Azure Security Checklist: Score Your Tenant Gaps
A weighted self-assessment for your Azure and Entra estate. Mark 35 controls Done, Partly, Not yet or N/A and see your exposure band, a score for each domain and the gaps to fix first. Each control links the Microsoft Learn page behind it. Answers stay in your browser. To see the design behind the controls, read Secure Azure Architecture; to practise the decisions, try the Azure Hardening Lab.
Weights are PlayCISO judgments, not Microsoft's, and this is not a Defender for Cloud secure score. Answers stay in this browser only; nothing is sent to us.
Identity and applications
Sign-ins, consent, app credentials and revoking access. Benchmark domain: Identity Management.
- Two or more emergency access (break-glass) accounts exist, are used only in emergencies, and their use raises an alert.High impact
- User consent to apps is limited to verified publishers and low-impact permissions (or disabled), with the admin consent workflow on.High impact
- Existing OAuth app consents are reviewed on a schedule, including apps authorised by few users and apps not recently authorised.
- Apps use managed identities or federated credentials; remaining apps use certificates, not client secrets; policies limit secret lifetimes.High impact
- ID Protection risk detections are reviewed and feed alerts, and the team knows which detections need Entra ID P2.
- Legacy (basic) authentication is retired in favour of modern authentication.
- A rehearsed runbook revokes a compromised user: disable, revoke refresh tokens, disable devices.
Privileged access
Who holds powerful roles, at what scope, and for how long. Benchmark domain: Privileged Access.
- Powerful roles are time-bound (just-in-time, just-enough access) instead of standing permissions, including platform-team access at management group scope.High impact
- Workload teams receive RBAC at subscription or resource group scope, not at management group scope.
- Contributor and Owner on subscriptions that hold Key Vaults are tightly controlled and reviewed.
Governance and posture
Management groups, Azure Policy, Defender for Cloud. Benchmark domain: Asset Management; Posture and Vulnerability Management.
- The management group hierarchy is shallow (three to four levels), follows the landing zone pattern, and does not mirror the org chart or environments.
- RBAC authorization is enabled for management group operations, and new subscriptions go to a dedicated default group, not the root.
- Baseline guardrails are Azure Policy assignments at management group scope, with few assignments at the root.High impact
- New policies roll out as audit first, move to deny or remediation once impact is known, and compliance is reviewed.
- Defender for Cloud is on with the Microsoft cloud security benchmark, and recommendations are ordered by risk, not only by score gain.
- Tags are enforced by policy so resources can be inventoried and queried.
Network
NSGs, private paths, central connectivity. Benchmark domain: Network Security.
- No NSG rule allows SSH or RDP from any internet source; admin access uses a path that does not expose management ports.High impact
- NSG rule priorities are reviewed so broad low-number allows do not shadow later denies.
- Production storage, Key Vault and databases use private endpoints, approvals are reviewed, and public access is closed once the private path works.
- Shared network services (firewall, Private DNS, hub connectivity) live in a dedicated connectivity subscription.
Data protection
Storage exposure, keys and secrets, classification, encryption. Benchmark domain: Data Protection.
- Storage accounts disallow anonymous blob access at the account level; truly public content lives in separate accounts.High impact
- Shared Key authorization is disallowed on storage accounts where feasible; apps use Microsoft Entra authorization.
- Key Vaults use Azure RBAC, one vault per application per environment, roles at vault scope with narrow roles.High impact
- Anonymous storage requests are monitored with metrics or logs and alert.
- Data is classified by sensitivity and each class has a confidentiality level that drives access and encryption.
- Data is encrypted at rest, in transit and during processing according to its classification.
Logging and detection
Central logs, SIEM, and alerts that matter. Benchmark domain: Logging and Threat Detection.
- A central Log Analytics workspace exists and policy requires resources to send diagnostic logs to it.High impact
- A SIEM such as Microsoft Sentinel receives identity and Azure platform logs.
- Alerts exist for new consent grants, new credentials on app registrations, and newly registered authentication methods.
Incident response
Plan, roles, rehearsal and lessons. Benchmark domain: Incident Response.
- An incident response plan exists with roles, aligned to the SOC, covering preparation, detection, containment and post-incident work.
- Post-incident reviews run and feed changes to policy, detection and runbooks.
- The identity runbook and the cloud runbook were rehearsed in the last year (tabletop or lab).
Backup, DevOps and testing
Recoverable, tested and scanned. Benchmark domain: Backup and Recovery; DevOps Security.
