Record and synchronize details for the Azure Active Directory application into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Turbot CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

Azure > Active Directory > Application

Azure > Active Directory > Application > CMDB

Discover all Azure Active Directory application resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/v5/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > Active Directory > Directory

Azure > Active Directory > Application > Discovery

&#92;nThe Active control determines whether the resource is in active use. When running an automated compliance&#92;nenvironment, it&#39;s common to end up with a wide range of alarms that are difficult&#92;nand time consuming to clear. The Active control brings automated, well-defined&#92;ncontrol to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; Active Directory &gt; Client Secret &gt; Active &gt; *`) and&#92;nraises an alarm. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;nSee [Active](https://turbot.com/v5/docs/concepts/guardrails/active) for more information.&#92;n

Azure > Active Directory > Client Secret

Azure > Active Directory > Client Secret > Active

Azure > Active Directory > Client Secret > Active > Age

Take an action when an Azure Active Directory client secret is not approved based on `Azure &gt; Active Directory &gt; Client Secret &gt; Approved &gt; * policies`.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm.&#92;n&#92;nSee [Approved](https://turbot.com/v5/docs/concepts/guardrails/approved) for more information.&#92;n

Azure > Active Directory > Client Secret > Approved

Azure > Active Directory > Client Secret > Approved > Custom

Azure > Active Directory > Client Secret > Approved > Usage

Record and synchronize details for the Azure Active Directory client secret into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Turbot CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nThis control will automatically re-run every 24 hours because Azure does not currently support real-time events for this resource type.&#92;n

Azure > Active Directory > Client Secret > CMDB

Discover all Azure Active Directory client secret resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/v5/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nThis control will automatically re-run every 24 hours because Azure does not currently support real-time events for this resource type.&#92;n

Azure > Active Directory > Client Secret > Discovery

&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm.&#92;n&#92;nSee [Approved](https://turbot.com/v5/docs/concepts/guardrails/approved) for more information.&#92;n

Azure > Active Directory > Custom Domain

Azure > Active Directory > Custom Domain > Approved

Azure > Active Directory > Custom Domain > Approved > Usage

Record and synchronize details for the Azure Active Directory custom domain into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Turbot CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n&#92;nThis control will automatically re-run every 24 hours because Azure does not currently support real-time events for this resource type.&#92;n

Azure > Active Directory > Custom Domain > CMDB

Discover all Azure Active Directory custom domain resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/v5/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control.&#92;n&#92;nThis control will automatically re-run every 24 hours because Azure does not currently support real-time events for this resource type.&#92;n

Azure > Active Directory > Custom Domain > Discovery

Record and synchronize details for the Azure active directory user into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.cloud/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Turbot CMDB.&#92;n&#92;nNote that if CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

Azure > Active Directory > Directory > CMDB

Discover all Azure active directory resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > Tenant

Azure > Active Directory > Directory > Discovery

The Turbot Azure Directory Poller control will query the Activity Log for relevant events on a schedule, and forward them to the router for processing.&#92;n

Azure > Turbot

Azure > Turbot > Directory Event Poller

Azure > Turbot > Directory Event Poller > Interval

Azure > Turbot > Directory Event Poller > Window

Record and synchronize details for the Azure active directory group into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.cloud/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Turbot CMDB.&#92;n&#92;nNote that if CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

Azure > Active Directory > Group

Azure > Active Directory > Group > CMDB

Discover all Azure active directory group resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > Active Directory > Group > Discovery

Record and synchronize details for the Azure Active Directory service principal into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control is&#92;nresponsible for populating and updating all the attributes for that&#92;nresource type in the Turbot CMDB.&#92;n&#92;n**Note:** If CMDB is set to Skip for a resource, then it will not be added&#92;nto the CMDB, and no controls that target it will run.&#92;n

Azure > Active Directory > Service Principal

Azure > Active Directory > Service Principal > CMDB

Discover all Azure Active Directory service principal resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/v5/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > Active Directory > Service Principal > Discovery

Take an action when an Azure Active Directory user is not approved based on `Azure &gt; Active Directory &gt; User &gt; Approved &gt; * policies`.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Azure > Active Directory > User

Azure > Active Directory > User > Approved

Azure > Active Directory > User > Approved > Custom

Azure > Active Directory > User > Approved > Usage

Azure > Active Directory > User > Approved > User Types

Azure > Active Directory > User > CMDB

Discover all Azure active directory user resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/docs/concepts/guardrails/cmdb) control.&#92;n

