![Screenshot 2024-03-12 at 11.34.19 AM.png]](https://cloud-kb.sentinelone.com/hs-fs/hubfs/Screenshot%202024-03-12%20at%2011.34.19%20AM.png?height=40&name=Screenshot%202024-03-12%20at%2011.34.19%20AM.png){kind=small}
Azure Knowledge Base
Security checks and vulnerability fixes for Azure.
Container Registries
Azure Virtual Machines
- Premium SSD Disk Enabled
- Old VM Disk Snapshots
- Low VM Instant Restore Backup Retention Limit
- Scale Sets Autoscale Notifications Disabled
- No Recovery Services Vault
- Premium Data SSD Disk Enabled
- Automatic OS Upgrades Disabled
- VM Undesired SKU Size
- Accelerated Networking Disabled
- Unattached Disk Volumes
- Guest Level Diagnostics Disabled
- Scale Sets Health Monitoring Disabled
- VM Availability Set Disabled
- VM Active Directory (AD) Authentication Disabled
- Virtual Machine Performance Diagnostics Disabled
- VM OS Disk Encryption Disabled
- VM Auto Update Disabled
- VM Backups Disabled
- VM Data Disk Encryption Disabled
- VM Unapproved Extensions
- Disk Volumes BYOK Encryption Disabled
- Empty Scale Sets
- VM Boot Diagnostic Disabled
- Automatic Instance Repairs Disabled
- VM Daily Backup Low Retention Period
Network Security Group
- Open VNC Server
- Open RPC
- Open PostgreSQL
- Open RDP
- Open All Ports
- Open SSH
- Open Oracle Auto Data Warehouse
- No Network Watcher
- Open Hadoop HDFS NameNode WebUI
- Open Docker
- Open MySQL
- Open VNC Client
- Open Telnet
- Open SQLServer
- Open FTP
- Open NetBIOS
- Open Salt
- Open Hadoop HDFS NameNode Metadata Service
- Open SMBoTCP
- Open DNS
- Open SMTP
- Open Oracle
- Open CIFS
- Network Watcher Disabled
- Excessive Security Groups
- Open Kibana
- Restricted Ports Open To Public
- Default Security Group Rules
PostgreSQL
Azure Monitor
- NSG Log Analytics Disabled
- CDN Profile Log Analytics Disabled
- Load Balancer No Diagnostic Settings
- Azure Monitor Logs Disabled
- Load Balancer Log Analytics Disabled
- CDN No Diagnostic Settings
- Log Profile Low Retention Time
- Log Profile Archive Data For Critical Activities
- NSG No Diagnostic Settings
- Log Profile No Retention Policy
- No Log Profile
- Azure Monitor Storage Account Not configured
- Key Vault No Diagnostic Settings
- Azure Monitor No Diagnostic Settings
- Key Vault Log Analytics Disabled
Azure Security Center
SQL Databases
SQL Servers
- SQL Server Public Access
- Azure Active Directory Admin Disabled
- SQL Server Automatic Tuning Disabled
- Audit Retention Policy Limit
- SQL Server Allow Insecure TLS Version
- Auto-Failover Groups Disabled
- Audit Action Groups Disabled
- Server Auditing Disabled
- SQL Server Minimum TLS Version
- TDE Protector Encryption Disabled
- SQL Server Private Endpoints Not Configured
Storage Accounts
- Insecure Network Access Default Action
- Queue Service All Access ACL
- Storage Account Encryption Disabled
- Storage Accounts Without HTTPS-Only
- Trusted MS Access Disabled
- Log Container Public Access
- Log Storage Encryption Disabled
- Blob Container Public Access
- Blob Service Encryption Disabled
- Blob Service Not Immutable
- Blobs Soft Deletion Disabled