Azure security scans
Explore 203 Azure security checks across 22 service areas, from Entra ID and storage to Kubernetes and AI services, with resource evidence and remediation guidance.
A CONNECTED VIEW
Three of 22 supported Azure service areas
Resources · recommendations · coverage gaps
Catalog illustration, not a customer scan or compliance score. *Exports on eligible plans.
Verified catalog.
Your scan determines actual coverage.
A CLEARER SECURITY REVIEW
A useful security review connects the issue to its context. Futrly brings Azure configuration checks into the same workspace as your tenants and reports, so your team can review the evidence and agree on the next step.
Findings carry a check name, status, severity and resource evidence, with subscription, region and service context where available. Separate tenant-wide identity findings from subscription-level infrastructure issues before assigning work.
Review the explanation of the risk alongside the observed setting. Use severity as a starting point, then consider exposure, business importance and compensating controls. A failed check is a finding to review, not a failed scan job.
Read the available remediation recommendation and reference links without losing the resource context. Your team remains in control of changes: the scanner assesses configuration and does not automatically remediate Azure resources.
Use the results for a first tenant review, recurring client conversations or remediation planning. Mapped findings also feed framework-based compliance reports, so you can connect technical issues to the control discussion without presenting a scan as an audit certificate.
THE FULL SUPPORTED CATALOG
Open a service area to see every check in the pinned catalog, including its configured severity. The number of findings depends on your resources: one check may produce several resource findings, or no result when a resource is absent or cannot be evaluated. Counts below describe supported checks, not a guarantee of completed coverage.
203 checks across 22 service areas in the supported catalog
aisearch_service_not_publicly_accessibleaiservices_account_diagnostic_logging_enabledaiservices_account_encrypted_with_cmkaiservices_account_local_auth_disabledaiservices_account_managed_identity_enabledaiservices_account_network_acls_default_action_denyaiservices_account_outbound_network_restrictedaiservices_account_public_network_access_disabledaiservices_account_uses_private_endpointaiservices_deployment_content_filter_prompt_shield_enabledaks_cluster_auto_upgrade_enabledaks_cluster_azure_monitor_enabledaks_cluster_defender_enabledaks_cluster_local_accounts_disabledaks_cluster_rbac_enabledaks_clusters_created_with_private_nodesaks_clusters_public_access_disabledaks_network_policy_enabledapim_threat_detection_llm_jackingapp_client_certificates_onapp_ensure_auth_is_set_upapp_ensure_http_is_redirected_to_httpsapp_ensure_java_version_is_latestapp_ensure_php_version_is_latestapp_ensure_python_version_is_latestapp_ensure_using_http20app_ftp_deployment_disabledapp_function_access_keys_configuredapp_function_application_insights_enabledapp_function_ensure_http_is_redirected_to_httpsapp_function_ftps_deployment_disabledapp_function_identity_is_configuredapp_function_identity_without_admin_privilegesapp_function_latest_runtime_versionapp_function_not_publicly_accessibleapp_function_vnet_integration_enabledapp_http_logs_enabledapp_minimum_tls_version_12app_register_with_identityappinsights_ensure_is_configuredcontainerregistry_admin_user_disabledcontainerregistry_not_publicly_accessiblecontainerregistry_uses_private_linkcosmosdb_account_automatic_failover_enabledcosmosdb_account_backup_policy_continuouscosmosdb_account_firewall_use_selected_networkscosmosdb_account_minimum_tls_versioncosmosdb_account_public_network_access_disabledcosmosdb_account_use_aad_and_rbaccosmosdb_account_use_private_endpointsdatabricks_workspace_cmk_encryption_enableddatabricks_workspace_no_public_ip_enableddatabricks_workspace_public_network_access_disableddatabricks_workspace_vnet_injection_enableddefender_additional_email_configured_with_a_security_contactdefender_assessments_vm_endpoint_protection_installeddefender_attack_path_notifications_properly_configureddefender