Security assessment

Cloud Security Assessment

Section 1

Executive Summary

Security Assessment Summary

contoso-demo

Report generated 10 November 2026

Critical Risk

Security findings in report

1431

+ 117 architecture review(s), not included

High-priority finding groups

110

Attack Path Findings

431

Resources Assessed

5820

Why this rating

Rated Critical on the evidence below. Each point is a measured result from this assessment, not an estimate.

515 confirmed attack path(s) were identified. Of 431 attack-path finding(s), 337 are critical. The remediation analysis includes privileged or sensitive targets.
324 internet-exposed resource finding(s) are critical severity.
2% of assessed resources (109 of 5820) carry high or critical findings.

This report describes the assessment as it stood on 10 November 2026. The ARGOS dashboard links in it always show your current posture, which may differ.

Assessment overview

The assessment identifies confirmed attack paths involving privileged or sensitive targets, alongside internet-exposed findings and security issues affecting storage, web, network security, cache and cognitive-services resources. A verified remediation plan is available and its analysed outcome covers the confirmed attack paths, but this is a projected result of implementing the plan rather than evidence that remediation has occurred. Potential paths requiring further validation remain outside the confirmed-path analysis because effective access could not be established with sufficient confidence. Network review is also recommended, and service retirements include unsupported platforms.

Priorities

Follow the published action order by first reducing the unresolved Owner assignment at subscription scope, then reducing the subscription-level access held by Contoso Cloud - Projects Team, followed by reducing Sam Taylor's subscription-level access. Each action should replace broad Owner permissions with access limited to genuine operational need; the stated path reduction remains an analysed projection until changes are implemented and verified. Next, validate replacement services and migration paths for affected Basic Public IP and Basic Load Balancer resources, then schedule their migration, as these services are past retirement. The verified plan addresses confirmed attack paths, while the potential paths requiring validation should be investigated separately.

Assessment Policy Scope

The scan policy sets this assessment ran with, per connection. Rules a connection's policy sets excluded were not evaluated there: their state is unknown, not passed.

Connection	Policy sets	Rules run	Rules excluded	Outcome
Dev (Azure)	All ARGOS Rules	266	0	Rules evaluated Applied 2026-11-10 12:10 UTC

Findings by severity

Most triggered controls

Control	Open findings
Azure NSG is allowing unrestricted RDP Access from internet	424
Attack Path: Principal can extract a Storage Account's access keys or generate a SAS	273
Storage Accounts lack immutable storage protection against ransomware	45
Azure Storage Account does not use infrastructure (double) encryption (architecture review)	45
Azure Storage Account has no approved private endpoint connection (benchmark deviation, architecture review)	45

Section 2

Attack path examples

Up to three distinct finding types, selected by finding severity. These are illustrative paths with confirmed overall classification. Individual display relationships may require further validation, as shown in their evidence. A scenario does not establish that an attacker has compromised the environment.

Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process

ARGOS verified this standing privilege and the access it reaches.

Entry point: f39a965a9abe7ac328578764.

The diagram shows the stored path relationships. Names are shown where available; otherwise identifiers are used. Scroll horizontally if needed.

From	Relationship	To	Evidence
6945d750-ef98-4624-aafe-fd9cd5e8ecf5	AssignedTo	/providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/ecf68ece-61e5-4ee8-adb8-3376e2435422	verified
/providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/ecf68ece-61e5-4ee8-adb8-3376e2435422	PermissionInheritedTo	/subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82	verified
/subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82	PermissionInheritedTo	/subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg	verified
/subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg	CanExtractCredential	/subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	verified

Assumptions to validate

Azure MFA enforcement applies to relevant resource modifications here, through policy assignment Microsoft Azure Multi Factor Authentication Enforcement for Resource Delete Actions (/providers/Microsoft.Management/managementGroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/Microsoft.Authorization/policyAssignments/sys.mfa-delete) at /providers/Microsoft.Management/managementGroups/97a795e8-b7fb-430c-af82-ecbc152813a6 (DenyAction); policy assignment Microsoft Azure Multi Factor Authentication Enforcement for Resource Write Actions (/providers/Microsoft.Management/managementGroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/Microsoft.Authorization/policyAssignments/sys.mfa-write) at /providers/Microsoft.Management/managementGroups/97a795e8-b7fb-430c-af82-ecbc152813a6 (Deny). It tests the CALLER rather than the resource, and its rule fires only where the request identity type is a user - so it does not constrain a managed identity or a service principal. Azure may refuse an individual request whose authentication claims do not satisfy it; the standing privilege itself is unchanged, and a compromised session or a valid access token that already satisfies the requirement is not constrained by it.

Relationship evidence

f39a965a9abe7ac328578764 holds the 'Contributor' role assignment at management-group or tenant-root scope. (Verified, AzureRbac)
The assignment is scoped at a management group, and this subscription's own Azure role-assignment listing returned it - Azure resolves inheritance from containing management groups when it answers that listing. (Verified, AzureRbac)
The assignment is scoped at a management group, and this subscription's own Azure role-assignment listing returned it - Azure resolves inheritance from containing management groups when it answers that listing. (Verified, AzureRbac)
The 'Contributor' role applies to Storage Account. (Verified, AzureRbac)

Ensure that App Services Functions are not accessible by anybody from the Internet

ARGOS verified the downstream access this workload would have if compromised.

Entry point: orderproducts1.

The diagram shows the stored path relationships. Names are shown where available; otherwise identifiers are used. Scroll horizontally if needed.

From	Relationship	To	Evidence
/subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	RunsAs	bcab44f7-2dc0-486d-a224-54955648d810/identity	verified

Assumptions to validate

An attacker can reach a listening service on orderproducts1 from the internet and execute code on it. ARGOS has read that it is configured to allow public network access; it has not evaluated its access restrictions, any private endpoint in front of it, or whether authentication is enforced before a request reaches application code.

Relationship evidence

orderproducts1 is configured to allow public network access and runs as a managed identity, so code executing on it acts with that identity's permissions. (Verified, AzureResourceConfiguration)

Ensure that App Services Web Apps are not accessible by anybody from the Internet

ARGOS verified the downstream access this workload would have if compromised.

Entry point: webappcontosotest.

The diagram shows the stored path relationships. Names are shown where available; otherwise identifiers are used. Scroll horizontally if needed.

From	Relationship	To	Evidence
/subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	RunsAs	e6687757-a43e-4436-a3a9-8942f008a380/identity	verified

Assumptions to validate

An attacker can reach a listening service on webappcontosotest from the internet and execute code on it. ARGOS has read that it is configured to allow public network access; it has not evaluated its access restrictions, any private endpoint in front of it, or whether authentication is enforced before a request reaches application code.

Relationship evidence

webappcontosotest is configured to allow public network access and runs as a managed identity, so code executing on it acts with that identity's permissions. (Verified, AzureResourceConfiguration)

Section 3

Recommended Actions

Recommended Remediation Plan

✓ REPLAY-VERIFIED ARGOS replayed the 24 recommended action(s) against the confirmed attack-path graph. The modelled effect is shown below and must be validated after implementation.

