azure-security-analyzer

Azure Security Analyzer

Analyze Azure resource configurations against Microsoft security best practices and produce a per-resource security assessment report.

When to Use

• During template generation (invoked by the template generator before deployment confirmation)
• To audit an existing ARM template for security gaps
• When user asks "is this secure?" or "check security" for a deployment
• Post-deployment security review

Verification Integrity Rules (CRITICAL)

Every claim in the security report MUST be verifiable against the ARM template. Never fabricate, assume, or misrepresent security status.

Rule 1: Cite Exact Evidence

Every "✅ Applied" status MUST cite the exact ARM template property path and its value that proves the control is in place. If you cannot point to a specific property in the template JSON, you cannot mark it as applied.

# ✅ CORRECT — cites exact property
| HTTPS-only | 🔴 Critical | ✅ Applied | `properties.httpsOnly: true` | Explicitly set in template |

# ❌ WRONG — no evidence from template
| Disk encryption | 🔴 Critical | ✅ Applied | `managedDisk.storageAccountType` | This property is the performance tier, NOT encryption |

Rule 2: Distinguish Explicit Config vs Platform Defaults

Azure provides some security controls by default (e.g., SSE at rest on managed disks). These are NOT the same as explicitly configured controls.

Status	Icon	Meaning	When to Use
✅ Applied	✅	Explicitly configured in the ARM template	Property exists in template JSON with secure value
🔄 Platform Default	🔄	Azure provides this automatically, NOT in template	Control exists due to Azure platform behavior, not template config
⚠️ Not applied	⚠️	Control is missing and should be considered	Property absent from template, no platform default covers it
❌ Misconfigured	❌	Property exists but set to an insecure value	Property in template with wrong/insecure value

# ✅ CORRECT — distinguishes platform default from explicit config
| SSE at rest (managed disks) | 🟡 Medium | 🔄 Platform Default | Not in template | Azure encrypts all managed disks at rest with platform-managed keys automatically |
| Encryption at host (ADE) | 🟡 Medium | ⚠️ Not applied | `securityProfile.encryptionAtHost` absent | Not enabled — would encrypt temp disks and caches too |

# ❌ WRONG — claims explicit config for a platform default
| Managed disk encryption | 🔴 Critical | ✅ Applied | `managedDisk.storageAccountType` | WRONG: storageAccountType is performance tier, not encryption |

Rule 3: Never Use Misleading Framing

Describe security status accurately and literally. Do not soften or reframe risks.

# ❌ WRONG — misleading framing
| No open SSH to internet | 🔴 Critical | ✅ Applied |
# This is misleading: the VM HAS a public IP with port 22 open.
# IP-restriction reduces risk but port 22 IS internet-reachable.

# ✅ CORRECT — accurate framing
| SSH not open to 0.0.0.0/0 | 🔴 Critical | ✅ Applied | `sourceAddressPrefix: 175.x.x.x/32` | Restricted to single IP |
| VM is internet-facing (public IP + port 22) | 🟠 High | ⚠️ Risk accepted | Public IP attached to NIC | Port 22 reachable from internet (IP-restricted). Safer: Azure Bastion |

Specific rules:

• If a VM has a public IP → it IS internet-facing. Always flag this.
• If any port is open, even IP-restricted → state the port IS open and note the restriction as mitigation, not as "closed."
• If encryption is platform-default → say "platform default", not "applied."
• If a property is absent from the template → say "not configured", not "applied" based on assumptions.

Rule 4: Verify Before Reporting

Before generating the security report, perform this verification checklist:

1. For each "✅ Applied" entry: Search the ARM template JSON for the cited property. If not found → change status.
2. For each security claim: Confirm the ARM property cited actually controls what you claim. (e.g., storageAccountType is NOT encryption)
3. For network exposure: Check if any publicIPAddress resource is attached to a NIC. If yes → VM is internet-facing, period.
4. For encryption claims: Distinguish between SSE (automatic), ADE (explicit extension), and encryption at host (explicit VM property).
5. Cross-check property paths: Use the correct ARM template property paths, not invented or approximate ones.

Rule 5: When Uncertain, Mark as Unknown

If you cannot determine a security status with certainty:

| {check} | {severity} | ❓ Unknown | {property} | Unable to verify — property path unclear or resource type not in checklist |

Never guess. Never fabricate. When in doubt, flag it.