_auto_provisioning_log_analytics_agent_vms_ondefender_auto_provisioning_vulnerabilty_assessments_machines_ondefender_container_images_resolved_vulnerabilitiesdefender_container_images_scan_enableddefender_ensure_defender_cspm_is_ondefender_ensure_defender_for_app_services_is_ondefender_ensure_defender_for_arm_is_ondefender_ensure_defender_for_azure_sql_databases_is_ondefender_ensure_defender_for_containers_is_ondefender_ensure_defender_for_cosmosdb_is_ondefender_ensure_defender_for_databases_is_ondefender_ensure_defender_for_dns_is_ondefender_ensure_defender_for_keyvault_is_ondefender_ensure_defender_for_os_relational_databases_is_ondefender_ensure_defender_for_server_is_ondefender_ensure_defender_for_sql_servers_is_ondefender_ensure_defender_for_storage_is_ondefender_ensure_iot_hub_defender_is_ondefender_ensure_mcas_is_enableddefender_ensure_notify_alerts_severity_is_highdefender_ensure_notify_emails_to_ownersdefender_ensure_system_updates_are_applieddefender_ensure_wdatp_is_enabledentra_app_registration_credential_not_expiredentra_authentication_methods_policy_strong_auth_enforcedentra_conditional_access_policy_require_mfa_for_admin_portalsentra_conditional_access_policy_require_mfa_for_management_apientra_global_admin_in_less_than_five_usersentra_non_privileged_user_has_mfaentra_policy_default_users_cannot_create_security_groupsentra_policy_ensure_default_user_cannot_create_appsentra_policy_ensure_default_user_cannot_create_tenantsentra_policy_guest_invite_only_for_admin_rolesentra_policy_guest_users_access_restrictionsentra_policy_restricts_user_consent_for_appsentra_policy_user_consent_for_verified_appsentra_privileged_user_has_mfaentra_security_defaults_enabledentra_trusted_named_locations_existsentra_user_with_recent_sign_inentra_user_with_vm_access_has_mfaentra_users_cannot_create_microsoft_365_groupsiam_custom_role_has_permissions_to_administer_resource_locksiam_role_user_access_admin_restrictediam_subscription_owners_between_2_and_3iam_subscription_roles_owner_custom_not_createdkeyvault_access_only_through_private_endpointskeyvault_key_expiration_set_in_non_rbackeyvault_key_rotation_enabledkeyvault_logging_enabledkeyvault_non_rbac_secret_expiration_setkeyvault_private_endpointskeyvault_rbac_enabledkeyvault_rbac_key_expiration_setkeyvault_rbac_secret_expiration_setkeyvault_recoverablemonitor_alert_create_policy_assignmentmonitor_alert_create_update_nsgmonitor_alert_create_update_public_ip_address_rulemonitor_alert_create_update_security_solutionmonitor_alert_create_update_sqlserver_frmonitor_alert_delete_nsgmonitor_alert_delete_policy_assignmentmonitor_alert_delete_public_ip_address_rulemonitor_alert_delete_security_solutionmonitor_alert_delete_sqlserver_frmonitor_alert_service_health_existsmonitor_diagnostic_setting_with_appropriate_categoriesmonitor_diagnostic_settings_existsmonitor_storage_account_with_activity_logs_cmk_encryptedmonitor_storage_account_with_activity_logs_is_privatemysql_flexible_server_audit_log_connection_activatedmysql_flexible_server_audit_log_enabledmysql_flexible_server_geo_redundant_backup_enabledmysql_flexible_server_high_availability_enabledmysql_flexible_server_minimum_tls_version_12mysql_flexible_server_ssl_connection_enablednetwork_application_gateway_http2_enablednetwork_application_gateway_waf_enablednetwork_bastion_host_existsnetwork_flow_log_captured_sentnetwork_flow_log_more_than_90_daysnetwork_http_internet_access_restrictednetwork_public_ip_shodannetwork_rdp_internet_access_restrictednetwork_ssh_internet_access_restrictednetwork_subnet_nsg_associatednetwork_udp_internet_access_restrictednetwork_vnet_ddos_protection_enablednetwork_watcher_enabledpolicy_ensure_asc_enforcement_enabledpostgresql_flexible_server_allow_access_services_disabledpostgresql_flexible_server_connection_throttling_onpostgresql_flexible_server_enforce_ssl_enabledpostgresql_flexible_server_entra_id_authentication_enabledpostgresql_flexible_server_geo_redundant_backup_enabledpostgresql_flexible_server_high_availability_enabledpostgresql_flexible_server_log_checkpoints_onpostgresql_flexible_server_log_connections_onpostgresql_flexible_server_log_disconnections_onpostgresql_flexible_server_log_retention_days_greater_3recovery_vault_backup_policy_retention_adequaterecovery