| name | cis-azure-foundations-8.1.16 |
| description | Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","security","defender","security-benchmark","policies"] |
| cis_id | 8.1.16 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
8.1.16 Ensure that Microsoft Cloud Security Benchmark policies are not set to 'Disabled' (Automated)
Description
Ensure that none of the policies within the Microsoft Cloud Security Benchmark (MCSB) initiative assigned to the subscription have been manually disabled, maintaining comprehensive security coverage.
Rationale
The Microsoft Cloud Security Benchmark (MCSB) is the default security initiative automatically assigned to every subscription in Microsoft Defender for Cloud. It provides a comprehensive set of security policies aligned with industry standards. Disabling individual policies within MCSB reduces the security coverage and creates blind spots in the organization's security posture. All MCSB policies should remain enabled to ensure full compliance assessment and recommendation coverage.
Impact
Keeping all MCSB policies enabled may generate recommendations for resources that are not in scope or not applicable to the organization's environment. However, the security benefits of comprehensive coverage outweigh the noise from inapplicable recommendations. Organizations can use exemptions for specific resources rather than disabling policies entirely.
Audit Procedure
From Azure Portal:
- Go to
Microsoft Defender for Cloud.
- Under
Management, click Environment settings.
- Click the name of a subscription.
- Select the
Security policy blade.
- Click on
Microsoft Cloud Security Benchmark.
- Review the list of policies and ensure none have the
Effect set to Disabled.
From Azure CLI:
az policy assignment list --scope "/subscriptions/{subscriptionId}" --query "[?displayName=='Microsoft Cloud Security Benchmark']"
Then check the policy parameters for any disabled effects:
az policy assignment show --name "{assignmentName}" --scope "/subscriptions/{subscriptionId}" --query "parameters"
Verify no policy effects are set to Disabled.
From PowerShell:
$assignment = Get-AzPolicyAssignment -Scope "/subscriptions/{subscriptionId}" | Where-Object {$_.Properties.DisplayName -eq "Microsoft Cloud Security Benchmark"}
$assignment.Properties.Parameters | ConvertTo-Json -Depth 10
Review the output and verify no policy effects are set to Disabled.
Expected Result
All policies within the Microsoft Cloud Security Benchmark initiative should have their effects set to their default values (typically or ), not .