Attack-path analysis confidence: Medium. Some choke points are not backed by a concrete, actionable control, so the analysis cannot name what to change there.

Remediation impact

Stage

Confirmed paths remaining

Removed

Current

515 confirmed path(s)

—

Top 1 action

435 remaining

80 (15.5%)

Top 3 actions

275 remaining

240 (46.6%)

Top 5 actions

117 remaining

398 (77.3%)

Full published plan

0 remaining

515 (100%)

The three highest-impact actions remove 46.6% of confirmed attack paths. The full plan removes 100%. Each stage counts DISTINCT paths: actions overlap, so their individual figures must not be added together.

Highest-impact remediation actions

Ranked by risk priority, then by the confirmed attack paths each action closes that the actions above it do not. Individual path counts overlap and must not be added together. Priority reflects risk (the attack mechanism closed, finding impact and, where known, production status); effort is the relative amount of change work, not a monetary cost; and the implementation plan below lists the actions in a suggested order, which does not establish dependencies between them.

Path closure is verified against ARGOS's attack-path graph: the change removes the modelled relationships these paths depend on. It does not validate that dependent workloads keep working - complete the prerequisites and validation steps before and after the change.

1. Review unresolved Owner assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 HIGH HIGH CONFIDENCE

Do this: Remove or scope down the Owner role assignment granting principal 2eb4f07f-c67d-441e-a51c-3014874798ac access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path. This Azure RBAC assignment references principal 2eb4f07f-c67d-441e-a51c-3014874798ac, which ARGOS could not resolve against the current Entra ID or managed identity inventory. That is an observation, not proof the identity was deleted - a foreign or guest identity, a principal type ARGOS does not inventory, an incomplete identity collection or a transient inventory inconsistency all look the same from here. Verify whether the identity still exists. If it no longer exists, or the assignment is no longer required, remove role assignment /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966 (role: Owner) at scope /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82.

Closes 80 confirmed path(s), 80 additional beyond the higher-ranked actions. Cumulative after this action: 80. Findings affected: 67. Effort: Low. Suggested position in the plan: 17.

2. Reduce Contoso Cloud - Projects Team's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 HIGH HIGH CONFIDENCE

Do this: Remove or scope down the Owner role assignment granting principal Contoso Cloud - Projects Team access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/71fedb2c-68f7-447b-ace4-1fe0455939bc. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Closes 80 confirmed path(s), 80 additional beyond the higher-ranked actions. Cumulative after this action: 160. Findings affected: 67. Effort: Low. Suggested position in the plan: 18.

3. Reduce Sam Taylor's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 HIGH HIGH CONFIDENCE

Do this: Remove or scope down the Owner role assignment granting principal Sam Taylor access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/65d59f2f-05f2-45ec-a89e-b47c683a897a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Closes 80 confirmed path(s), 80 additional beyond the higher-ranked actions. Cumulative after this action: 240. Findings affected: 67. Effort: Low. Suggested position in the plan: 19.

Suggested remediation timeline

Within 7 days1 scheduled entry

Within 30 days20 scheduled entries

Within 90 days5 scheduled entries

Counts include plan actions and assessment priorities listed below; entries may overlap. Fixed deadlines are shown separately.

Overdue: Migrate from Public IP address (Basic SKU) before 2025-09-30 (2025-09-30).

Overdue: Migrate from Load balancer (Basic Load Balancer) before 2025-09-30 (2025-09-30).

Overdue: Migrate from Storage Account (Support for TLS 1.0 and 1.1) before 2026-02-03 (2026-02-03).

These are planning targets, not delivery estimates. Confirm owners, change windows and all prerequisites. Start validation and preparation now; follow the implementation order and dependencies below even when a target window is earlier.

Show all target windows and deadlines

Sorted by target. Plan order identifies the suggested implementation sequence; check prerequisites before acting.

