Azure Compliance: NSGs, Storage, SQL, AKS and VM Hygiene
The Azure configuration checks that run across every subscription in a tenant connection, one Resource Graph field per finding.
A tenant-scoped Azure connection in ZopNight discovers every subscription beneath it, so the Azure compliance rules cover the whole estate in one pass. Each reads a property that Azure Resource Graph or the resource API reports, fails closed when the property is absent, and writes a plain finding with fix steps and a portal link. None of them carries a saving.
The most urgent: exposed management ports
Azure NSG Open to Internet has two levels. An NSG rule that exposes SSH on port 22 or RDP on port 3389 to the internet is raised at critical severity; a broader open-to-internet rule on other ports is raised as a general finding. Fact sheet: network security groups.
Storage accounts
Azure Storage Account Public Access Enabled and Azure Storage Account HTTPS Not Enforced read the account’s own flags. Encryption is handled differently on Azure: storage is always encrypted at rest and that cannot be switched off, so the related finding, Azure Storage Account Not Using Customer-Managed Key Encryption, is about key ownership and sits in the security category. See storage accounts.
Azure SQL and Cosmos DB
Azure SQL Database TDE Not Enabled, Azure SQL Database Auditing Not Enabled and Azure SQL Database Threat Detection Not Enabled check each database. Azure Cosmos DB Backup Policy Not Configured covers Cosmos accounts.
AKS
AKS Cluster Network Policy Not Enabled, AKS Cluster RBAC Not Enabled, AKS Cluster API Server Not Private, AKS Cluster Monitoring Not Enabled, AKS Cluster Diagnostic Logging Not Enabled and AKS Node Pool Autoscaler Not Enabled. See AKS clusters.
Virtual machines
- Azure VM Disk Encryption Not Enabled fires only on an explicit customer-managed-key gap or an explicit Azure Disk Encryption “false”. It no longer treats a missing encryption setting as “not encrypted”, because Azure encrypts managed disks by default.
- Azure VM Missing Deletion Protection reads resource locks on the VM.
- Azure VM Backup Not Enabled and Azure Managed Disk Without Backup.
- Azure VM JIT Access Not Enabled, Azure VM Update Management Not Enabled, Azure VM Antimalware Not Enabled, Azure VM Diagnostics Not Enabled and Azure VM Using Unmanaged Disks.
- Azure Production VM Without Availability Set.
Scale sets and web apps
VMSS Autoscale Setting Not Configured, Scaling Target Too High (Azure) and Scaling Cooldown Too Short (Azure), which fires below 120 seconds, can be applied through ZopNight’s autoscaler as a configure or tune action. Azure App Service SSL Not Enforced, Azure App Service Authentication Not Enabled and Azure Function App Deprecated Runtime Version cover web workloads.
A retirement deadline
Azure NSG Flow Logs Past End-of-Life flags flow logs still attached to an NSG rather than a virtual network. Microsoft retires NSG flow logs on September 30, 2027 and will delete the existing NSG flow log resources then, so these need migrating to virtual network flow logs first.
Working the list
Findings export to Excel with their evidence, open as Jira tickets, and are verified by re-reading the same property after you change it. All rules: Azure recommendations. Cross-cloud view: compliance findings. Other Azure categories: discounts, orphans.