azure-sql-db-list
The resource JSON for this API has been updated to include following fields:
properties.encryptionProtectorproperties.encryptionProtectorAutoRotationazure-security-center-settings
The Microsoft.Security/autoProvisioningSettings/read and Microsoft.Security/autoProvisioningSettings/write deprecated permissions have been removed from the CFT template to align with the latest Azure API requirements.
azure-security-center-settings
The autoProvisioningSettings\[\*] field has been removed in the JSON resource for this API as it is no longer supported by the Azure API.
gcloud-ai-applications-cmek-config
Additional permissions required:
discoveryengine.cmekConfigs.listThe Viewer role includes the permission.
| ## New Policies| Policies | Description |
| Azure Network Watcher virtual network flow log is disabled | The absence of network flow logging prevents comprehensive monitoring of network traffic within virtual networks, hindering security incident detection and forensic analysis efforts. Network flow logs record information about IP traffic through Network Security Groups, providing details like source/destination IP, port, protocol, and traffic allowed/denied. If Virtual Network flow logs are disabled, there is no visibility into internal network communications. This lack of logging hinders the ability to detect anomalous traffic patterns indicative of a breach, such as data exfiltration attempts, command and control communications, or internal reconnaissance. The impact of disabled network flow logs is a significant blind spot in network security. Without these logs, it is nearly impossible to reconstruct a security incident, determine the extent of a compromise, or identify the source and destination of malicious traffic within the network. This severely impedes incident response capabilities and post-mortem analysis. Maintaining enabled flow logs is a best practice for a strong security posture, providing essential telemetry for threat hunting, compliance auditing, and network performance troubleshooting. To mitigate this misconfiguration, ensure Network Watcher flow logging is enabled for all Virtual Networks. Configure flow logs to capture all traffic that passes through Network Security Groups and direct them to a secure, immutable storage account for long-term retention. Integrate these logs with a security information and event management (SIEM) solution for real-time analysis, alerting, and correlation with other security data. Policy Severity— Informational Policy Type— Config |
| Azure SQL Server not using Entra-only authentication | Azure SQL Server authentication relies on verifying the identity of users and applications connecting to the database. When not using Entra-only authentication, the SQL server might be using older/legacy authentication methods which are less secure. Allowing SQL older/legacy authentication methods increases the risk of credential compromise, such as brute-force attacks, password spraying, and stolen credentials. Legacy authentication protocols often lack modern security features like multi-factor authentication (MFA) and conditional access, making them more susceptible to exploitation. This exposes the database to unauthorized access and potential data breaches. The impact of not using Entra-only authentication includes an increased risk of unauthorized access, data breaches, and compliance violations. Security incidents may arise from compromised credentials, leading to data exfiltration or system disruptions. Enforcing Entra-only authentication helps to strengthen the security posture and reduce the attack surface. To mitigate the risks, configure Azure SQL Server to use Entra-only authentication and disable SQL older/legacy authentication methods. Enforce MFA for all Entra accounts accessing the database. Regularly monitor authentication logs for suspicious activity and implement strong password policies to enhance security and prevent unauthorized access. Policy Severity— Medium Policy Type— Config |
| Policy Updates | Description |
| Policy Updates—RQL | |
| Azure Microsoft Defender for Cloud disk encryption monitoring is set to disabled | Changes– The policy RQL and remediation steps are updated. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Informational Impact– Existing alerts will be resolved as |
| Azure Microsoft Defender for Cloud system updates monitoring is set to disabled | Changes– The policy RQL and remediation steps are updated. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Informational Impact– Existing alerts will be resolved as |
| Azure Microsoft Defender for Cloud security contact additional email is not set | Changes– The policy RQL is updated to refine the policy logic. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Informational Impact– You may notice an increase in count for the number of alerts for policy violations. |
| Azure App Service web apps with public network access | Changes– The policy RQL is updated to consider private endpoints as well to reduce false positives. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Medium Impact– Low. Existing alerts for private link identifiers will be resolved. New alerts will be generated for application services where the IP rule allows access from 0.0.0.0/0. |
| Azure Network Watcher Network Security Group (NSG) flow logs retention is less than 90 days | Changes– The policy RQL and remediation steps are updated to incorporate changes introduced by the CSP and to reduce false positive alerts. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Low Impact– Low. Existing alerts where the Flow logs did not exist for NSG will be resolved. |
| Azure Network Watcher Network Security Group (NSG) flow logs are disabled | Changes– The policy RQL and remediation steps are updated to incorporate changes introduced by the CSP and to reduce false positive alerts. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Medium Impact– Low. Existing alerts where the Flow logs did not exist for NSG will be resolved. |
| Azure Key Vault audit logging is disabled | Changes– The policy RQL is updated to resolve a syntax issue. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Informational Impact– None. No impact on alerts. |
| GCP Cloud Run function is using default service account with editor role | Changes– The policy RQL is updated to match the GCP API. Current RQL– Updated RQL– Policy Type– Config Policy Severity– Medium Impact– Low. New alerts will be generated for policy violations. |
| GCP PostgreSQL instance database flag log_min_error_statement is not set to Error or higher | Changes– The policy RQL is updated to stop generating alerts for GCP PostgreSQL instances where the Current RQL– Updated RQL– Policy Type– Config Policy Severity– Low Impact– Low. Existing alerts will be resolved on GCP PostgreSQL instances where the |
| GCP PostgreSQL instance database flag log_min_messages is not set to Warning or higher | Changes– The policy RQL is updated to stop generating alerts for GCP PostgreSQL instances where the Current RQL– Updated RQL– Policy Type– Config Policy Severity– Low Impact– Low. Existing alerts will be resolved on GCP PostgreSQL instances where the |
The following policies have been deleted because the CSP updated the Azure Microsoft Defender for Cloud service, making these policies obsolete:
Microsoft Defender for Cloud has modernized its approach by replacing individual security setting monitors with comprehensive plans such as "Defender for Servers."
Impact— Low. Previously generated alerts are resolved as Policy\_Deleted.