Azure Cloud Security Assessment Checklist

A practical Azure cloud security assessment checklist aligned with the CIS Microsoft Azure Foundations Benchmark: what to check in identity, networking, data and logging, and how to rank what you find.

This Azure cloud security assessment checklist follows the structure of the CIS Microsoft Azure Foundations Benchmark and Microsoft’s own security guidance. Use it to review your tenant, or to know what a professional assessment should cover.

What is an Azure security assessment checklist?

An Azure cloud security assessment checklist lists configuration checks across identity, access control, Defender for Cloud, networking, data services and logging that together describe a secure baseline. Working through it shows which misconfigurations exist and which to fix first.

The checks are aligned with the CIS Microsoft Azure Foundations Benchmark, published by the Center for Internet Security on cisecurity.org. Control numbering changes between versions, so confirm the current version for exact IDs. We describe each check in plain language instead.

How do you use an Azure cloud security assessment checklist?

Use read-only access, review identity first, then access control, Defender for Cloud, networking, data and logging, and rank findings by exploitability. Use scanners such as Prowler or ScoutSuite for breadth, and read the results by hand.

Grant yourself the built-in Reader and Security Reader roles on the subscriptions, and Global Reader in Microsoft Entra ID, so nothing can be changed by accident.

1. Identity (Microsoft Entra ID)

In Azure, identity is the perimeter, so start here.

• MFA is required for all users, and always for administrators. Use Conditional Access policies where your licence allows it, or Microsoft’s security defaults if it does not. Test with a break-glass account excluded.
• Privileged roles are few, and just-in-time where possible. Count your Global Administrators and keep them to the minimum your organisation needs. Use Privileged Identity Management to make high roles eligible rather than permanent.
• Legacy authentication is blocked. Older protocols cannot do MFA, so attackers use them for password spraying. Block them with a Conditional Access policy.
• Guest users are reviewed. List external accounts, remove those without a business reason, and use access reviews to repeat the check.
• Break-glass accounts exist and are monitored. Two emergency administrator accounts with strong credentials, excluded from Conditional Access, and with sign-in alerts so any use is noticed.
• App registrations and service principals are reviewed. Look for secrets that never expire, owners who have left, and application permissions that grant more than the app needs.

2. Access control on Azure resources

Who can do what, and where.

• Role assignments follow least privilege. Review Owner and Contributor assignments at management group, subscription and resource group level. Prefer built-in roles scoped as narrowly as possible.
• No permanent Owner for people who rarely need it. Use eligible assignments and approval for elevation.
• Managed identities replace stored credentials. Where applications run in Azure, let them use managed identities instead of secrets in configuration files.
• Azure Policy enforces the baseline. Policies for allowed regions, required tags and denied public endpoints stop drift at the source.

3. Microsoft Defender for Cloud

The tool is useful only if it is configured and read.

• Defender plans are enabled for the resource types you run. Servers, storage, databases, containers and Key Vault each have their own plan. Some are off by default and some are billed per resource, so decide deliberately.
• Secure Score recommendations are triaged. Do not chase the number. Sort recommendations by exposure and exploitability and assign owners.
• Security contact and alert notifications are set. Alerts that go to an unmonitored mailbox are the same as no alerts.

4. Networking

Reduce what the internet can reach.

• No network security group allows RDP or SSH from any source. Use Azure Bastion or just-in-time VM access instead of open management ports.
• Public IPs are intentional. Inventory every public IP and load balancer and confirm each is needed.
• Flow logs and traffic analytics are enabled for production networks. They are the evidence you need during an incident. Use the flow log type Microsoft currently supports for your virtual networks.
• Private endpoints for sensitive services. Storage, Key Vault and databases should be reachable over private endpoints where practical.

5. Data services

Public or unencrypted data is the most visible failure.

• Storage accounts disable anonymous blob access. Turn off public access at account level, require secure transfer and set a minimum TLS version.
• Shared access signatures are limited. Prefer Microsoft Entra authorisation over account keys and long-lived SAS tokens.
• Key Vault has soft delete and purge protection. Both stop an attacker, or a mistake, from permanently destroying keys. Use RBAC for access.
• Azure SQL has auditing on and no open firewall rules. Avoid rules that allow every address, and enable transparent data encryption and auditing.
• Backups are tested. A restore you have never tried is an assumption.

6. Logging and monitoring

Keep the evidence somewhere an attacker cannot reach.

• The Activity Log is exported with a retention period that fits your needs. Send it to a Log Analytics workspace or storage account through diagnostic settings.
• Diagnostic settings cover every subscription, not only the first. Use Azure Policy to deploy them automatically to new resources.
• Microsoft Sentinel or another SIEM receives the key logs. Sign-in logs, audit logs and activity logs at a minimum.
• Alerts exist for high-signal events. Role assignment changes, policy changes, network security group changes and Key Vault access are good starting points.

How do you prioritise Azure cloud security assessment checklist findings?

When the Azure cloud security assessment checklist is done, fix anything that lets an outsider in first, then anything that lets a compromised account escalate, then gaps in logging. Rank by exploitability and exposure. An administrator without MFA outranks a missing resource tag every time.

1. Identity: MFA, legacy authentication, standing administrators, risky guests.
2. Public exposure: open management ports, anonymous storage, public databases.
3. Detection: Defender plans, logging and alerts.
4. Encryption, Key Vault and backups.
5. Governance and hygiene.

What mistakes make an Azure cloud security assessment checklist miss things?

The usual ones are reviewing a single subscription, ignoring the tenant, trusting the Secure Score as the result, and fixing items in list order instead of risk order. Each leaves real exposure behind a reassuring dashboard.

• One subscription only. Larger organisations have many, and the forgotten ones are the weakest. List every subscription under the tenant first.
• Skipping Microsoft Entra ID. Subscription settings do not matter if an attacker holds a Global Administrator account.
• Chasing the score. Cheap recommendations raise the number quickly while serious exposure remains.
• No follow-up. Use Azure Policy and access reviews so fixes stay fixed.

Why does Defender for Cloud not replace an assessment?

Defender for Cloud gives you a Secure Score and recommendations, but it does not know your business. It cannot tell you which items matter for your data, in which order to fix them, or whether anyone acts on its alerts. An assessment adds that judgement.

Should you do this yourself or hire an assessor?

Do a first pass yourself if you have an engineer with time, and bring in an assessor for independent evidence, speed or a second opinion. Teams tend to miss what they see every day, and customers and auditors give more weight to an independent report.

Our Azure security assessment covers every area above and delivers a severity-ranked report with exact fixes, quoted at a fixed price after a free call. See how we price, or read the AWS version of this list, the AWS security audit checklist.

The bottom line

Treat this Azure cloud security assessment checklist as a routine you repeat after every major change. Most Azure security problems are ordinary: administrators without MFA, standing Owner roles, open management ports, anonymous storage, and logs nobody reads. A disciplined pass through identity, access, Defender, networking, data and logging finds nearly all of them. Book a free 20-minute assessment if you would like us to run it for you.

Last updated: 11 October 2026 · Written by AegisElligent.