Important | Error |
| Azure.VM.Updates | Ensure automatic updates are enabled at deployment. | Important | Error |
| Azure.VMSS.PublicKey | Use SSH keys instead of common credentials to secure virtual machine scale sets against malicious activities. | Important | Error |
SE:09 Application secrets
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.AppConfig.SecretLeak | Secrets stored as key values in an App Configuration Store may be leaked to unauthorized users. | Critical | Error |
| Azure.KeyVault.AutoRotationPolicy | Keys that become compromised may be used to spoof, decrypt, or gain access to sensitive data. | Important | Error |
SE:10 Monitoring and threat detection
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.ACR.AuditLogs | Ensure container registry audit diagnostic logs are enabled. | Important | Error |
| Azure.ACR.ContainerScan | Container images or their base images may have vulnerabilities discovered after they are built. | Critical | Error |
| Azure.AKS.AuditLogs | AKS clusters should collect security-based audit logs to assess and monitor the compliance status of workloads. | Important | Error |
| Azure.APIM.DefenderCloud | APIs published in Azure API Management should be onboarded to Microsoft Defender for APIs. | Critical | Error |
| Azure.AppConfig.AuditLogs | Ensure app configuration store audit diagnostic logs are enabled. | Important | Error |
| Azure.Cosmos.DefenderCloud | Enable Microsoft Defender for Azure Cosmos DB. | Critical | Error |
| Azure.Defender.Api | Enable Microsoft Defender for APIs. | Critical | Error |
| Azure.Defender.AppServices | Enable Microsoft Defender for App Service. | Critical | Error |
| Azure.Defender.Arm | Enable Microsoft Defender for Azure Resource Manager (ARM). | Critical | Error |
| Azure.Defender.Containers | Enable Microsoft Defender for Containers. | Critical | Error |
| Azure.Defender.CosmosDb | Enable Microsoft Defender for Azure Cosmos DB. | Critical | Error |
| Azure.Defender.Cspm | Enable Microsoft Defender Cloud Security Posture Management Standard plan. | Critical | Error |
| Azure.Defender.Dns | Enable Microsoft Defender for DNS. | Critical | Error |
| Azure.Defender.KeyVault | Enable Microsoft Defender for Key Vault. | Critical | Error |
| Azure.Defender.OssRdb | Enable Microsoft Defender for open-source relational databases. | Critical | Error |
| Azure.Defender.Servers | Enable Microsoft Defender for Servers. | Critical | Error |
| Azure.Defender.SQL | Enable Microsoft Defender for SQL servers. | Critical | Error |
| Azure.Defender.SQLOnVM | Enable Microsoft Defender for SQL servers on machines. | Critical | Error |
| Azure.Defender.Storage | Enable Microsoft Defender for Storage. | Critical | Error |
| Azure.Defender.Storage.DataScan | Enable sensitive data threat detection in Microsoft Defender for Storage. | Critical | Error |
| Azure.Defender.Storage.MalwareScan | Enable Malware Scanning in Microsoft Defender for Storage. | Critical | Error |
| Azure.DefenderCloud.ActiveAlerts | Alerts that have not received a response may indicate a security issue that requires attention. | Important | Error |
| Azure.Firewall.Mode | Deny high confidence malicious IP addresses and domains on classic managed Azure Firewalls. | Critical | Error |
| Azure.Firewall.PolicyMode | Deny high confidence malicious IP addresses, domains and URLs. | Critical | Error |
| Azure.FrontDoor.Logs | Audit and monitor access through Azure Front Door profiles. | Important | Error |
| Azure.KeyVault.Logs | Ensure audit diagnostics logs are enabled to audit Key Vault access. | Important | Error |
| Azure.SQL.Auditing | Enable auditing for Azure SQL logical server. | Important | Error |
| Azure.SQL.DefenderCloud | Enable Microsoft Defender for Azure SQL logical server. | Important | Error |
| Azure.SQL.VAScan | SQL Databases may have configuration vulnerabilities discovered after they are deployed. | Important | Error |
| Azure.Storage.Defender.DataScan | Enable sensitive data threat detection in Microsoft Defender for Storage. | Critical | Error |
| Azure.Storage.Defender.MalwareScan | Enable Malware Scanning in Microsoft Defender for Storage. | Critical | Error |
| Azure.Storage.DefenderCloud | Enable Microsoft Defender for Storage for storage accounts. | Critical | Error |
SE:12 Incident response
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Defender.SecurityContact | Important security notifications may be lost or not processed in a timely manner when a clear security contact is not identified. | Important | Error |
Security design principles
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.BV.Immutable | Ensure immutability is configured to protect backup data. | Important | Error |
| Azure.RSV.Immutable | Ensure immutability is configured to protect backup data. | Important | Error |
Security operations
| Name | Synopsis | Severity | Level |
|---|---|---|---|
| Azure.Arc.Kubernetes.Defender | Deploy Microsoft Defender for Containers extension for Arc-enabled Kubernetes clusters. | Important | Error |
| Azure.DefenderCloud.Provisioning | Enable auto-provisioning on to improve Microsoft Defender for Cloud insights. | Important | Error |
| Azure.MariaDB.DefenderCloud | Enable Microsoft Defender for Cloud for Azure Database for MariaDB. | Important | Error |
| Azure.MySQL.DefenderCloud | Enable Microsoft Defender for Cloud for Azure Database for MySQL. | Important | Error |
| Azure.PostgreSQL.DefenderCloud | Enable Microsoft Defender for Cloud for Azure Database for PostgreSQL. | Important | Error |