Target	Suggested action and specific change	Readiness	Change effort
Overdue: 2025-09-30	Migrate from Public IP address (Basic SKU) before 2025-09-30 (Service retirement) Validate the replacement service and migration path now, then schedule the migration of the affected resources.	Review	To confirm
Overdue: 2025-09-30	Migrate from Load balancer (Basic Load Balancer) before 2025-09-30 (Service retirement) Validate the replacement service and migration path now, then schedule the migration of the affected resources.	Review	To confirm
Overdue: 2026-02-03	Migrate from Storage Account (Support for TLS 1.0 and 1.1) before 2026-02-03 (Service retirement) Validate the replacement service and migration path now, then schedule the migration of the affected resources.	Review	To confirm
Within 7 days	Restrict Public App Service and Function Ingress (Systemic) Remove unrestricted internet access from the affected App Services and Functions. Allow only approved clients and routes, and use private connectivity for administrative and backend access.	Review	To confirm
Within 30 days	Reduce contoso-contributor's access to resource group team-dev-rg (plan order 1) Remove or scope down the Contributor role assignment granting principal contoso-contributor access to team-dev-rg. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/ad53b955-e8db-4722-a959-9eb5145d3612. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce Jordan Lee's access to resource group team-dev-rg (plan order 2) Remove or scope down the Contributor role assignment granting principal Jordan Lee access to team-dev-rg. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/74e3fccd-a6cb-4913-a870-f7dde226a5db. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce orderproducts1's access to importantsql (plan order 3) Remove or scope down the Contributor role assignment granting principal orderproducts1 access to importantsql. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql/providers/microsoft.authorization/roleassignments/7baeb04f-7b2f-464f-af47-02709d921880. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce webappcontosotest's access to dummysacontoso (plan order 4) Scope down or remove the role assignment granting principal webappcontosotest access to dummysacontoso (dummysacontoso). Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso/providers/microsoft.authorization/roleassignments/105a9a0b-8bac-484b-a4ce-ed322d011e6f. Matched action(s): Microsoft.Storage/storageAccounts/listKeys/action, Microsoft.Storage/storageAccounts/listAccountSas/action. If access is still required, replace this assignment with a custom role that excludes Microsoft.Storage/storageAccounts/listKeys/action, Microsoft.Storage/storageAccounts/listAccountSas/action. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce orderproducts1's access to contosolocaldev (plan order 5) Remove or scope down the Contributor role assignment granting principal orderproducts1 access to contosolocaldev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/b3308c7e-ef4b-413a-a98e-b815131bd426. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce web002's access to contosolocaldev (plan order 6) Remove or scope down the Contributor role assignment granting principal web002 access to contosolocaldev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/18b9926e-0a0b-4d2f-a2b2-8ee6c51618b8. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce jumpbox's access to kvaueprd (plan order 7) Scope down or remove the role assignment granting principal jumpbox access to kvaueprd (Key Vault). Replace it with a least-privilege role granting only the access the principal genuinely needs.	Manual validation required	Low
Within 30 days	Reduce 370a931473355be74a9dc3ad's access to dev (plan order 8) Remove or scope down the Contributor role assignment granting principal 370a931473355be74a9dc3ad access to dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/80a336f6-ef1b-4171-a2da-0e1fe7c48e21. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Not assessed	Trivial
Within 30 days	Reduce Sam Taylor's access to dev (plan order 9) Remove or scope down the Owner role assignment granting principal Sam Taylor access to dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/f2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Not assessed	Trivial
Within 30 days	Reduce Sam Taylor's access to contoso-foundry-dev (plan order 10) Remove or scope down the Foundry Account Owner role assignment granting principal Sam Taylor access to contoso-foundry-dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/providers/microsoft.authorization/roleassignments/65808402-f39f-45b1-a283-dfc78ab071b2. Matched action(s): Microsoft.Authorization/roleAssignments/delete. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/delete. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Not assessed	Trivial
Within 30 days	Reduce Jordan Lee's access to dc001 (plan order 11) Remove or scope down the Contributor role assignment granting principal Jordan Lee access to dc001. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/dc001/providers/microsoft.authorization/roleassignments/65921218-7b1a-4a24-a840-34e0f5d7c01a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Not assessed	Trivial
Within 30 days	Reduce Sam Taylor's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 (plan order 12) Remove or scope down the User Access Administrator role assignment granting principal Sam Taylor access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.authorization/roleassignments/18904bce-fe9c-49bf-ad19-08d411a454c6. Matched action(s): Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Not assessed	Low
Within 30 days	Reduce Contoso Cloud - Projects Team's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 (plan order 13) Remove or scope down the User Access Administrator role assignment granting principal Contoso Cloud - Projects Team access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/5c690fb6-febc-42e2-a799-11984ff9c7e0. Matched action(s): Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Not assessed	Low
Within 30 days	Reduce 7e310e21f217b02ca2bb0892's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 (plan order 14) Remove or scope down the Contributor role assignment granting principal 7e310e21f217b02ca2bb0892 access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/55d108d7-2db1-4d70-aeb0-49495e8fe57a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce contoso-github-actions's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 (plan order 15) Remove or scope down the Contributor role assignment granting principal contoso-github-actions access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/f96e4f8a-75e9-4fda-a0fc-7fef24a18aea. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce f39a965a9abe7ac328578764's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 (plan order 16) Remove or scope down the Contributor role assignment granting principal f39a965a9abe7ac328578764 access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/ecf68ece-61e5-4ee8-adb8-3376e2435422. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Review unresolved Owner assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 (plan order 17) Remove or scope down the Owner role assignment granting principal 2eb4f07f-c67d-441e-a51c-3014874798ac access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path. This Azure RBAC assignment references principal 2eb4f07f-c67d-441e-a51c-3014874798ac, which ARGOS could not resolve against the current Entra ID or managed identity inventory. That is an observation, not proof the identity was deleted - a foreign or guest identity, a principal type ARGOS does not inventory, an incomplete identity collection or a transient inventory inconsistency all look the same from here. Verify whether the identity still exists. If it no longer exists, or the assignment is no longer required, remove role assignment /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966 (role: Owner) at scope /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82.	Manual validation required	Low
Within 30 days	Reduce Contoso Cloud - Projects Team's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 (plan order 18) Remove or scope down the Owner role assignment granting principal Contoso Cloud - Projects Team access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/71fedb2c-68f7-447b-ace4-1fe0455939bc. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Reduce Sam Taylor's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 (plan order 19) Remove or scope down the Owner role assignment granting principal Sam Taylor access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/65d59f2f-05f2-45ec-a89e-b47c683a897a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.	Manual validation required	Low
Within 30 days	Restrict east-west connectivity with subnet-level network security groups (Network) Attach workload-aligned network security groups to the unprotected subnets and restrict flows to the application paths each workload actually needs.	Review	To confirm
Within 90 days	Remove public exposure from jumpbox (plan order 20) Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.	Manual validation required	Low
Within 90 days	Remove public exposure from web002 (plan order 21) Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.	Manual validation required	Low
Within 90 days	Remove public exposure from webserver001 (plan order 22) Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.	Manual validation required	Low
Within 90 days	Remove public exposure from orderproducts1 (plan order 23) Restrict public access to this App Service: place it behind Azure Application Gateway or Front Door with a Web Application Firewall, and use Access Restrictions (or a Private Endpoint) to limit inbound traffic to trusted sources. This closes every attack path that starts by reaching this App Service from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.	Manual validation required	Low
Within 90 days	Remove public exposure from webappcontosotest (plan order 24) Restrict public access to this App Service: place it behind Azure Application Gateway or Front Door with a Web Application Firewall, and use Access Restrictions (or a Private Endpoint) to limit inbound traffic to trusted sources. This closes every attack path that starts by reaching this App Service from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.	Manual validation required	Low

Suggested order: follow the modelled prerequisites; where dependencies allow, consider quick wins before major projects. ARGOS models only the dependencies listed, does not know every application dependency, and does not track completion of manual validation. Preparatory tasks and validation gates close no attack paths themselves and are not counted in the plan's cut size or impact. Effort is relative, not a delivery estimate.

Full implementation plan (24 actions)

Risk / effort	Low effort	High effort
High risk	Quick wins (7) - do first. Suggested actions 1, 2, 3, 4, 5, 6, 7	Major projects (6) - plan and resource them. Suggested actions 14, 15, 16, 17, 18, 19
Low risk	Fill-ins (5) - fit in where convenient. Suggested actions 20, 21, 22, 23, 24	Defer (0) - schedule after the rest.

High risk: Immediate or High risk priority. High effort: the change or its preparation is Medium or High. A modelled dependency always comes first, so a major project's preparation can still precede a quick win that depends on nothing.

1. Reduce contoso-contributor's access to resource group team-dev-rg HIGH HIGH CONFIDENCE QUICK WIN

Scope contoso-contributor's role assignment on resource group team-dev-rg to least-privilege scope

Change effort
Low
Preparation
Low (2 steps)

Findings resolved
2

Findings neutralised
0

Attack paths removed
2

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 10). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

Replacement identity and access are in place, and its clients are validated - Give the workloads and pipelines that use this access their own Microsoft Entra identity with the least-privileged data-plane role they need, migrate them off the keys or local credentials this assignment can read, and confirm each still works. Then remove this assignment, and rotate the keys or credentials it could read once nothing uses them.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and its clients are validated (see "Before you change anything" above)
Principal: ab8fe3bb-7c8e-428d-ad23-c40bb97a4f33 · Scope: resource group team-dev-rg
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: ab8fe3bb-7c8e-428d-ad23-c40bb97a4f33
This change (suggested action 1)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: contoso-contributor currently has a role assignment granting access at a broad scope over resource group team-dev-rg.

Security risk: If contoso-contributor is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 2 attack paths.

Do this: Remove or scope down the Contributor role assignment granting principal contoso-contributor access to team-dev-rg. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/ad53b955-e8db-4722-a959-9eb5145d3612. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Target state: Use the principle of least privilege in Azure RBAC: assign only the narrowest role at the narrowest scope needed (a single resource before a resource group, a resource group before a subscription). Where only data access is needed, prefer a data-plane role (e.g., Key Vault Secrets User, Storage Blob Data Reader) over a control-plane role (e.g., Contributor, Owner).

