AWS & Azure security controls

App Service has no diagnostic logs, leaving no activity trail for investigation

A Function app still answers plain HTTP

A function app authenticates with stored credentials instead of a managed identity

An App Service web app still answers plain HTTP

Unencrypted Automation account variables expose secrets and sensitive runbook data to anyone who can read them.

Unauthenticated API endpoints let attackers reach data through missing or broken access controls.

Stale unused API endpoints stay exposed without current security coverage and widen the attack surface.

Serving APIs over plain HTTP or WS exposes data in transit to interception and tampering.

Skipping backend certificate validation lets attackers impersonate backends in man-in-the-middle attacks.

The direct management REST API bypasses Azure RBAC, authorisation and throttling, weakening the service.

Secrets held inline in API Management miss Key Vault access control and rotation, raising leak risk.

All-API subscription scope grants more access than needed and risks excessive data exposure.

APIs not onboarded to Defender for APIs go unmonitored for runtime attacks and data exposure.

App Configuration on public endpoints risks leaking application settings and feature flags

API apps reachable over plain HTTP let attackers eavesdrop on traffic in transit.

A wildcard CORS policy lets any external site call your API app on a user's behalf.

An unrestricted CORS configuration lets any domain interact with your web application.

Without incoming client certificates, an API app cannot verify the callers reaching it.

Unencrypted FTP to API apps lets credentials and content be sniffed off the wire.

Permitting unencrypted FTP to web apps lets attackers intercept publishing credentials.

Running an outdated Java runtime on API apps leaves known security flaws unpatched.

Without a managed identity, API apps rely on stored credentials that can leak or be stolen.

Web apps without a managed identity must hold secrets that are easy to expose or misuse.

Without Defender for App Service, common web app attacks go undetected across your plans.

An outdated PHP runtime on API apps carries unpatched vulnerabilities attackers can target.

Stale Python versions on API apps miss security fixes shipped in newer releases.

Remote debugging opens inbound ports on API apps that broaden the attack surface.

Active remote debugging on a web app exposes inbound ports that should stay closed.

Old TLS versions on API apps carry known cryptographic weaknesses attackers can exploit.

Serving web apps over legacy TLS exposes traffic to known cipher and downgrade attacks.

Not requesting client certificates lets any unauthenticated client reach the web app.

Without the Azure Policy extension you cannot audit or enforce security guardrails across Arc-connected clusters.

Without the Defender extension, Arc-connected clusters get no run-time threat detection on their control plane.

Without a customer-managed key you cannot meet compliance requirements that mandate control over registry encryption keys.

A registry open to the whole internet is exposed to untrusted hosts that could pull or tamper with images.

Without private link, registry traffic traverses public endpoints and is exposed to data leakage risks.

Without customer-managed keys you cannot independently control or revoke Cosmos DB data encryption

Key-based access to Cosmos DB bypasses centralised identity controls and cannot be revoked cleanly when compromised.

A Cosmos DB account exposed to the public internet is open to untrusted network probing

Cosmos DB reachable over public endpoints widens the data exfiltration surface

Missing Data Lake Analytics logs leave job activity invisible to security investigations

Without diagnostic logs you cannot reconstruct activity on Data Lake Store after an incident

Without customer-managed keys you cannot control or revoke the keys protecting MySQL data

Missing an Entra administrator forces reliance on weaker local database credentials

Connections to MySQL can travel unencrypted, exposing data to interception

Without geo-redundant backups a regional outage can cause permanent MySQL data loss

Without a private endpoint MySQL traffic crosses the public network

Public network access leaves MySQL servers reachable for attack from the internet

Without customer-managed keys you cannot control or revoke the keys protecting PostgreSQL data

Missing an Entra administrator forces reliance on weaker local database credentials

Connections to PostgreSQL can travel unencrypted, exposing data to interception

Without geo-redundant backups a regional outage can cause permanent PostgreSQL data loss

Without a private endpoint PostgreSQL traffic crosses the public network

Public network access leaves PostgreSQL servers reachable for attack from the internet

Allowing all Azure services bypasses isolation and opens access from other tenants

Allowing local passwords alongside Entra weakens centralised identity control

Without connection throttling the server is open to brute-force and denial-of-service floods

Short log retention lets attackers wait out the window in which evidence survives

Excluding privilege and schema changes from audit logs hides malicious activity

A weaker audit log level can suppress security-relevant events from the record

Without statement logging executed SQL goes unrecorded for investigation

Inconsistent statement logging leaves gaps in the audit trail

Without a configured private endpoint database traffic traverses the public internet

A public IP lets attackers scan and brute-force the PostgreSQL server directly

Clients can connect without TLS, leaving credentials and queries open to interception

Event Grid domains on public endpoints expose event traffic to data leakage

Publicly reachable Event Grid topics broaden the surface for intercepting event data

Function App API endpoints without authentication can leak sensitive data to anonymous callers.

