Skip to main content

Pro audit program · v1.0

Azure Tenant Hardening

Tenant-wide hardening for Azure subscriptions — identity, networking, logging and Defender for Cloud baseline.

  • General target area
  • CIS Azure framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Tenant-wide hardening for Azure subscriptions — identity, networking, logging and Defender for Cloud baseline.

Risks addressed

  • Critical Permanent Global Administrator role abused
  • Critical Storage accounts left publicly accessible
  • High No central monitoring across subscriptions

Controls (6)

  1. Privileged Identity Management for admin roles

    Critical

    Privileged Identity Management for admin roles

    How to test + evidence

    Testing procedure: No permanent Global / Privileged Role Admins. JIT via PIM with approval.

    Evidence to collect: PIM config + last 90-day activations.

  2. Conditional Access baseline policies

    High

    Conditional Access baseline policies

    How to test + evidence

    Testing procedure: MFA-on-every-sign-in + block legacy auth policies on.

    Evidence to collect: CA policy export.

  3. Defender for Cloud enabled (Standard)

    High

    Defender for Cloud enabled (Standard)

    How to test + evidence

    Testing procedure: Defender for Cloud Standard tier on critical workloads.

    Evidence to collect: Defender pricing tier screenshot.

  4. Storage accounts: public access disabled

    Critical

    Storage accounts: public access disabled

    How to test + evidence

    Testing procedure: Tenant policy denies "Allow Blob public access" by default.

    Evidence to collect: Azure Policy + scan results.

  5. Activity log streamed to Log Analytics

    High

    Activity log streamed to Log Analytics

    How to test + evidence

    Testing procedure: Diagnostic settings push activity log + key services to Log Analytics / SIEM.

    Evidence to collect: Diagnostic settings export.

  6. Resource locks on production resources

    Medium

    Resource locks on production resources

    How to test + evidence

    Testing procedure: Critical resources have CanNotDelete locks.

    Evidence to collect: Lock list export.