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal contoso-contributor access to team-dev-rg. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/ad53b955-e8db-4722-a959-9eb5145d3612. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and its clients are validated - Give the workloads and pipelines that use this access their own Microsoft Entra identity with the least-privileged data-plane role they need, migrate them off the keys or local credentials this assignment can read, and confirm each still works. Then remove this assignment, and rotate the keys or credentials it could read once nothing uses them.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

2. Reduce Jordan Lee's access to resource group team-dev-rg HIGH HIGH CONFIDENCE QUICK WIN

Scope Jordan Lee's role assignment on resource group team-dev-rg to least-privilege scope

Change effort
Low
Preparation
Low (2 steps)

Findings resolved
2

Findings neutralised
0

Attack paths removed
2

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 10). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

Replacement identity and access are in place, and its clients are validated - Give the workloads and pipelines that use this access their own Microsoft Entra identity with the least-privileged data-plane role they need, migrate them off the keys or local credentials this assignment can read, and confirm each still works. Then remove this assignment, and rotate the keys or credentials it could read once nothing uses them.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and its clients are validated (see "Before you change anything" above)
Principal: fb79fc1a-f1fb-4d3d-ad88-facf25f91be7 · Scope: resource group team-dev-rg
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: fb79fc1a-f1fb-4d3d-ad88-facf25f91be7
This change (suggested action 2)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: Jordan Lee currently has a role assignment granting access at a broad scope over resource group team-dev-rg.

Security risk: If Jordan Lee is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 2 attack paths.

Do this: Remove or scope down the Contributor role assignment granting principal Jordan Lee access to team-dev-rg. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/74e3fccd-a6cb-4913-a870-f7dde226a5db. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal Jordan Lee access to team-dev-rg. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/74e3fccd-a6cb-4913-a870-f7dde226a5db. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and its clients are validated - Give the workloads and pipelines that use this access their own Microsoft Entra identity with the least-privileged data-plane role they need, migrate them off the keys or local credentials this assignment can read, and confirm each still works. Then remove this assignment, and rotate the keys or credentials it could read once nothing uses them.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

3. Reduce orderproducts1's access to importantsql HIGH HIGH CONFIDENCE QUICK WIN

Scope orderproducts1's role assignment on importantsql to least-privilege scope

Change effort
Low
Preparation
Low (3 steps)

Findings resolved
10

Findings neutralised
0

Attack paths removed
9

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.

Dependency sequence

Preparatory task: The workload's narrower replacement access is in place (see "Before you change anything" above)
For 2 targets:
- Principal: bcab44f7-2dc0-486d-a224-54955648d810 · Scope: importantsql
- Principal: bcab44f7-2dc0-486d-a224-54955648d810 · Scope: contosolocaldev
Shared with suggested actions 3, 5.
Validation gate: The workload is validated on its narrower access
Deploy the narrower role and confirm every operation the workload performs still succeeds before the broader assignment is removed.
Mechanism: workload identity role · Principal: bcab44f7-2dc0-486d-a224-54955648d810 Shared with suggested actions 3, 5.
This change (suggested action 3)

Why first: Removing the broader assignment before the workload is validated on the narrower one breaks it.

Current state: orderproducts1 currently has a role assignment granting access at a broad scope over importantsql.

Security risk: If orderproducts1 is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 9 attack paths.

Do this: Remove or scope down the Contributor role assignment granting principal orderproducts1 access to importantsql. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql/providers/microsoft.authorization/roleassignments/7baeb04f-7b2f-464f-af47-02709d921880. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal orderproducts1 access to importantsql. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql/providers/microsoft.authorization/roleassignments/7baeb04f-7b2f-464f-af47-02709d921880. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

4. Reduce webappcontosotest's access to dummysacontoso HIGH HIGH CONFIDENCE QUICK WIN

Scope webappcontosotest's role assignment on dummysacontoso to least-privilege scope

Change effort
Low
Preparation
Low (2 steps)

Findings resolved
7

Findings neutralised
0

Attack paths removed
7

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 10). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

Replacement identity and access are in place, and its clients are validated - Give the workloads and pipelines that use this access their own Microsoft Entra identity with the least-privileged data-plane role they need, migrate them off the keys or local credentials this assignment can read, and confirm each still works. Then remove this assignment, and rotate the keys or credentials it could read once nothing uses them.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and its clients are validated (see "Before you change anything" above)
Principal: e6687757-a43e-4436-a3a9-8942f008a380 · Scope: dummysacontoso
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
Resource: dummysacontoso · Mechanism: access keys · Principal: e6687757-a43e-4436-a3a9-8942f008a380
This change (suggested action 4)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: webappcontosotest currently has a role assignment granting access at a broad scope over dummysacontoso.

Security risk: If webappcontosotest is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 7 attack paths.

Do this: Scope down or remove the role assignment granting principal webappcontosotest access to dummysacontoso (dummysacontoso). Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso/providers/microsoft.authorization/roleassignments/105a9a0b-8bac-484b-a4ce-ed322d011e6f. Matched action(s): Microsoft.Storage/storageAccounts/listKeys/action, Microsoft.Storage/storageAccounts/listAccountSas/action. If access is still required, replace this assignment with a custom role that excludes Microsoft.Storage/storageAccounts/listKeys/action, Microsoft.Storage/storageAccounts/listAccountSas/action. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Scope down or remove the role assignment granting principal webappcontosotest access to dummysacontoso (dummysacontoso). Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso/providers/microsoft.authorization/roleassignments/105a9a0b-8bac-484b-a4ce-ed322d011e6f. Matched action(s): Microsoft.Storage/storageAccounts/listKeys/action, Microsoft.Storage/storageAccounts/listAccountSas/action. If access is still required, replace this assignment with a custom role that excludes Microsoft.Storage/storageAccounts/listKeys/action, Microsoft.Storage/storageAccounts/listAccountSas/action. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and its clients are validated - Give the workloads and pipelines that use this access their own Microsoft Entra identity with the least-privileged data-plane role they need, migrate them off the keys or local credentials this assignment can read, and confirm each still works. Then remove this assignment, and rotate the keys or credentials it could read once nothing uses them.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

5. Reduce orderproducts1's access to contosolocaldev HIGH HIGH CONFIDENCE QUICK WIN

Scope orderproducts1's role assignment on contosolocaldev to least-privilege scope

Change effort
Low
Preparation
Low (3 steps)

Findings resolved
10

Findings neutralised
0

Attack paths removed
10

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources. Closes 10 confirmed paths.

Before you change anything

The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.

Dependency sequence

Preparatory task: The workload's narrower replacement access is in place (see "Before you change anything" above)
For 2 targets:
- Principal: bcab44f7-2dc0-486d-a224-54955648d810 · Scope: importantsql
- Principal: bcab44f7-2dc0-486d-a224-54955648d810 · Scope: contosolocaldev
Shared with suggested actions 3, 5.
Validation gate: The workload is validated on its narrower access
Deploy the narrower role and confirm every operation the workload performs still succeeds before the broader assignment is removed.
Mechanism: workload identity role · Principal: bcab44f7-2dc0-486d-a224-54955648d810 Shared with suggested actions 3, 5.
This change (suggested action 5)

Why first: Removing the broader assignment before the workload is validated on the narrower one breaks it.

