Cis Azure Database 2.1
DevOps & Securitycis-azure-database-2.1Cis Azure Database 2.1 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure 'Microsoft Entra Authentication' is 'Enabled'
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Database_Services_Benchmark_v2.0.0/cis-azure-database-2.1/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-database-2-1, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
2.1 Ensure 'Microsoft Entra Authentication' is 'Enabled' (Manual)
Profile Applicability
- Level 1
Description
Ensuring that Microsoft Entra Authentication is 'Enabled' provides a natively integrated use of identities already defined with Microsoft Entra ID.
Rationale
The use of a centralized Identity and Access Management (IAM) solution such as Microsoft Entra ID is highly recommended for all activity related to Identity, Authentication, Authorization, and Accountability.
Decentralized IAM -- such as local authentication methods -- may present additional vulnerability and introduce avoidable administrative complexity.
Impact
Free tiers exist for the licensing of Microsoft Entra ID if required.
Audit Procedure
Audit From Azure Portal
- Search for and open the
Azure Cache for Redisservice - For each instance, repeat the remaining steps
- Click on the name of the instance
- In the blade menu on the left, click on Authentication
- Review the checkbox next to
Enable Microsoft Entra Authentication
If the checkbox is Checked, the configuration for that instance is compliant.
Expected Result
The checkbox next to Enable Microsoft Entra Authentication should be Checked for each Azure Cache for Redis instance.
Remediation
Remediate From Azure Portal
- Search for and open the
Azure Cache for Redisservice - For each instance, repeat the remaining steps
- Click on the name of the instance
- In the blade menu on the left, click on Authentication
- Check the checkbox next to
Enable Microsoft Entra Authentication
Default Value
By default, Microsoft Entra Authentication is Checked during setup.
References
- https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management
- https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.6 Centralize Account Management | X | X | |
| v7 | 16.2 Configure Centralized Point of Authentication | X | X |