Procedure

1. Extract Resources from Template

Parse the ARM template or requirements to identify all resources and their configurations:

Input: ARM template JSON or resource configuration list

Extract for each resource:
- Resource type (e.g., Microsoft.Storage/storageAccounts)
- Resource name
- All security-relevant properties
- Current configuration values

2. Query Azure MCP Best Practices (Per Resource)

For EACH resource type, query the Azure MCP bestpractices service to get security recommendations:

Tool: mcp_azure_mcp_search
Intent: "bestpractices {resource-type}"

Examples:
- "bestpractices Microsoft.Storage/storageAccounts"
- "bestpractices Microsoft.Web/sites"
- "bestpractices Microsoft.Sql/servers"
- "bestpractices Microsoft.DocumentDB/databaseAccounts"
- "bestpractices Microsoft.KeyVault/vaults"
- "bestpractices Microsoft.ContainerApp/containerApps"

Parse the MCP response for:

• Security recommendations with severity levels
• Configuration best practices
• Compliance alignment notes (CIS, SOC2, PCI-DSS)
• Microsoft Defender for Cloud recommendations

3. Check Resource-Specific Security Properties

Cross-reference MCP recommendations against the template configuration.

Storage Accounts (Microsoft.Storage/storageAccounts):

#	Check	Property	Severity	Secure Value
1	HTTPS-only transfer	supportsHttpsTrafficOnly	🔴 Critical	true
2	TLS 1.2 minimum	minimumTlsVersion	🔴 Critical	TLS1_2
3	Disable public blob access	allowBlobPublicAccess	🟠 High	false
4	Blob soft delete	deleteRetentionPolicy.enabled	🟠 High	true
5	Container soft delete	containerDeleteRetentionPolicy.enabled	🟡 Medium	true
6	Disable shared key access	allowSharedKeyAccess	� High	false
7	Network rules / firewall	networkAcls.defaultAction	🟡 Medium	Deny (prod)
8	Private endpoint	Private endpoint resource	🟡 Medium	Configured (prod)
9	Infrastructure encryption	encryption.requireInfrastructureEncryption	🔵 Low	true
10	Immutability policy	immutableStorageWithVersioning	🔵 Low	Enabled (compliance)

Function Apps / App Services (Microsoft.Web/sites):

#	Check	Property	Severity	Secure Value
1	HTTPS-only	httpsOnly	🔴 Critical	true
2	TLS 1.2 minimum	siteConfig.minTlsVersion	🔴 Critical	1.2
3	Managed identity	identity.type	🔴 Critical	SystemAssigned
4	Identity-based storage access	AzureWebJobsStorage__accountName (not AzureWebJobsStorage)	🔴 Critical	Identity-based
5	RBAC for storage	Role assignments for MI → Storage	🔴 Critical	Storage Blob Data Owner + Storage Account Contributor
6	FTP disabled	siteConfig.ftpsState	🟠 High	Disabled
7	Remote debugging off	siteConfig.remoteDebuggingEnabled	🟠 High	false
8	Latest runtime version	siteConfig.linuxFxVersion or netFrameworkVersion	🟠 High	Latest stable
9	App Insights connected	APPINSIGHTS_INSTRUMENTATIONKEY in appSettings	🟡 Medium	Set
8	Health check enabled	siteConfig.healthCheckPath	🟡 Medium	Set
9	CORS not wildcard	siteConfig.cors.allowedOrigins	🟡 Medium	Not *
10	VNet integration	virtualNetworkSubnetId	🟡 Medium	Configured (prod)
11	IP restrictions	siteConfig.ipSecurityRestrictions	🔵 Low	Configured
12	HTTP/2 enabled	siteConfig.http20Enabled	🔵 Low	true

SQL Servers (Microsoft.Sql/servers):

#	Check	Property	Severity	Secure Value
1	TDE enabled	transparentDataEncryption.status	🔴 Critical	Enabled
2	AAD-only auth	administrators.azureADOnlyAuthentication	🔴 Critical	true
3	Minimal TLS 1.2	minimalTlsVersion	🔴 Critical	1.2
4	Auditing enabled	auditingSettings.state	🟠 High	Enabled
5	Advanced threat protection	securityAlertPolicies.state	🟠 High	Enabled
6	Firewall rules restrictive	firewallRules	🟠 High	No 0.0.0.0/0 (prod)
7	Vulnerability assessment	vulnerabilityAssessments	🟡 Medium	Enabled
8	Private endpoint	Private endpoint resource	🟡 Medium	Configured (prod)
9	Long-term backup retention	backupLongTermRetentionPolicies	🟡 Medium	Configured
10	Connection policy	connectionPolicies.connectionType	🔵 Low	Redirect

Cosmos DB (Microsoft.DocumentDB/databaseAccounts):

#	Check	Property	Severity	Secure Value
1	Firewall configured	ipRules or virtualNetworkRules	🔴 Critical	Not empty
2	Disable key-based metadata writes	disableKeyBasedMetadataWriteAccess	🟠 High	true
3	RBAC-based access	disableLocalAuth	🟠 High	true (prefer RBAC)
4	Continuous backup	backupPolicy.type	🟡 Medium	Continuous
5	Customer-managed keys	`

---

Content truncated.