Current state: orderproducts1 currently has a role assignment granting access at a broad scope over contosolocaldev.

Do this: Remove or scope down the Contributor role assignment granting principal orderproducts1 access to contosolocaldev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/b3308c7e-ef4b-413a-a98e-b815131bd426. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal orderproducts1 access to contosolocaldev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/b3308c7e-ef4b-413a-a98e-b815131bd426. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

6. Reduce web002's access to contosolocaldev HIGH HIGH CONFIDENCE QUICK WIN

Scope web002's role assignment on contosolocaldev to least-privilege scope

Change effort
Low
Preparation
Low (2 steps)

Findings resolved
9

Findings neutralised
0

Attack paths removed
9

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.

Dependency sequence

Preparatory task: The workload's narrower replacement access is in place (see "Before you change anything" above)
Principal: 812fc112-7499-4a45-abd7-2b5a2782da4d · Scope: contosolocaldev
Validation gate: The workload is validated on its narrower access
Deploy the narrower role and confirm every operation the workload performs still succeeds before the broader assignment is removed.
Mechanism: workload identity role · Principal: 812fc112-7499-4a45-abd7-2b5a2782da4d
This change (suggested action 6)

Why first: Removing the broader assignment before the workload is validated on the narrower one breaks it.

Current state: web002 currently has a role assignment granting access at a broad scope over contosolocaldev.

Security risk: If web002 is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 9 attack paths.

Do this: Remove or scope down the Contributor role assignment granting principal web002 access to contosolocaldev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/18b9926e-0a0b-4d2f-a2b2-8ee6c51618b8. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal web002 access to contosolocaldev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/18b9926e-0a0b-4d2f-a2b2-8ee6c51618b8. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

7. Reduce jumpbox's access to kvaueprd HIGH HIGH CONFIDENCE QUICK WIN

Scope jumpbox's role assignment on kvaueprd to least-privilege scope

Change effort
Low
Preparation
Low (2 steps)

Findings resolved
7

Findings neutralised
0

Attack paths removed
7

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 8). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.

Dependency sequence

Preparatory task: The workload's narrower replacement access is in place (see "Before you change anything" above)
Principal: f7dc8f85-3c59-4258-ad82-aabcce3ba0f5 · Scope: kvaueprd
Validation gate: The workload is validated on its narrower access
Deploy the narrower role and confirm every operation the workload performs still succeeds before the broader assignment is removed.
Mechanism: workload identity role · Principal: f7dc8f85-3c59-4258-ad82-aabcce3ba0f5
This change (suggested action 7)

Why first: Removing the broader assignment before the workload is validated on the narrower one breaks it.

Current state: jumpbox currently has a role assignment granting access at a broad scope over kvaueprd.

Security risk: If jumpbox is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 7 attack paths.

Do this: Scope down or remove the role assignment granting principal jumpbox access to kvaueprd (Key Vault). Replace it with a least-privilege role granting only the access the principal genuinely needs.

Implementation steps

Review impact - Scope down or remove the role assignment granting principal jumpbox access to kvaueprd (Key Vault). Replace it with a least-privilege role granting only the access the principal genuinely needs.
Prerequisite - validate before changing anything: The workload's narrower replacement access is in place - Grant the role and scope the workload actually needs, deploy and validate it, then remove this assignment. Removing it first breaks a workload that legitimately depends on part of the access.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

8. Reduce 370a931473355be74a9dc3ad's access to dev HIGH HIGH CONFIDENCE

Scope 370a931473355be74a9dc3ad's role assignment on dev to least-privilege scope

Change effort
Trivial
Preparation
Not established

Findings resolved
1

Findings neutralised
0

Attack paths removed
1

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 8). Business criticality is unknown: no environment tag was observed on the affected resources.

Current state: 370a931473355be74a9dc3ad currently has a role assignment granting access at a broad scope over dev.

Security risk: If 370a931473355be74a9dc3ad is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of an attack path.

Do this: Remove or scope down the Contributor role assignment granting principal 370a931473355be74a9dc3ad access to dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/80a336f6-ef1b-4171-a2da-0e1fe7c48e21. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal 370a931473355be74a9dc3ad access to dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/80a336f6-ef1b-4171-a2da-0e1fe7c48e21. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

9. Reduce Sam Taylor's access to dev HIGH HIGH CONFIDENCE

Scope Sam Taylor's role assignment on dev to least-privilege scope

Change effort
Trivial
Preparation
Not established

Findings resolved
3

Findings neutralised
0

Attack paths removed
2

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources.

Current state: Sam Taylor currently has a role assignment granting access at a broad scope over dev.

Security risk: If Sam Taylor is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 2 attack paths.

Do this: Remove or scope down the Owner role assignment granting principal Sam Taylor access to dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/f2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Owner role assignment granting principal Sam Taylor access to dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/f2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

10. Reduce Sam Taylor's access to contoso-foundry-dev HIGH HIGH CONFIDENCE

Scope Sam Taylor's role assignment on contoso-foundry-dev to least-privilege scope

Change effort
Trivial
Preparation
Not established

Findings resolved
3

Findings neutralised
0

Attack paths removed
2

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources.

Current state: Sam Taylor currently has a role assignment granting access at a broad scope over contoso-foundry-dev.

Do this: Remove or scope down the Foundry Account Owner role assignment granting principal Sam Taylor access to contoso-foundry-dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/providers/microsoft.authorization/roleassignments/65808402-f39f-45b1-a283-dfc78ab071b2. Matched action(s): Microsoft.Authorization/roleAssignments/delete. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/delete. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Foundry Account Owner role assignment granting principal Sam Taylor access to contoso-foundry-dev. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/providers/microsoft.authorization/roleassignments/65808402-f39f-45b1-a283-dfc78ab071b2. Matched action(s): Microsoft.Authorization/roleAssignments/delete. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/delete. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

11. Reduce Jordan Lee's access to dc001 HIGH HIGH CONFIDENCE

Scope Jordan Lee's role assignment on dc001 to least-privilege scope

Change effort
Trivial
Preparation
Not established

Findings resolved
1

Findings neutralised
0

Attack paths removed
1

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 8). Business criticality is unknown: no environment tag was observed on the affected resources.

Current state: Jordan Lee currently has a role assignment granting access at a broad scope over dc001.

Do this: Remove or scope down the Contributor role assignment granting principal Jordan Lee access to dc001. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/dc001/providers/microsoft.authorization/roleassignments/65921218-7b1a-4a24-a840-34e0f5d7c01a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal Jordan Lee access to dc001. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/dc001/providers/microsoft.authorization/roleassignments/65921218-7b1a-4a24-a840-34e0f5d7c01a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

12. Reduce Sam Taylor's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 HIGH HIGH CONFIDENCE

Scope Sam Taylor's role assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 to least-privilege scope

Change effort
Low
Preparation
Not established

Findings resolved
4

Findings neutralised
0

Attack paths removed
2

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources.