Allowing all origins to call a function app widens its exposure to cross-site abuse.

Allowing plain FTP to function apps exposes deployment credentials and code to interception.

Disabling client certificates lets unverified clients reach the function app directly.

Leaving remote debugging on a function app keeps inbound debug ports needlessly open.

Function apps on outdated TLS remain open to downgrade and protocol weakness attacks.

Dormant HTTP-triggered Function endpoints linger unpatched and broaden the exposed attack surface.

Without Key Vault diagnostic logs, access to your secrets and keys cannot be reconstructed after a breach.

Clusters without the Defender profile collect no security event data and miss run-time threat alerts.

Without the Azure Policy add-on, Defender cannot audit or enforce in-cluster hardening and compliance.

Known CVEs in images already running in your clusters expand the live attack surface of containerised workloads.

Containers without resource limits can exhaust node CPU and memory, enabling denial-of-service against the cluster.

Pulling images from unknown registries can introduce malicious or vulnerable code into the cluster.

Allowing privilege escalation lets a container process gain more rights than its parent and approach root on the node.

Pods that share the host process ID or IPC namespace can escalate privileges outside the container boundary.

Without diagnostic logs you cannot reconstruct cluster activity trails to investigate a security incident.

A writable root filesystem lets an attacker drop malicious binaries into a running container at run-time.

An unrestricted Kubernetes API server is reachable from any network, widening the attack surface for cluster takeover.

Allowing plain HTTP ingress exposes cluster traffic to network-layer eavesdropping and tampering.

Auto-mounted API credentials let a compromised pod issue commands against the Kubernetes API server.

Using the default namespace weakens isolation and risks unauthorised access to shared cluster resources.

Granting broad Linux capabilities widens the container attack surface beyond what the workload needs.

Privileged containers hold all host root capabilities and serve as a ready entry point for host compromise.

Without Kubernetes RBAC, permissions cannot be scoped and users gain broad access to cluster resources.

A container running as root runs as root on the host, making any misconfiguration far easier to exploit.

Out-of-date AKS-managed system pods carry known CVEs that an attacker can exploit until the cluster is upgraded.

Unencrypted OS and data volumes expose all stored data if a disk is removed or the host is physically accessed.

Inconsistent WDAC enforcement across a cluster lets unsigned or malicious code run on whichever node is weakest.

Azure Local hosts that miss Secured-core hardening lack the firmware and boot protections that block low-level attacks.

Unprotected Azure Local host and VM networking exposes east-west traffic to interception and lateral movement.

Logic App API endpoints without authentication expose workflows and data to unauthorised access.

Idle Logic App API endpoints remain live without recent security updates and invite abuse.

Service-managed keys leave you unable to control or revoke encryption of machine learning data

Public workspace endpoints let training data and models leak across the internet

Without Network Watcher, you lack the flow logs and diagnostics needed to investigate network-level incidents.

SignalR without private link keeps real-time messaging exposed on public networks

Disabling threat protection types leaves SQL injection and anomalous activity undetected on your servers

Short audit retention means forensic logs may be purged before an incident is detected and investigated

Without server auditing there is no record of database activity to investigate breaches or misuse

Allowing legacy TLS lets clients connect over protocols with known weaknesses, exposing data in transit

Without private endpoints, database traffic traverses public network paths instead of staying on the backbone

No Entra administrator forces reliance on local logins and blocks centralised, auditable identity management

Without vulnerability assessment configured, database misconfigurations and excessive permissions go undiscovered

Relying on platform-managed keys removes the control and separation of duties some compliance regimes demand

Disabling threat protection types leaves SQL injection and anomalous activity undetected on managed instances

A public endpoint on a managed instance widens the attack surface beyond the virtual network and private links

Without vulnerability assessment on managed instances, weak baselines and unprotected data stay invisible

Without a customer-managed TDE key you lose control over the protector and HSM-backed key separation

Storage accounts open to all networks let attackers reach your data from any public IP

Storage accounts reachable over public endpoints can be enumerated and exfiltrated without private network isolation.