Azure > Active Directory > User > Discovery

activeDirectory

application

applicationAka

App ID

applicationServiceNow

clientSecret

clientSecretAka

clientSecretServiceNow

turbot.com

customDomain

customDomainAka

customDomainServiceNow

cdffd708-7da0-4cea-abeb-0a4cabcd1234

directoryAka

directoryServiceNow

invalid - missing required property groupPrincipalName

group

groupAka

groupServiceNow

objectId

servicePrincipal

servicePrincipalAka

servicePrincipalServiceNow

Product Marketing Manager

invalid - missing required property userPrincipalName

user

userAka

userPrincipalName

userServiceNow

azure-activedirectory

Configure whether to record and synchronize details for the Azure active directory application into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB. All policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

&#92;nThe control determines whether the resource is in active use. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; Active Directory &gt; Client Secret &gt; Active &gt; *`) and raises an alarm. Each Active sub-policy can calculate a status of active, inactive&#92;nor skipped. Generally, if the resource appears to be Active for any reason&#92;nit will be considered Active.&#92;n&#92;nSee [Active](https://turbot.com/v5/docs/concepts/guardrails/active) for more information.&#92;n

The age after which the Azure Active Directory client secret&#92;nis no longer considered active. If a create time is unavailable, the time Turbot discovered the resource is used.&#92;n&#92;nThe [Active](https://turbot.com/v5/docs/concepts/guardrails/active)&#92;ncontrol determines whether the resource is in active use. When running an automated&#92;ncompliance environment, it&#39;s common to end up with a wide range of alarms&#92;nthat are difficult and time consuming to clear. The Active control brings&#92;nautomated, well-defined control to this process.&#92;n&#92;nThe Active control checks the status of all defined Active policies for the&#92;nresource (`Azure &gt; Active Directory &gt; Client Secret &gt; Active &gt; *`) and&#92;nraises an alarm. Each Active sub-policy can calculate a status of active, inactive or skipped. Generally,&#92;nif the resource appears to be Active for any reason it will be considered Active.&#92;n&#92;nSee [Active](https://turbot.com/v5/docs/concepts/guardrails/active) for more information.&#92;n

Determine the action to take when an Azure Active Directory client secret is not approved based on `Azure &gt; Active Directory &gt; Client Secret &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm.&#92;n&#92;nSee [Approved](https://turbot.com/v5/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the Azure Active Directory client secret is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure Active Directory client secret is not approved, it will be subject to the action specified in the `Azure &gt; Active Directory &gt; Client Secret &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/v5/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

string

Determine whether the Azure Active Directory client secret is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If an Azure Active Directory client secret is not approved, it will be subject to the action specified in the `Azure &gt; Active Directory &gt; Client Secret &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/v5/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the Azure Active Directory client secret into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB.&#92;nAll policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Determine whether the Azure Active Directory custom domain is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If an Azure Active Directory custom domain is not approved, it will be subject to the action specified in the `Azure &gt; Active Directory &gt; Custom Domain &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/v5/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the Azure Active Directory custom domain into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB.&#92;nAll policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Configure whether to record and synchronize details for Azure AD into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.cloud/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB.&#92;n&#92;nNote that if CMDB is set to Skip for a resource, then it will not be added to the CMDB, and no controls that target it will run.&#92;n

Turbot > Folder

Configure the Azure Directory Event Poller.  When set to `Enabled`, the poller will&#92;nrun at the interval specified to retrieve the latest events and forward&#92;nthem to the Turbot Router.&#92;n

The polling interval. This policy determines how often the event poller will run.&#92;n

The polling window, in minutes.  This policies determines the oldest&#92;nevents the event poller will retrieve.  For example, setting the window&#92;nto &#39;5 minutes&#39; will cause the poller to retrieve all events from&#92;nthe previous 5 minutes every time it runs.&#92;n&#92;nThe Window must be greater than the Interval, and it is recommended&#92;nto be at least twice the Interval.  For example, if the Interval&#92;nis &#39;Every 5 Minutes&#39;, the Window should be at least &#39;10 Minutes&#39;.&#92;n

Configure whether to record and synchronize details for the Azure active directory group into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB. All policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Configure whether to record and synchronize details for the Azure Active Directory service principal into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/v5/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB.&#92;nAll policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Determine the action to take when an Azure Active Directory user is not approved based on `Azure &gt; Active Directory &gt; User &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

azure_activedirectory_user_approved

Azure CIS v2.0.0 - Section 1 - IAM

Determine whether the Azure Active Directory user is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure Active Directory user is not approved, it will be subject to the action specified in the `Azure &gt; Active Directory &gt; User &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

azure_activedirectory_user_approved_custom

Determine whether the Azure Active Directory user is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If an Azure Active Directory user is not approved, it will be subject to the action specified in the `Azure &gt; Active Directory &gt; User &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

