Azure Security Review (AZQR)

Date: 2026-02-25

This document summarizes security-relevant findings from an Azure Quick Review (azqr) scan of the Audissey Azure subscription and provides a prioritized remediation plan.

Scope & Inputs

• Scope: Azure resources discovered by azqr scan for the subscription.
• Primary artifacts (generated locally):
  • Audissey/.tmp/azqr/audissey-azqr-full-2026-02-25.recommendations.csv
  • Audissey/.tmp/azqr/audissey-azqr-full-2026-02-25.defenderRecommendations.csv
  • Audissey/.tmp/azqr/audissey-azqr-full-2026-02-25.azurePolicy.csv
  • Full report: Audissey/.tmp/azqr/audissey-azqr-full-2026-02-25.xlsx

Notes:

• AZQR produced 305 recommendation “types”; 40 of them impacted at least one resource.
• “Impacted resources” counts in AZQR are not unique-resource counts (summing across recommendations double-counts resources).
• Severity distribution by impacted-count sum: High: 30, Medium: 67, Low: 157.

Executive Summary (Security)

Top security priorities identified by Azure Policy/Defender/AZQR are:

1. Enforce HTTPS-only for App Services (Defender + Policy show multiple noncompliant apps).
2. Restrict public access / adopt Private Link for shared services:
   • Azure Container Registry: private endpoints + restrict public network.
   • Cosmos DB: disable public network access.
3. Key Vault protection & auditing:
   • Enable purge protection (deletion protection) where missing.
   • Enable diagnostic/resource logs for investigation/audit trail.
4. Network hardening & observability:
   • Enable VNet Flow Logs.
   • Ensure VNet DNS resiliency (at least two DNS servers assigned).
   • Consider policy-driven guidance to route internet traffic via a firewall (Defender/Policy “preview” recommendation).

Key Findings (Prioritized)

High

From recommendations.csv (top high by impacted count):

• Virtual Networks: “at least two DNS servers assigned”: impacted 5 VNets.
• App Service: “HTTPS only”: impacted 4 App Services.
• App Service: “Enable Health Check” (availability): impacted 4 App Services.
• App Service Plans: “minimum instance count = 2” (availability): impacted 4 plans.
• ACR: Private endpoints: impacted 1 registry.
• Cosmos DB hardening (security): impacted 1 account:
  • Disable local authentication.
  • Disable write operations on metadata resources via account keys.

From defenderRecommendations.csv (4 High):

• Web Application should only be accessible over HTTPS:
  • audissey-prod-rg/audissey-admin
  • audissey-staging-rg/audissey-admin-staging
  • audissey-dev-rg/audissey-admin-dev
  • audissey-dev-rg/audissey-worker-dev

From azurePolicy.csv (27 NonCompliant total):

• App Service apps should only be accessible over HTTPS: 4 noncompliant resources (same set as Defender).

Medium

From recommendations.csv (top medium by impacted count):

• Private DNS zones TTL: impacted 22 zones (availability / recovery objectives).
• App Service: Avoid Client Affinity: impacted 10 apps.
• App Service: Enable “VNET Route all” for VNET integration: impacted 10 apps.
• VNet Flow Logs: impacted 5 VNets.
• Key Vault purge protection: impacted 2 vaults.

From defenderRecommendations.csv:

• Key vault deletion protection (purge protection): affected vaults include audissey-kv-dev and audissey-kv-staging.
• Container Registry network restrictions / private link: audissey-shared-rg/audissey.
• Cosmos DB disable public network access: audissey-shared-rg/audissey-cosmos.

Low (mainly governance / monitoring)

From recommendations.csv:

• Naming conventions: impacted-count sum 87.
• Tags: impacted-count sum 37.
• Diagnostic settings:
  • App Services: impacted 10.
  • VNets: impacted 5.
  • Plans: impacted 4.
  • Key Vault: impacted 3.

From azurePolicy.csv:

• App Service apps should have resource logs enabled: 10 noncompliant.
• Resource logs in Key Vault should be enabled: 3 noncompliant.

Remediation Plan (Practical)

0–7 days (quick wins / high security ROI)

• Enable HTTPS-only for all noncompliant App Services (prod/staging/dev).
• Enable Key Vault purge protection (starting with staging/dev vaults identified by Defender/Policy).
• Turn on diagnostic/resource logs:
  • App Service resource logs (Policy indicates 10 noncompliant).
  • Key Vault diagnostic/resource logs (Policy indicates 3 noncompliant).

1–3 weeks (reduce exposure surface)

• Container Registry:
  • Restrict public network access and move to Private Link (typically requires Premium SKU).
• Cosmos DB:
  • Disable public network access and adopt private endpoints (if feasible for the workload).
  • Review “local authentication disabled” and “metadata writes via account keys” settings in the context of your application/automation.

1–2 months (hardening & reliability)

• Network observability: enable VNet Flow Logs and VNet diagnostics.
• Private DNS TTL: review and set TTLs aligned to RTO/RPO requirements.
• App Service resiliency: minimum instance count and health checks; avoid client affinity; ensure VNET route-all where appropriate.

What Looks Good / Not Flagged

• AZQR/Defender/Policy outputs here did not report any Critical severity findings.
• The scan did not surface any immediate “wide-open NSG inbound” type findings in the summarized top lists (this does not prove they don’t exist; it only reflects what these scanners emitted in this run).

Appendix

• Defender findings summary (from defenderRecommendations.csv):

  • Total recommendations: 26
  • Severity: High 4, Medium 15, Low 7
  • Most frequent: App Service diagnostic logs (10 occurrences)

• Azure Policy noncompliance summary (from azurePolicy.csv):

  • Total noncompliant evaluations: 27
  • Top policy names:
    • “App Service apps should have resource logs enabled” (10)
    • “App Service apps should only be accessible over HTTPS” (4)
    • “[Preview]: All Internet traffic should be routed via your deployed Azure Firewall” (4)
    • “Resource logs in Key Vault should be enabled” (3)
    • “Key vaults should have deletion protection enabled” (2)