Maester Azure APRL and Custom Controls
Azure checks comprising APRL-mapped recommendations and local custom controls.
| ID | Title | Severity | Product |
|---|---|---|---|
MP.AZR.0001 | Deploy Azure Firewall across multiple availability zones | High |  |
MP.AZR.0002 | Deploy Virtual Machines across availability zones | High | |
MP.AZR.0003 | Ensure Standard Load Balancer is zone-redundant | High | |
MP.AZR.0004 | Ensure Load Balancer backend pool contains at least two instances | High | |
MP.AZR.0005 | Use Standard SKU and zone-redundant Public IP addresses | High | |
MP.AZR.0006 | Ensure Application Gateway autoscale is enabled with minimum capacity >= 2 | Medium | |
MP.AZR.0007 | Ensure storage accounts are zone or region redundant | High | |
MP.AZR.0008 | Enable zone redundancy for Azure Cache for Redis | High | |
MP.AZR.0009 | Ensure Event Hub namespace zone redundancy is enabled | High | |
MP.AZR.0010 | Key vaults should have soft delete enabled | High | |
MP.AZR.0011 | Key vaults should have purge protection enabled | Medium | |
MP.AZR.0012 | Deploy Application Gateway in a zone-redundant configuration | High | |
MP.AZR.0013 | Choose a zone-redundant VPN gateway SKU | High | |
MP.AZR.0015 | Enable Soft Delete for Recovery Services Vaults | Medium | |
MP.AZR.0016 | Configure Cosmos DB accounts with at least two regions | High | |
MP.AZR.0017 | Enable service-managed failover for multi-region Cosmos DB accounts | High | |
MP.AZR.0018 | Deploy AKS cluster node pools across availability zones | High | |
MP.AZR.0019 | Enable Active-Active mode for VPN Gateways | Medium | |
MP.AZR.0020 | Use Standard Load Balancer SKU | High | |
MP.AZR.0021 | Migrate to Application Gateway v2 | High | |
MP.AZR.0022 | Use Health Probes to detect Application Gateway backend availability | High | |
MP.AZR.0023 | Upgrade Basic SKU Public IP addresses to Standard SKU | Medium | |
MP.AZR.0024 | Use Active Geo Replication for Azure SQL databases | High | |
MP.AZR.0025 | Configure Auto Failover Groups for Azure SQL databases | High | |
MP.AZR.0026 | Enable zone redundancy for Azure SQL Database | High | |
MP.AZR.0027 | Configure Service Bus minimum TLS version to 1.2 or higher | High | |
MP.AZR.0028 | Migrate API Management services to Premium SKU to support Availability Zones | High | |
MP.AZR.0029 | Enable Availability Zones on Premium API Management instances | High | |
MP.AZR.0030 | Upgrade API Management platform version to stv2 | High | |
MP.AZR.0031 | Ensure eligible subnets have a Network Security Group associated | Low | |
MP.AZR.0032 | Enable DDoS Protection for Virtual Networks | High | |
MP.AZR.0033 | Use Private Endpoints instead of Service Endpoints for PaaS services | Medium | |
MP.AZR.0034 | Enable Virtual Network Flow Logs | Medium | |
MP.AZR.0035 | Deploy App Service to a staging slot | Low | |
MP.AZR.0036 | Migrate App Service Plan to availability zone support | High | |
MP.AZR.0037 | Use Standard or Premium tier for App Service Plans | High | |
MP.AZR.0038 | Set minimum instance count to 2 for App Service Plans | High | |
MP.AZR.1001 | Enforce the latest TLS version for a storage account | Medium | |
MP.AZR.1002 | Check for Anonymous Public Blob Access | High | |
MP.AZR.1003 | Ensure all Storage Accounts have public network access disabled | High | |
MP.AZR.1004 | Ensure all Key vaults have public network access disabled | High | |
MP.AZR.1005 | Ensure WAF Policy is in Prevention Mode | High | |
MP.AZR.1006 | Ensure SQL Server public network access is disabled | High | |
MP.AZR.1007 | Ensure MySQL Server public network access is disabled | High | |
MP.AZR.1008 | Ensure PostgreSQL Server public network access is disabled | High | |
MP.AZR.1009 | Ensure SQL Managed Instance public data endpoint is disabled | High | |
MP.AZR.1010 | Ensure AKS API server is private | High | |
MP.AZR.1011 | Ensure Cosmos DB public network access is disabled | High | |
MP.AZR.1012 | Ensure Event Hub public network access is disabled | High | |
MP.AZR.1018 | Ensure Azure Bastion is deployed across availability zones | High | |
MP.AZR.1020 | Ensure at least one Cost Management budget has alerts configured | Medium | |
MP.AZR.1021 | Ensure every enabled subscription has at least one budget with alerts configured | Medium | |
MP.AZR.1023 | Identify orphaned Azure resources | Medium | |
MP.AZR.1024 | Ensure management group hierarchy depth does not exceed four levels | Low | |
MP.AZR.1027 | Ensure all subscriptions have activity logs forwarded | High | |
No test matches your search and filters.
Install
Install-MtPack teemukom/maesterpack-azureAssumes Maester is installed. New to Maester? Get started.
Next: connect and run
Connect
Connect-Maester -Service Azure Run
Invoke-Maester -Pack AZR -SkipBuiltIn -SkipGraphConnect