Determine whether the Azure Active Directory user type is allowed to exist.&#92;n&#92;nThis policy will be evaluated by the Approved control. If an Azure active directory user is not approved, it will be subject to the action specified in the `Azure &gt; Active Directory &gt; User &gt; Approved` policy.&#92;n&#92;nSee [Approved](https://turbot.com/v5/docs/concepts/guardrails/approved) for more information.&#92;n

Configure whether to record and synchronize details for the Azure active directory user into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Turbot CMDB. All policies and controls in Turbot are based around the resource, so usually the CMDB policy is set to **&quot;Enforce: Enabled&quot;**.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

Azure

Azure > Active Directory

Azure > Active Directory > Application > ServiceNow

Azure > Active Directory > Application > ServiceNow > Configuration Item

Azure > Active Directory > Application > ServiceNow > Configuration Item > Record

Azure > Active Directory > Client Secret > ServiceNow

Azure > Active Directory > Client Secret > ServiceNow > Configuration Item

Azure > Active Directory > Client Secret > ServiceNow > Configuration Item > Record

Azure > Active Directory > Custom Domain > ServiceNow

Azure > Active Directory > Custom Domain > ServiceNow > Configuration Item

Azure > Active Directory > Custom Domain > ServiceNow > Configuration Item > Record

Azure > Active Directory > Directory > ServiceNow

Turbot

Azure > CIS v1 > 1 Identity and Access Management > 1.01 Ensure that multi-factor authentication is enabled for all privileged users (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.02 Ensure that multi-factor authentication is enabled for all non- privileged users (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.04 Ensure that &#39;Allow users to remember multi-factor authentication on devices they trust&#39; is &#39;Disabled&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.05 Ensure that &#39;Number of methods required to reset&#39; is set to &#39;2&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.06 Ensure that &#39;Number of days before users are asked to re-confirm their authentication information&#39; is not set to &quot;0&quot; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.07 Ensure that &#39;Notify users on password resets?&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.08 Ensure that &#39;Notify all admins when other admins reset their password?&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.09 Ensure that &#39;Users can consent to apps accessing company data on their behalf&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.10 Ensure that &#39;Users can add gallery apps to their Access Panel&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.11 Ensure that &#39;Users can register applications&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.12 Ensure that &#39;Guest user permissions are limited&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.13 Ensure that &#39;Members can invite&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.14 Ensure that &#39;Guests can invite&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.15 Ensure that &#39;Restrict access to Azure AD administration portal&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.16 Ensure that &#39;Self-service group management enabled&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.17 Ensure that &#39;Users can create security groups&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.18 Ensure that &#39;Users who can manage security groups&#39; is set to &#39;None&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.19 Ensure that &#39;Users can create Office 365 groups&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.20 Ensure that &#39;Users who can manage Office 365 groups&#39; is set to &#39;None&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.21 Ensure that &#39;Enable &quot;All Users&quot; group&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1 > 1 Identity and Access Management > 1.22 Ensure that &#39;Require Multi-Factor Auth to join devices&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.01 - Ensure that multi-factor authentication is enabled for all privileged users (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.02 - Ensure that multi-factor authentication is enabled for all non- privileged users (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.04 - Ensure that &#39;Allow users to remember multi-factor authentication on devices they trust&#39; is &#39;Disabled&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.05 - Ensure that &#39;Number of methods required to reset&#39; is set to &#39;2&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.06 - Ensure that &#39;Number of days before users are asked to re-confirm their authentication information&#39; is not set to &quot;0&quot; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.07 - Ensure that &#39;Notify users on password resets?&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.08 - Ensure that &#39;Notify all admins when other admins reset their password?&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.09 - Ensure that &#39;Users can consent to apps accessing company data on their behalf&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.10 - Ensure that &#39;Users can add gallery apps to their Access Panel&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.11 - Ensure that &#39;Users can register applications&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.12 - Ensure that &#39;Guest user permissions are limited&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.13 - Ensure that &#39;Members can invite&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.14 - Ensure that &#39;Guests can invite&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.15 - Ensure that &#39;Restrict access to Azure AD administration portal&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.16 - Ensure that &#39;Restrict user ability to access groups features in the Access Pane&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.17 - Ensure that &#39;Users can create security groups&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.18 - Ensure that &#39;Owners can manage group membership requests in the Access Panel&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.19 - Ensure that &#39;Users can create Office 365 groups&#39; is set to &#39;No&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.20 - Ensure that &#39;Require Multi-Factor Auth to join devices&#39; is set to &#39;Yes&#39; (Not Scored)