Current state: Sam Taylor currently has a role assignment granting access at a broad scope over subscription 56914835-2c07-4bdf-a088-72e94ee7eb82.

Do this: Remove or scope down the User Access Administrator role assignment granting principal Sam Taylor access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.authorization/roleassignments/18904bce-fe9c-49bf-ad19-08d411a454c6. Matched action(s): Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the User Access Administrator role assignment granting principal Sam Taylor access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.authorization/roleassignments/18904bce-fe9c-49bf-ad19-08d411a454c6. Matched action(s): Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

13. Reduce Contoso Cloud - Projects Team's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 HIGH HIGH CONFIDENCE

Scope Contoso Cloud - Projects Team's role assignment on 97a795e8-b7fb-430c-af82-ecbc152813a6 to least-privilege scope

Change effort
Low
Preparation
Not established

Findings resolved
4

Findings neutralised
0

Attack paths removed
2

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources.

Current state: Contoso Cloud - Projects Team currently has a role assignment granting access at a broad scope over 97a795e8-b7fb-430c-af82-ecbc152813a6.

Security risk: If Contoso Cloud - Projects Team is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 2 attack paths.

Do this: Remove or scope down the User Access Administrator role assignment granting principal Contoso Cloud - Projects Team access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/5c690fb6-febc-42e2-a799-11984ff9c7e0. Matched action(s): Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the User Access Administrator role assignment granting principal Contoso Cloud - Projects Team access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/5c690fb6-febc-42e2-a799-11984ff9c7e0. Matched action(s): Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

14. Reduce 7e310e21f217b02ca2bb0892's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 HIGH HIGH CONFIDENCE MAJOR PROJECT

Scope 7e310e21f217b02ca2bb0892's role assignment on 97a795e8-b7fb-430c-af82-ecbc152813a6 to least-privilege scope

Change effort
Low
Preparation
High (58 steps)

Findings resolved
65

Findings neutralised
0

Attack paths removed
79

Why this priority: Closes a confirmed privilege exposure. Involves a high-impact finding (score 10). Business criticality is unknown: no environment tag was observed on the affected resources. Closes 79 confirmed paths.

Before you change anything

Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and pipelines are validated (see "Before you change anything" above)
Principal: 801256c9-cc77-4531-af67-b477812e0b95 · Scope: 97a795e8-b7fb-430c-af82-ecbc152813a6
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
For 57 targets:
- Resource: argstacct003 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosocontosojump081015360 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service function keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevrgb75f · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct198 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: webappcontosotest · Mechanism: app service publishing credentials · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: functionsconsumptio9fc6 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: orderproducts1 · Mechanism: app service application settings · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevbaddev3sa · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct200 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: auth0test · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: orderproducts1 · Mechanism: app service key replacement · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service host keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct006 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: vdxfvsdfsdfv · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: storageaccountfunct936f · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevrgb910 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct001 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevbaddev2sa · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: sflogscontosodevcluste2038 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: dsfsdfsdfgff · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: rewrfaeraewrfaesrfasef · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevrg8ae3 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: jdhalfkjadhflaskh · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct002 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: orderproducts1 · Mechanism: app service host keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct199 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service application settings · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevbaddev0sa · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosocontosodb00081013560 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosocontosofile081015510 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosocontosoweb0081015270 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosocontosodb00081015100 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: cs110032000f71044ed · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct008 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: orderproducts1 · Mechanism: app service publishing credentials · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: azureiamparking · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct004 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: yetanotherbad2 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: dummysacontoso · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: storageaccountcontosobfbe · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: orderproducts1 · Mechanism: app service function keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct197 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: yetanotherbadstorage · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct007 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevbaddev1sa · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosocontosodb00081014340 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service publishing credentials · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service key replacement · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevinsecurergba9f · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: contosodevbaddev4sa · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: newcontosobadsa · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct005 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: cs1100320034a5146ba · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: argstacct196 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
- Resource: storageaccountcontoso8298 · Mechanism: access keys · Principal: 801256c9-cc77-4531-af67-b477812e0b95
This change (suggested action 14)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: 7e310e21f217b02ca2bb0892 currently has a role assignment granting access at a broad scope over 97a795e8-b7fb-430c-af82-ecbc152813a6.

Security risk: If 7e310e21f217b02ca2bb0892 is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 79 attack paths.

Do this: Remove or scope down the Contributor role assignment granting principal 7e310e21f217b02ca2bb0892 access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/55d108d7-2db1-4d70-aeb0-49495e8fe57a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal 7e310e21f217b02ca2bb0892 access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/55d108d7-2db1-4d70-aeb0-49495e8fe57a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

15. Reduce contoso-github-actions's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 HIGH HIGH CONFIDENCE MAJOR PROJECT

Scope contoso-github-actions's role assignment on 97a795e8-b7fb-430c-af82-ecbc152813a6 to least-privilege scope

Change effort
Low
Preparation
High (58 steps)

Findings resolved
65

Findings neutralised
0

Attack paths removed
79

Before you change anything

Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and pipelines are validated (see "Before you change anything" above)
Principal: 67d029fa-3f7d-454f-a851-932048b1b074 · Scope: 97a795e8-b7fb-430c-af82-ecbc152813a6
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
For 57 targets:
- Resource: contosodevbaddev2sa · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevrgb910 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevbaddev3sa · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: dsfsdfsdfgff · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct200 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: dummysacontoso · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service application settings · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: orderproducts1 · Mechanism: app service function keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevbaddev1sa · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevinsecurergba9f · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: vdxfvsdfsdfv · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: orderproducts1 · Mechanism: app service key replacement · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevbaddev0sa · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct007 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct004 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: auth0test · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: storageaccountcontoso8298 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct199 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct197 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: functionsconsumptio9fc6 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct196 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevrgb75f · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: storageaccountcontosobfbe · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: orderproducts1 · Mechanism: app service application settings · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: cs1100320034a5146ba · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct198 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosocontosodb00081014340 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct008 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service function keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosocontosofile081015510 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct003 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct001 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct002 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: sflogscontosodevcluste2038 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: newcontosobadsa · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: orderproducts1 · Mechanism: app service publishing credentials · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: jdhalfkjadhflaskh · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: cs110032000f71044ed · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: yetanotherbadstorage · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosocontosoweb0081015270 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: rewrfaeraewrfaesrfasef · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevbaddev4sa · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct005 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service host keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: orderproducts1 · Mechanism: app service host keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: azureiamparking · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosocontosodb00081015100 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: storageaccountfunct936f · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: yetanotherbad2 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: webappcontosotest · Mechanism: app service publishing credentials · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service key replacement · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service publishing credentials · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosocontosodb00081013560 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: argstacct006 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosocontosojump081015360 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
- Resource: contosodevrg8ae3 · Mechanism: access keys · Principal: 67d029fa-3f7d-454f-a851-932048b1b074
This change (suggested action 15)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: contoso-github-actions currently has a role assignment granting access at a broad scope over 97a795e8-b7fb-430c-af82-ecbc152813a6.