Classic deployment model storage accounts lack RBAC, managed identity and modern auditing protections.

Shared key authorisation hands out long-lived account secrets that bypass Microsoft Entra identity controls.

Storage accounts open to any public IP let attackers reach data instead of only trusted virtual networks.

Permitting local SQL authentication alongside Entra weakens centralised identity control on Synapse workspaces

Overly permissive NSG inbound rules let any internet host probe and attack your VMs

IP forwarding lets a compromised VM intercept and reroute traffic meant for other hosts

Exposed risky ports give attackers a direct route into your machines

Internal VMs without an NSG allow unchecked lateral movement once an attacker is inside the network

Subnets without an NSG leave every resource in them open to unfiltered network traffic

Public-facing virtual networks without DDoS protection can be knocked offline by volumetric attacks

Virtual networks without a firewall lack edge filtering against inbound and outbound threats

Batch accounts without logging leave investigators blind to how compute jobs were created or tampered with.

Endpoint protection is installed but unhealthy or out of date

Machines have no anti-malware endpoint protection installed

Machines lack the Guest Configuration agent that audits in-guest security settings

An internet-facing VM has no network security group restricting traffic

Machines have no vulnerability scanner, so known CVEs go undetected

VM management ports are always open instead of just-in-time

RDP or SSH management ports are open to the internet on a VM

Machines are missing operating-system security updates that attackers commonly exploit

VM temp disks and caches are left unencrypted

Container images in the registry carry unresolved known vulnerabilities

Misconfigured Docker hosts give attackers an easy path to break out of containers and compromise the underlying node.

Cosmos DB has no IP firewall, so it is reachable from any address

Azure Database for PostgreSQL accepts connections from the public internet

High-severity alert emails are off, so critical alerts are missed

Defender for SQL is off, so database attacks and anomalies are not detected

Defender for Servers is off, so VMs get no real-time threat detection or alerts

Defender for Storage is off, so malicious access to blobs goes undetected

No security contact email, so Defender breach notices reach nobody

Disabled Event Hubs logging removes the audit trail needed to trace data exfiltration through the messaging layer.

Too many subscription owners widen the blast radius of a compromise

Blocked or deleted directory accounts still hold subscription access

Guest or external accounts hold owner rights on a subscription

Key Vault firewall is off, so any network can reach the vault endpoint

Key Vault is reachable over its public endpoint rather than private link

A Key Vault key never expires, so it lives indefinitely

Secrets that never expire give an attacker who steals them unlimited time to use the credentials undetected

A deleted vault or key can be permanently purged before its retention ends

Deleted vault objects cannot be recovered because soft delete is off

Key vaults using legacy access policies grant coarse permissions, so attackers and over-privileged users can read every secret and key

Long-lived certificates extend the period an attacker can abuse a compromised key before rotation.

Without Defender for Key Vault, unusual or malicious attempts to access your secrets go undetected.

Logic Apps without diagnostic logs hide who triggered workflows, hampering incident investigation.

Without the APIs plan you miss discovery, threat detection and attack alerts for your published APIs.

Without owner notifications, subscription owners may not learn of a high-severity breach in time to act.

Without Defender for Azure Cosmos DB, injection and exfiltration attempts against your databases go undetected.

Without Defender for Containers, your Kubernetes clusters lack run-time threat detection and hardening.

Without Defender for DNS, malicious DNS queries from compromised resources are not detected.

Without Defender for open-source databases, anomalous access to your MySQL and PostgreSQL servers is not alerted.

Without Defender for Resource Manager, suspicious control-plane operations across your subscription go unnoticed.

With Defender for Servers off at the workspace, reporting machines miss protections you are already paying for.

Without Defender for SQL on machines, SQL servers hosted on your VMs lack threat detection and vulnerability assessment.

Azure Cache for Redis accepts unencrypted non-TLS connections

Service Bus without logging gives no record of message access, so abuse of the queue goes undetected.

Node-to-node traffic that is not encrypted and signed can be intercepted or forged within the cluster.

Client authentication outside Microsoft Entra ID bypasses central identity governance and conditional access.