- Backups are immutable and encrypted, and the recovery environment has the same security as production.
- Pipelines scan dependencies and code for vulnerabilities at build time and runtime.
- Threat modelling and periodic external security testing are part of the cycle.
TL;DRWhat this tool is
5 points
- An interactive Azure security checklist with 35 controls in eight domains that follow the Microsoft cloud security benchmark: identity, privileged access, governance, network, data protection, logging, incident response, and backup, DevOps and testing.
- Mark each control Done, Partly, Not yet or N/A. You get a weighted score, an exposure band, a score per domain and a list of the biggest gaps. N/A items are left out of the maths.
- Each control says why it matters and links the Microsoft Learn page it rests on (read 4 November 2026). Controls that are PlayCISO practice rather than a Microsoft statement are marked.
- Answers stay in your browser (local storage). Nothing is uploaded and no Azure access is needed.
- Using it is free. Markdown and PDF exports of the report need a paid plan.
Frequently asked questions
What is on the Azure security checklist?
35 controls in eight domains: identity and applications, privileged access, governance and posture, network, data protection, logging and detection, incident response, and backup, DevOps and testing. They cover emergency access accounts, user consent, app credentials, management groups, Azure Policy, Defender for Cloud, NSG rules, private endpoints, storage exposure, Key Vault RBAC, central logging and incident response.
How is the score calculated?
Each control has a weight of 1 to 3. Done counts as full weight, Partly as half, Not yet and unanswered as zero. N/A controls are removed from both sides. The score is the weighted points earned divided by the weighted points possible. The exposure band is Low at 80 percent or more, Moderate from 60, High from 40 and Critical below that.
Is this the same as the Defender for Cloud secure score?
No. The weights here are PlayCISO judgments, and this is a self-assessment you answer yourself. The Defender for Cloud secure score aggregates findings from built-in Microsoft cloud security benchmark recommendations that it assesses in your subscriptions. Use this checklist to find process and design gaps, and Defender for Cloud to measure resource configuration.
Does it connect to my Azure tenant?
No. Nothing connects to Azure and no credentials are requested. Your answers are kept in this browser's local storage and are not sent to PlayCISO. Clear them with the Clear all button.
Is it based on the CIS Azure Foundations Benchmark?
It is organised around the Microsoft cloud security benchmark domains and Microsoft Learn guidance, not the CIS Benchmark. It deliberately prints no versioned control numbers from either. For exact CIS recommendation IDs, use the CIS Microsoft Azure Benchmark for the version you assess against.
Can I download the report?
The score and gaps are shown on the page for free. Downloading the report as Markdown or PDF needs a paid plan.
Sources
Read on 4 November 2026. Written in our own words; no Microsoft text is reproduced. The CIS page is listed as a pointer for exact control numbers only.
- Microsoft Learn: Overview of the Microsoft cloud security benchmark v2 (preview)
- Microsoft Learn: Manage emergency access admin accounts in Microsoft Entra ID
- Microsoft Learn: Configure how users consent to applications (Microsoft Entra ID)
- Microsoft Learn: Investigate and remediate risky OAuth apps (Defender for Cloud Apps)
- Microsoft Learn: Security best practices for application properties in Microsoft Entra ID
- Microsoft Learn: Workload identities overview (Microsoft Entra)
- Microsoft Learn: What are risk detections? (Microsoft Entra ID Protection)
- Microsoft Learn: Revoke user access in Microsoft Entra ID
- Microsoft Learn: Cloud Adoption Framework, Management groups (Azure landing zone design area)
- Microsoft Learn: What is Azure Policy?
- Microsoft Learn: Azure Policy definitions effect basics
- Microsoft Learn: Secure score in Defender for Cloud
- Microsoft Learn: Review security recommendations (Defender for Cloud)
- Microsoft Learn: Network security groups overview
- Microsoft Learn: What is a private endpoint?
- Microsoft Learn: Remediate anonymous read access to blob data (Azure Resource Manager deployments)
- Microsoft Learn: Prevent Shared Key authorization for an Azure Storage account
- Microsoft Learn: Grant permission to applications to access an Azure key vault using Azure RBAC
- Microsoft Learn: Security design principles, Azure Well-Architected Framework
- Microsoft Learn: Log Analytics workspace overview
- Microsoft Learn: What is Microsoft Sentinel?
- Center for Internet Security: CIS Microsoft Azure Benchmarks
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.