Security risk: If contoso-github-actions is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 79 attack paths.

Do this: Remove or scope down the Contributor role assignment granting principal contoso-github-actions access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/f96e4f8a-75e9-4fda-a0fc-7fef24a18aea. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal contoso-github-actions access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/f96e4f8a-75e9-4fda-a0fc-7fef24a18aea. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

16. Reduce f39a965a9abe7ac328578764's access to 97a795e8-b7fb-430c-af82-ecbc152813a6 HIGH HIGH CONFIDENCE MAJOR PROJECT

Scope f39a965a9abe7ac328578764's role assignment on 97a795e8-b7fb-430c-af82-ecbc152813a6 to least-privilege scope

Change effort
Low
Preparation
High (58 steps)

Findings resolved
65

Findings neutralised
0

Attack paths removed
79

Before you change anything

Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and pipelines are validated (see "Before you change anything" above)
Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5 · Scope: 97a795e8-b7fb-430c-af82-ecbc152813a6
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
For 57 targets:
- Resource: contosocontosodb00081014340 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct002 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: newcontosobadsa · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosocontosojump081015360 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: dummysacontoso · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: dsfsdfsdfgff · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: orderproducts1 · Mechanism: app service key replacement · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: jdhalfkjadhflaskh · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct003 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service publishing credentials · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: cs1100320034a5146ba · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: rewrfaeraewrfaesrfasef · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevbaddev0sa · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct197 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct199 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosocontosoweb0081015270 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct005 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevbaddev4sa · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct007 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: orderproducts1 · Mechanism: app service application settings · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevrg8ae3 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevbaddev1sa · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service host keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct001 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: storageaccountcontoso8298 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: auth0test · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosocontosodb00081013560 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: functionsconsumptio9fc6 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevrgb910 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: sflogscontosodevcluste2038 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevbaddev2sa · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct196 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: vdxfvsdfsdfv · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service application settings · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevrgb75f · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosocontosofile081015510 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service key replacement · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: storageaccountcontosobfbe · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct200 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: orderproducts1 · Mechanism: app service host keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct008 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: storageaccountfunct936f · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: webappcontosotest · Mechanism: app service publishing credentials · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct006 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: orderproducts1 · Mechanism: app service publishing credentials · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevinsecurergba9f · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct004 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: cs110032000f71044ed · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosodevbaddev3sa · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: yetanotherbad2 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: yetanotherbadstorage · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: contosocontosodb00081015100 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: orderproducts1 · Mechanism: app service function keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service function keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: argstacct198 · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
- Resource: azureiamparking · Mechanism: access keys · Principal: 6945d750-ef98-4624-aafe-fd9cd5e8ecf5
This change (suggested action 16)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: f39a965a9abe7ac328578764 currently has a role assignment granting access at a broad scope over 97a795e8-b7fb-430c-af82-ecbc152813a6.

Security risk: If f39a965a9abe7ac328578764 is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 79 attack paths.

Do this: Remove or scope down the Contributor role assignment granting principal f39a965a9abe7ac328578764 access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/ecf68ece-61e5-4ee8-adb8-3376e2435422. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.

Implementation steps

Review impact - Remove or scope down the Contributor role assignment granting principal f39a965a9abe7ac328578764 access to 97a795e8-b7fb-430c-af82-ecbc152813a6. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/ecf68ece-61e5-4ee8-adb8-3376e2435422. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

17. Review unresolved Owner assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 HIGH HIGH CONFIDENCE MAJOR PROJECT

Scope the identity's role assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 to least-privilege scope

Change effort
Low
Preparation
High (58 steps)

Findings resolved
67

Findings neutralised
0

Attack paths removed
80

Before you change anything

Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and pipelines are validated (see "Before you change anything" above)
Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac · Scope: subscription 56914835-2c07-4bdf-a088-72e94ee7eb82
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
For 57 targets:
- Resource: yetanotherbad2 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service application settings · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct005 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: sflogscontosodevcluste2038 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service function keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosocontosoweb0081015270 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: dsfsdfsdfgff · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevbaddev4sa · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct008 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: storageaccountcontosobfbe · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: cs110032000f71044ed · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: yetanotherbadstorage · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosocontosodb00081014340 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: storageaccountcontoso8298 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct006 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevbaddev0sa · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: jdhalfkjadhflaskh · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct197 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: newcontosobadsa · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct002 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: dummysacontoso · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevinsecurergba9f · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevbaddev1sa · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevrg8ae3 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: auth0test · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: webappcontosotest · Mechanism: app service publishing credentials · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct004 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: orderproducts1 · Mechanism: app service key replacement · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevrgb910 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: orderproducts1 · Mechanism: app service host keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: orderproducts1 · Mechanism: app service application settings · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct007 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct198 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: storageaccountfunct936f · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct199 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevbaddev3sa · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct001 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service key replacement · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: functionsconsumptio9fc6 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosocontosodb00081015100 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: orderproducts1 · Mechanism: app service function keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: cs1100320034a5146ba · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct200 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct196 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: vdxfvsdfsdfv · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: azureiamparking · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosocontosojump081015360 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: rewrfaeraewrfaesrfasef · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosocontosofile081015510 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: orderproducts1 · Mechanism: app service publishing credentials · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevrgb75f · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosodevbaddev2sa · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: contosocontosodb00081013560 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service publishing credentials · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service host keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
- Resource: argstacct003 · Mechanism: access keys · Principal: 2eb4f07f-c67d-441e-a51c-3014874798ac
This change (suggested action 17)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: The identity or principal currently has a role assignment granting access at a broad scope over subscription 56914835-2c07-4bdf-a088-72e94ee7eb82.

Security risk: If the identity is compromised, an attacker can use this overly-broad role assignment to access resources or modify configuration across the environment. This is part of 80 attack paths.

