Skip to main content

Pro audit program · v1.0

Azure Tenant Hardening

Tenant-wide hardening for Azure subscriptions — identity, networking, logging and Defender for Cloud baseline.

  • General target area
  • CIS Azure framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Tenant-wide hardening for Azure subscriptions — identity, networking, logging and Defender for Cloud baseline.

Risks addressed

  • Critical Permanent Global Administrator role abused
  • Critical Storage accounts left publicly accessible
  • High No central monitoring across subscriptions

Controls (6)

  1. Privileged Identity Management for admin roles

    Critical

    Privileged Identity Management (PIM) for administrative roles enforces just-in-time access elevation, time-bound assignments, approval workflows, and comprehensive audit logging for users performing privileged operations. Instead of granting permanent administrative rights, PIM requires users to activate eligible roles through documented justification,…

    How to test + evidence

    Testing procedure: No permanent Global / Privileged Role Admins. JIT via PIM with approval.

    Evidence to collect: PIM config + last 90-day activations.

  2. Conditional Access baseline policies

    High

    Conditional Access baseline policies are pre-configured rulesets in identity platforms (primarily Microsoft Entra ID/Azure AD) that enforce authentication and authorization requirements based on user attributes, device state, location, risk level, and application sensitivity. These policies act as guardrails by automatically…

    How to test + evidence

    Testing procedure: MFA-on-every-sign-in + block legacy auth policies on.

    Evidence to collect: CA policy export.

  3. Defender for Cloud enabled (Standard)

    High

    Microsoft Defender for Cloud Standard tier provides enhanced threat detection, vulnerability assessment, and advanced security monitoring capabilities for Azure resources beyond the free tier. The Standard tier includes workload protection plans such as Defender for Servers, Defender for Storage, Defender…

    How to test + evidence

    Testing procedure: Defender for Cloud Standard tier on critical workloads.

    Evidence to collect: Defender pricing tier screenshot.

  4. Storage accounts: public access disabled

    Critical

    This control requires that all storage accounts (such as Azure Storage, AWS S3, or Google Cloud Storage) be configured to block anonymous public access at the account or bucket/container level. When properly implemented, only authenticated and authorized users or services…

    How to test + evidence

    Testing procedure: Tenant policy denies "Allow Blob public access" by default.

    Evidence to collect: Azure Policy + scan results.

  5. Activity log streamed to Log Analytics

    High

    This control ensures that activity logs from Azure resources are automatically streamed in real-time to Azure Log Analytics workspace for centralized collection, retention, and analysis. The streaming configuration is typically implemented using Azure Diagnostic Settings, which route platform logs (including…

    How to test + evidence

    Testing procedure: Diagnostic settings push activity log + key services to Log Analytics / SIEM.

    Evidence to collect: Diagnostic settings export.

  6. Resource locks on production resources

    Medium

    Resource locks are protective mechanisms applied to critical production infrastructure (virtual machines, databases, networks, storage accounts) to prevent accidental or unauthorized deletion and modification. Locks are typically implemented at the cloud provider level (Azure Resource Manager locks, AWS Service Control…

    How to test + evidence

    Testing procedure: Critical resources have CanNotDelete locks.

    Evidence to collect: Lock list export.