Azure SQL Database is reachable from any network rather than a private endpoint

Open SQL vulnerability findings remain unresolved on your databases

Transparent Data Encryption is off on an Azure SQL database

A regulated storage account relies on the platform key, not a customer-managed key

Storage accepting plain HTTP lets requests and SAS tokens be intercepted

Anonymous public blob access can expose storage data to the internet

Without diagnostic logs there is no activity trail to reconstruct events when a Stream Analytics job is abused.

Identities holding far more rights than they use enlarge the blast radius of any single compromise.

Sign-in blocked owner accounts remain assigned and offer attackers a quiet route to full resource control.

Sign-in blocked accounts that keep read and write access give attackers an unmonitored path to your data.

Deprecated owner accounts that can no longer sign in are prime targets for takeover of the whole subscription.

External read accounts sit outside your tenant governance and can quietly exfiltrate subscription data.

External write accounts can modify resources without tenant oversight, widening your attack surface.

Guest owners are governed to lower standards than tenant identities yet hold full control of your resources.

Guest read access lives outside tenant governance and offers attackers an unmonitored view of your data.

Guest write access lets externally provisioned identities change resources without tenant oversight.

Identities idle for 45 days keep live permissions that an attacker can hijack without anyone noticing.

Standing privileged assignments give attackers always-on admin access instead of brief just-in-time windows.

Service principals with Owner or Contributor rights become high-value, non-human targets for privilege abuse.

A single subscription owner is a single point of failure for administrative access and recovery.

Scale sets without diagnostic logs leave no forensic trail when instances are compromised and recycled.

Without the Guest Attestation extension, boot-chain compromise of Linux scale-set instances cannot be detected.

Windows scale sets without Guest Attestation cannot prove boot integrity, hiding firmware-level compromise.

Scale-set instances built from an insecure baseline replicate the same exploitable misconfiguration at scale.

Without application allowlisting, any unexpected or malicious binary can execute freely on your servers.

Stale allowlist rules either block legitimate apps or let newly observed unsafe binaries slip through unmonitored.

Password-based SSH leaves Linux VMs exposed to brute-force credential attacks that key pairs would defeat.

VMs without Azure Backup have no recovery point, so ransomware or accidental deletion means permanent data loss.

Misconfigured endpoint detection silently degrades protection, so advanced threats on the VM go unseen.

VMs without an EDR solution have no means to detect, investigate or respond to advanced endpoint threats.

Without file integrity monitoring, tampering of critical files and registry keys by an intruder passes unnoticed.

Missing Guest Attestation on Linux VMs means rootkit or bootkit tampering of the boot chain stays invisible.

Without Guest Attestation, a Windows VM cannot attest its boot integrity, masking bootkit infection.

Unencrypted Linux VM disks, caches and temp data expose everything if underlying storage is accessed out of band.

Without kernel module signature validation, malicious or unauthorised modules can load and run in kernel mode.

Untrusted boot components on Linux VMs are a classic vector for persistent rootkit and bootkit infection.

Without Secure Boot, unsigned operating systems and drivers can load, enabling boot-level malware on Linux VMs.

Machines left off the CIS-aligned security baseline carry weak settings that attackers routinely exploit.

Machines that never assess for missing updates drift out of patch compliance and quietly accumulate exploitable holes.

Pending security configuration updates are not active until reboot, leaving the machine exposed in the interim.

Unresolved scanner findings are known, fixable weaknesses an attacker can chain into a full compromise.

Without Exploit Guard, Windows machines lack the attack-surface-reduction defences that block common malware behaviours.

Without Secure Boot, unauthorised changes to the Windows boot chain can install persistent boot-level malware.

Missing system, security and critical updates leave machines open to the malware that routinely weaponises known patches.

Without encryption at host, temp disks and disk caches stay in cleartext on the underlying hypervisor storage.

An unhealthy attestation status signals the boot chain may be compromised by a bootkit or rootkit.

Guest Configuration without a managed identity falls back to weaker auth and cannot securely report compliance.

Without a virtual TPM, Measured Boot and other integrity features that detect boot tampering cannot operate.

Linux machines off the Azure security baseline carry hardening gaps that attackers exploit for footholds.

Windows machines off the Azure security baseline keep weak settings that broaden the attack surface.

Unencrypted Windows VM disks, caches and temp data are readable if the underlying storage is accessed out of band.

Web servers without current TLS expose traffic to interception and downgrade attacks over the network.