Azure Security Audit · PipelineAtlas

How to create credentials Register an App in Azure Active Directory with Reader and Security Reader roles on your subscription. Use the App's Client ID, Client Secret, and your Tenant ID below. Your credentials are used only to run the audit and are never stored.

Azure Credentials

Subscription ID Found in Azure Portal under Subscriptions

Tenant ID Azure Active Directory : Overview : Directory ID

Client ID (App Registration) App Registrations : your app : Application (client) ID

Client Secret App Registrations : your app : Certificates and secrets

Report Delivery

Email Address (optional) Receive the full HTML report by email when the audit completes

Build Your Audit Package

Pick the scanners you want Select the Azure services you run from the scanners below. When you build your package, every scanner you tick runs against your subscription and the results are combined into a single prioritised report. Choose all of them, or just the services you actually run.

25 of 25 scanners selected

Storage and Data

Storage Accounts

Public access, HTTPS enforcement, TLS version, soft delete, network ACLs

SQL Database

TDE, auditing, public access, firewall rules, vulnerability assessment

Cosmos DB

Public network, IP/VNet rules, local auth, failover, CORS wildcard

PostgreSQL

SSL enforcement, public access, infra encryption, backup retention

MySQL

SSL enforcement, secure transport, public access, backup retention

Compute and Containers

Virtual Machines

Disk encryption, managed identity, OS login, auto-updates

AKS Kubernetes

RBAC, Azure AD integration, private cluster, network policy, node public IPs

App Service

HTTPS only, TLS version, remote debugging, HTTP/2, client certs

Azure Functions

HTTPS only, min TLS, App Service Auth, deprecated runtimes, CORS

Container Registry

Admin user, network default action, quarantine, content trust, retention

Logic Apps

HTTP trigger IP restrictions, open callers, connector endpoint exposure

Security and Identity

Key Vault

Soft delete, purge protection, network restrictions, RBAC authorization

Defender for Cloud

Defender plan tiers, security contacts, threat detection coverage

RBAC and Roles

Owner assignments, service principal access, classic admins, wildcard roles

Azure AD / Entra ID

Conditional access, MFA enforcement, legacy auth, guest users, SMS MFA

Networking and Edge

Network Security Groups

SSH/RDP exposed to internet, all-traffic rules, dangerous port exposure

VNet and DDoS

DDoS Standard plan, subnet NSG coverage, VNet flow logs

WAF and App Gateway

WAF enabled, prevention mode, WAF SKU, WAF policy state

Azure Firewall

Firewall presence, threat intel mode, SKU tier, DNS proxy

API Management

Deprecated TLS/SSL, VNet integration, gateway exposure

Messaging and Cache

Service Bus

Local auth, SKU tier, Premium network rules, minimum TLS

Event Hub

Local auth, minimum TLS, CMK, network rules, auto-inflate

Azure Cache for Redis

Non-SSL port, minimum TLS, public network, SKU, Redis version

Data Protection and Monitoring

Azure Backup

Vault presence, soft delete, geo-redundancy, multi-user authorization

Azure Monitor

Activity log exports, security operation alerts, Log Analytics workspace

Extended Service Coverage

These extended scanners cover the long tail of Azure services. They are optional and unchecked by default to keep a standard audit fast. Tick only what you run.

Extended AI, Analytics and Data

Cognitive Services / OpenAI

Public network, local auth (keys), custom subdomain

Machine Learning

Public network, HBI workspace, managed identity

Bot Service

Public network, local auth, isolated channels

Azure Quantum

Storage access, managed identity

Extended Integration and Messaging

Event Grid Topics

Public network, local auth, minimum TLS

Event Grid Domains

Public network, local auth, minimum TLS

Notification Hubs

Network rules, SAS policies

Relay

Local auth, network rules

SignalR

Public network, local auth, TLS client cert

Web PubSub

Public network, local auth, TLS

Data Share

Managed identity, snapshot exposure

API Center

Managed identity, access controls