Azure Baseline Explorer
Explore security baselines across Azure services. Filter by category, domain, and responsibility to identify gaps in your architecture.
Source: the per-service Azure security baselines for Microsoft Cloud Security Benchmark v1. Capability flags checked against those baselines on ; where the product documentation is newer than a baseline page, the newer behaviour is used and noted in the data source.
Select services for a review export, or jump straight to controls developers must configure.
Service Comparison Matrix
Compare key security capabilities across services. Click a row to drill into details.
| Review | Service | Burden | Private EP | Managed ID | Disable Local Auth | CMK | Defender | Features |
|---|---|---|---|---|---|---|---|---|
| Azure App Service Compute | High | ✓ | ✓ | ✓ | ✓ | ✓ | 10 | |
| Virtual Machines Compute | High | n/a | ✓ | ✓ | ✓ | ✓ | 10 | |
| Azure Functions Compute | Medium | ✓ | ✓ | ✓ | ✓ | ✓ | 7 | |
| Azure Front Door Networking | Medium | ✓ | n/a | n/a | n/a | ✗ | 6 | |
| Azure Firewall Networking | High | n/a | n/a | n/a | n/a | n/a | 8 | |
| VPN Gateway Networking | Medium | n/a | n/a | n/a | n/a | n/a | 6 | |
| Azure SQL Database Data & Storage | Medium | ✓ | ✓ | ✓ | ✓ | ✓ | 8 | |
| Storage Account Data & Storage | Medium | ✓ | ✓ | ✓ | ✓ | ✓ | 8 | |
| Service Bus Messaging & Events | Medium | ✓ | ✓ | ✓ | ✓ | n/a | 9 | |
| Event Hubs Messaging & Events | Medium | ✓ | ✓ | ✓ | ✓ | n/a | 8 | |
| Microsoft Entra ID Identity & Security | High | n/a | n/a | n/a | n/a | n/a | 8 | |
| Microsoft Defender for Cloud Identity & Security | High | n/a | ✓ | n/a | ✓ | n/a | 9 | |
| Microsoft Sentinel Identity & Security | High | n/a | ✓ | n/a | ✓ | n/a | 8 | |
| Key Vault Data & Storage | Medium | ✓ | ✓ | n/a | ✓ | ✓ | 8 | |
| Cosmos DB Data & Storage | Medium | ✓ | ✓ | ✓ | ✓ | ✓ | 6 | |
| AKS Containers | High | ✓ | ✓ | ✓ | ✓ | ✓ | 10 | |
| Azure Container Registry Containers | Low | ✓ | ✓ | ✓ | ✓ | ✓ | 4 | |
| Application Gateway Networking | Medium | ✓ | ✗ | n/a | n/a | n/a | 6 | |
| Azure Bastion Networking | Low | n/a | n/a | n/a | n/a | n/a | 5 | |
| ExpressRoute Networking | Medium | n/a | n/a | n/a | n/a | n/a | 5 | |
| Azure Cache for Redis Data & Storage | Medium | ✓ | ✗ | ✓ | ✗ | n/a | 6 | |
| Azure Database for PostgreSQL Data & Storage | Medium | ✓ | ✓ | ✓ | ✓ | ✓ | 8 | |
| Log Analytics Workspace Management | Low | ✓ | ✓ | n/a | ✓ | n/a | 5 | |
| Azure Data Factory Data & Storage | Medium | ✓ | ✓ | ✓ | ✓ | n/a | 7 | |
| Azure Container Apps Compute | Medium | ✓ | ✓ | n/a | n/a | n/a | 6 | |
| Azure Virtual Desktop Compute | High | ✓ | ✓ | n/a | n/a | ✓ | 8 | |
| API Management Integration | Medium | ✓ | ✓ | ✓ | n/a | ✓ | 7 |
Burden = customer-owned controls you must configure by hand, plus applicable capabilities the service lacks. n/a capabilities are excluded, so network appliances aren’t penalised for having no private endpoint. Capability flags follow the per-service Microsoft Cloud Security Benchmark baselines.