Infrastructure Security
39 of 55 checks passing
across 31 resources - most resources fail more than one check, so one fix clears several.
Identity vs infrastructure
Unsave posture 73% overall. This page is the Azure resource half - NSGs, storage, Key Vaults, SQL - not Entra.
- criticalNetwork4 resources
Close inbound SSH from the internet
Restrict NSG 22/3389 to known jump hosts.
nsg - highStorage3 resources
Disable public blob access
Set allowBlobPublicAccess = false on storage accounts.
storageaccounts - highKey Vault2 resources
Enable Key Vault purge protection
Turn on purge protection so deleted secrets cannot be purged.
vaults - highDatabase2 resources
Restrict SQL public network access
Disable public endpoint. Use private endpoints.
servers - mediumNetwork5 resources
Enable NSG flow logs
Send flow logs to Log Analytics for the production VNets.
networkwatchers - mediumStorage4 resources
Require HTTPS on storage
Set supportsHttpsTrafficOnly = true.
storageaccounts - mediumLogging3 resources
Diagnostic logs on Key Vaults
Enable audit and allLogs to the central workspace.
vaults - lowGovernance8 resources
Required tags on public IPs
Apply owner and cost-center before the next scan.
publicipaddresses