Azure > CIS v1.2 > 1 - Identity and Access Management > 1.22 - Ensure Security Defaults is enabled on Azure Active Directory (Not Scored)

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.01 - Ensure Security Defaults is enabled on Azure Active Directory

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.02 Ensure that &#39;Multi-Factor Auth Status&#39; is &#39;Enabled&#39; for all Privileged Users

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.03 Ensure that &#39;Multi-Factor Auth Status&#39; is &#39;Enabled&#39; for all Non-Privileged Users

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.01 - Security Defaults > 1.01.04 Ensure that &#39;Allow users to remember multi-factor authentication on devices they trust&#39; is Disabled

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.01 - Ensure Trusted Locations Are Defined

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.02 - Ensure that an exclusionary Geographic Access Policy is considered

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.03 - Ensure that A Multi-factor Authentication Policy Exists for Administrative Groups

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.04 - Ensure that A Multi-factor Authentication Policy Exists for All Users

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.05 - Ensure Multi-factor Authentication is Required for Risky Sign-ins

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.02 - Conditional Access > 1.02.06 - Ensure Multi-factor Authentication is Required for Azure Management

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.03 - Ensure that &#39;Users can create Azure AD Tenants&#39; is set to &#39;No&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.04 - Ensure Access Review is Set Up for External Users in Azure AD Privileged Identity Management

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.06 Ensure That &#39;Number of methods required to reset&#39; is set to &#39;2&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.07 - Ensure that a Custom Bad Password List is set to &#39;Enforce&#39; for your Organization

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.08 Ensure that &#39;Number of days before users are asked to re-confirm their authentication information&#39; is not set to &#39;0&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.09 Ensure that &#39;Notify users on password resets?&#39; is set to &#39;Yes&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.10 Ensure That &#39;Notify all admins when other admins reset their password?&#39; is set to &#39;Yes&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.11 - Ensure `User consent for applications` is set to `Do not allow user consent`

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.12 Ensure &#39;User consent for applications&#39; Is Set To &#39;Allow for Verified Publishers&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.13 Ensure that &#39;Users can add gallery apps to My Apps&#39; is set to &#39;No&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.14 - Ensure That &#39;Users Can Register Applications&#39; Is Set to &#39;No&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.15 Ensure That &#39;Guest users access restrictions&#39; is set to &#39;Guest user access is restricted to properties and memberships of their own directory objects&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.16 Ensure that &#39;Guest invite restrictions&#39; is set to &quot;Only users assigned to specific admin roles can invite guest users&quot;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.17 Ensure That &#39;Restrict access to Azure AD administration portal&#39; is Set to &#39;Yes&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.18 Ensure that &#39;Restrict user ability to access groups features in the Access Pane&#39; is Set to &#39;Yes&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.19 - Ensure that &#39;Users can create security groups in Azure portals, API or PowerShell&#39; is set to &#39;No&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.20 Ensure that &#39;Owners can manage group membership requests in the Access Panel&#39; is set to &#39;No&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.21 Ensure that &#39;Users can create Microsoft 365 groups in Azure portals, API or PowerShell&#39; is set to &#39;No&#39;

Azure > CIS v2.0 > 01 - Identity and Access Management > 1.22 Ensure that &#39;Require Multi-Factor Authentication to register or join devices with Azure AD&#39; is set to &#39;Yes&#39;

Azure > Active Directory > Directory > ServiceNow > Configuration Item

Azure > CIS v1 > Maximum Attestation Duration

Azure > CIS v1

Azure > CIS v1 > 1 Identity and Access Management > 1.01 Ensure that multi-factor authentication is enabled for all privileged users (Not Scored) > Attestation

Azure > CIS v1 > 1 Identity and Access Management > 1.02 Ensure that multi-factor authentication is enabled for all non- privileged users (Not Scored) > Attestation

Azure > CIS v1 > 1 Identity and Access Management > 1.04 Ensure that &#39;Allow users to remember multi-factor authentication on devices they trust&#39; is &#39;Disabled&#39; (Not Scored) > Attestation

Azure > CIS v1 > 1 Identity and Access Management > 1.05 Ensure that &#39;Number of methods required to reset&#39; is set to &#39;2&#39; (Not Scored) > Attestation

Mod: azure-activedirectory

Recommended Version

Resource Types

Controls

Policies

Policy Packs