Overview
Configuration auditing in Azure centers around Azure Policy, which evaluates resource configuration and enforces compliance. Azure Resource Graph provides inventory and query capabilities, while Defender for Cloud aggregates findings and security recommendations.
Key Azure Services for Configuration Auditing
- Azure Policy – Defines and enforces configuration rules.
- Azure Resource Graph – Queries resource configuration at scale.
- Defender for Cloud – Provides security recommendations and compliance status.
- Azure Monitor – Tracks configuration-related metrics and logs.
- Azure Blueprints – Packages policies and standards for deployment.
Azure Policy
Azure Policy is the core of configuration auditing in Azure. Policies evaluate resource configuration and enforce compliance through deny, audit, or deploy-if-not-exists effects.
| Policy | Purpose |
|---|---|
| Audit VMs without disk encryption | Ensures VM disks are encrypted at rest. |
| Deny public IPs | Prevents creation of public IP addresses. |
| Audit storage accounts without HTTPS | Ensures secure transport is enforced. |
| Deploy diagnostic settings | Automatically configures logging for resources. |
Configuration Auditing Workflow in Azure
- Define Azure Policies – Use built-in or custom definitions.
- Assign Policies – Apply to subscriptions, resource groups, or management groups.
- Evaluate Compliance – Azure Policy reports compliance status.
- Query with Resource Graph – Inspect configuration across resources.
- Review Defender for Cloud – Aggregate findings and recommendations.
- Automate Remediation – Use deploy-if-not-exists or remediation tasks.
- Collect Evidence – Export compliance reports for audits.
Policy Definition → Assignment → Evaluation → Drift Detection → Remediation → Compliance Reporting
Common Use Cases
- Enforcing encryption at rest for VMs and storage
- Preventing public access to storage accounts
- Ensuring diagnostic logs are enabled
- Auditing network security group rules
- Verifying identity and access configuration
Evidence Collection in Azure
Evidence for audits can include:
- Azure Policy compliance reports
- Resource Graph queries
- Defender for Cloud recommendations
- Activity logs and change history
- Blueprint assignments and artifacts
Frequently Asked Questions
How does configuration auditing work in Azure?
Azure uses Azure Policy, Resource Graph, Defender for Cloud, and compliance dashboards to enforce configuration standards, detect drift, and provide evidence.
Which Azure services support configuration auditing?
Key services include Azure Policy, Azure Resource Graph, Azure Monitor, Defender for Cloud, and Azure Blueprints.
Can Azure Policy enforce configuration automatically?
Yes. Deploy-if-not-exists and remediation tasks can automatically correct misconfigurations.