_vault_has_protected_itemssqlserver_auditing_enabledsqlserver_auditing_retention_90_dayssqlserver_azuread_administrator_enabledsqlserver_microsoft_defender_enabledsqlserver_recommended_minimal_tls_versionsqlserver_tde_encrypted_with_cmksqlserver_tde_encryption_enabledsqlserver_unrestricted_inbound_accesssqlserver_va_emails_notifications_admins_enabledsqlserver_va_periodic_recurring_scans_enabledsqlserver_va_scan_reports_configuredsqlserver_vulnerability_assessment_enabledstorage_account_key_access_disabledstorage_account_public_network_access_disabledstorage_blob_public_access_level_is_disabledstorage_blob_versioning_is_enabledstorage_cross_tenant_replication_disabledstorage_default_network_access_rule_is_deniedstorage_default_to_entra_authorization_enabledstorage_ensure_azure_services_are_trusted_to_access_is_enabledstorage_ensure_encryption_with_customer_managed_keysstorage_ensure_file_shares_soft_delete_is_enabledstorage_ensure_minimum_tls_version_12storage_ensure_private_endpoints_in_storage_accountsstorage_ensure_soft_delete_is_enabledstorage_geo_redundant_enabledstorage_infrastructure_encryption_is_enabledstorage_key_rotation_90_daysstorage_secure_transfer_required_is_enabledstorage_smb_channel_encryption_with_secure_algorithmstorage_smb_protocol_version_is_latestvm_backup_enabledvm_desired_sku_sizevm_ensure_attached_disks_encrypted_with_cmkvm_ensure_unattached_disks_encrypted_with_cmkvm_ensure_using_approved_imagesvm_ensure_using_managed_disksvm_jit_access_enabledvm_linux_enforce_ssh_authenticationvm_scaleset_associated_with_load_balancervm_scaleset_not_emptyvm_sufficient_daily_backup_retention_periodvm_trusted_launch_enabledCONNECT WITH A CLEAR SCOPE
Your Microsoft work account connects you to your Futrly workspace. Scanning a tenant is a separate authorisation step. An appropriately privileged administrator completes application consent and grants access to the selected subscriptions; ordinary sign-in alone does not grant scanning permissions.
The Azure scanner targets selected subscriptions in the public Azure cloud. Directory checks use tenant-wide Microsoft Graph access, even when the infrastructure scan includes only a subset of subscriptions. Keep that difference in mind when agreeing a client engagement or delegating onboarding.
The scanner uses Azure Reader, Microsoft Graph application permissions and specific App Service/Function read operations. Those operations can expose application configuration and host keys. The setup flow discloses this access and asks the administrator to acknowledge it before scanning.
Missing permissions, licensing limits, unavailable resources and collector errors can leave gaps. Review warnings and unknown outcomes alongside the findings. Futrly keeps scan scope and engine version with the results so a reviewer can understand what produced the report.
BEFORE YOUR FIRST SCAN
No. The catalog defines the checks supported by the integrated scanner. Your results depend on selected subscriptions, deployed resource types, required permissions and the evidence Azure makes available. Review the scan's coverage warnings rather than treating missing findings as a clean result.
No. This coverage is primarily Azure security posture and configuration assessment. It does not establish that application code, container contents, guest operating systems or every workload are free of vulnerabilities. Use those other assessments alongside the configuration evidence when your review requires them.
Futrly keeps connections and scan results within the customer workspace, with tenant and subscription context attached to reports. Available tenant capacity, scan allowances and reporting features depend on your plan. Explore the MSP workflow or compare plan limits before onboarding a larger portfolio.
This catalog describes the Azure checks and framework mappings supported by Futrly. New checks and mappings are added through reviewed scanner upgrades. Coverage is updated here after an upgrade has been integrated and verified.
YOUR NEXT SECURITY REVIEW
Sign in with Microsoft, connect an authorised Azure tenant and confirm the access needed for your chosen scope. Scan availability depends on workspace setup; compliance reports and exports require an eligible plan.