Azure checks in Varman
Read-only monitoring of security posture, identity, network, and compliance in Microsoft Azure. Varman runs 14 checks against Azure on a schedule and records each result as evidence.
Storage: HTTPS and TLS 1.2 enforced
Verify storage accounts enforce HTTPS-only traffic and a minimum TLS version of 1.2.
Storage: no public access
Verify storage accounts disable anonymous blob access and public network access.
Storage: encryption at rest enabled
Verify storage accounts have blob and file service encryption enabled.
SQL Database: TLS 1.2 enforced
Verify SQL Servers require a minimum TLS version of 1.2.
SQL Database: no public access
Verify SQL Servers disable public network access and have no wide-open firewall rules.
SQL Database: auditing enabled
Verify SQL Servers have auditing enabled to track database operations.
Database for MySQL: TLS 1.2 enforced
Verify Azure Database for MySQL Flexible Servers require secure transport and a minimum TLS version of 1.2.
Database for PostgreSQL: TLS 1.2 enforced
Verify Azure Database for PostgreSQL Flexible Servers require secure transport and a minimum TLS version of 1.2.
Key Vault: soft delete, purge protection, no public access
Verify Key Vaults enable soft delete and purge protection and restrict public network access.
Key Vault: RBAC authorization
Verify Key Vaults use Azure RBAC instead of legacy vault access policies.
Network: no NSG ports open to the internet
Flags NSG inbound rules that allow SSH, RDP, database ports, or all ports from the internet.
Azure RBAC: least privilege
Flags excessive privileged role assignments, custom roles with wildcard permissions, and service principals with privileged roles.
Azure Monitor: alerts and log export
Verify activity log alerts exist for critical operations and subscription logs are exported.
Separation of environments: production isolated from non-production
Verify production and non-production are separated across Azure subscriptions or resource groups.
Connecting Azure
Connect Azure with a read-only service principal (app registration). An admin adds the details below in Varman under Integrations. Secret values are encrypted before they are stored.
- Directory (tenant) ID
- The tenant ID of your Azure AD app registration.
- Application (client) ID
- The application (client) ID of the app registration.
- Client secret
- A client secret Value from the app registration.