Implementation steps

Review impact - Remove or scope down the Owner role assignment granting principal 2eb4f07f-c67d-441e-a51c-3014874798ac access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path. This Azure RBAC assignment references principal 2eb4f07f-c67d-441e-a51c-3014874798ac, which ARGOS could not resolve against the current Entra ID or managed identity inventory. That is an observation, not proof the identity was deleted - a foreign or guest identity, a principal type ARGOS does not inventory, an incomplete identity collection or a transient inventory inconsistency all look the same from here. Verify whether the identity still exists. If it no longer exists, or the assignment is no longer required, remove role assignment /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966 (role: Owner) at scope /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

18. Reduce Contoso Cloud - Projects Team's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 HIGH HIGH CONFIDENCE MAJOR PROJECT

Scope Contoso Cloud - Projects Team's role assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 to least-privilege scope

Change effort
Low
Preparation
High (58 steps)

Findings resolved
67

Findings neutralised
0

Attack paths removed
80

Before you change anything

Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and pipelines are validated (see "Before you change anything" above)
Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3 · Scope: subscription 56914835-2c07-4bdf-a088-72e94ee7eb82
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
For 57 targets:
- Resource: argstacct198 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct199 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: dsfsdfsdfgff · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: orderproducts1 · Mechanism: app service application settings · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct005 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosocontosofile081015510 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevrgb910 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: webappcontosotest · Mechanism: app service publishing credentials · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct007 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: azureiamparking · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: functionsconsumptio9fc6 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct006 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct008 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct197 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service application settings · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service key replacement · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct196 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevbaddev2sa · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: jdhalfkjadhflaskh · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosocontosojump081015360 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevbaddev4sa · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: storageaccountfunct936f · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct200 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevinsecurergba9f · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosocontosoweb0081015270 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: yetanotherbadstorage · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevbaddev1sa · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: dummysacontoso · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosocontosodb00081015100 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service function keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: storageaccountcontosobfbe · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct002 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: vdxfvsdfsdfv · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct004 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: yetanotherbad2 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: storageaccountcontoso8298 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: orderproducts1 · Mechanism: app service host keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: sflogscontosodevcluste2038 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct003 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: orderproducts1 · Mechanism: app service key replacement · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service publishing credentials · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: newcontosobadsa · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosocontosodb00081014340 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: cs1100320034a5146ba · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: cs110032000f71044ed · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevrg8ae3 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevbaddev3sa · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: argstacct001 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: auth0test · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosocontosodb00081013560 · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: orderproducts1 · Mechanism: app service publishing credentials · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevrgb75f · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: orderproducts1 · Mechanism: app service function keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: rewrfaeraewrfaesrfasef · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service host keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
- Resource: contosodevbaddev0sa · Mechanism: access keys · Principal: 235b348b-db57-446c-ae5c-9e4b5d8053b3
This change (suggested action 18)
Follow-up task: credential rotation for this change is done once, after suggested action 19, where it is listed - the last change that removes access to the same credentials.

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: Contoso Cloud - Projects Team currently has a role assignment granting access at a broad scope over subscription 56914835-2c07-4bdf-a088-72e94ee7eb82.

Implementation steps

Review impact - Remove or scope down the Owner role assignment granting principal Contoso Cloud - Projects Team access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/71fedb2c-68f7-447b-ace4-1fe0455939bc. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

19. Reduce Sam Taylor's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 HIGH HIGH CONFIDENCE MAJOR PROJECT

Scope Sam Taylor's role assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82 to least-privilege scope

Change effort
Low
Preparation
High (58 steps)

Findings resolved
67

Findings neutralised
0

Attack paths removed
80

Before you change anything

Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.

Dependency sequence

Preparatory task: Replacement identity and access are in place, and pipelines are validated (see "Before you change anything" above)
Principal: c88d1633-95f9-49d0-a865-889361308164 · Scope: subscription 56914835-2c07-4bdf-a088-72e94ee7eb82
Validation gate: This principal's clients and pipelines are migrated and validated
Move every client, pipeline and operator that uses this principal's access to the credential onto its replacement identity, and confirm each one still works on it.
For 57 targets:
- Resource: contosocontosoweb0081015270 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevbaddev4sa · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct007 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: orderproducts1 · Mechanism: app service publishing credentials · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevrg8ae3 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct008 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosocontosojump081015360 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevbaddev2sa · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct002 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct199 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevbaddev0sa · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: orderproducts1 · Mechanism: app service host keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct198 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct196 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevbaddev1sa · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service publishing credentials · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct003 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevrgb910 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevinsecurergba9f · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: functionsconsumptio9fc6 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct197 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service host keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: orderproducts1 · Mechanism: app service function keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service function keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: storageaccountcontosobfbe · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: vdxfvsdfsdfv · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: orderproducts1 · Mechanism: app service key replacement · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: orderproducts1 · Mechanism: app service application settings · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct001 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: rewrfaeraewrfaesrfasef · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: yetanotherbadstorage · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevbaddev3sa · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct200 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: sflogscontosodevcluste2038 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: webappcontosotest · Mechanism: app service publishing credentials · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: storageaccountfunct936f · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: fhjfhdjfhadsjfhd · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosocontosodb00081013560 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosocontosodb00081014340 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct006 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: storageaccountcontoso8298 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: cs1100320034a5146ba · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service application settings · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: dummysacontoso · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct004 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: argstacct005 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: cs110032000f71044ed · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosocontosodb00081015100 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service key replacement · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: azureiamparking · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: auth0test · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: dsfsdfsdfgff · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: jdhalfkjadhflaskh · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosocontosofile081015510 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: newcontosobadsa · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: yetanotherbad2 · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
- Resource: contosodevrgb75f · Mechanism: access keys · Principal: c88d1633-95f9-49d0-a865-889361308164
This change (suggested action 19)
Follow-up task: Rotate the credentials that may have been exposed (after the change) Do this once, after every change that removes access to these credentials: suggested actions 1 (contoso-contributor), 2 (Jordan Lee), 4 (webappcontosotest), 14 (7e310e21f217b02ca2bb0892), 15 (contoso-github-actions), 16 (f39a965a9abe7ac328578764), 17 (subscription 56914835-2c07-4bdf-a088-72e94ee7eb82), 18 (Contoso Cloud - Projects Team), 19 (Sam Taylor). Until every one of them has lost access, any of them could read the new credentials, so rotating earlier does not help.
Once nothing uses them, rotate or regenerate the keys, secrets, publishing credentials or certificates the removed access could read. Removing access does not un-expose a value already read.
For 57 targets:
- Resource: fhjfhdjfhadsjfhd · Mechanism: access keys
- Resource: dummysacontoso · Mechanism: access keys
- Resource: storageaccountcontoso8298 · Mechanism: access keys
- Resource: orderproducts1 · Mechanism: app service function keys
- Resource: vdxfvsdfsdfv · Mechanism: access keys
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service function keys
- Resource: rewrfaeraewrfaesrfasef · Mechanism: access keys
- Resource: argstacct200 · Mechanism: access keys
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service host keys
- Resource: storageaccountcontosobfbe · Mechanism: access keys
- Resource: contosocontosodb00081014340 · Mechanism: access keys
- Resource: contosodevbaddev4sa · Mechanism: access keys
- Resource: argstacct008 · Mechanism: access keys
- Resource: contosocontosodb00081015100 · Mechanism: access keys
- Resource: argstacct007 · Mechanism: access keys
- Resource: contosocontosojump081015360 · Mechanism: access keys
- Resource: functionsconsumptio9fc6 · Mechanism: access keys
- Resource: dsfsdfsdfgff · Mechanism: access keys
- Resource: argstacct005 · Mechanism: access keys
- Resource: contosocontosofile081015510 · Mechanism: access keys
- Resource: orderproducts1 · Mechanism: app service host keys
- Resource: webappcontosotest · Mechanism: app service publishing credentials
- Resource: cs110032000f71044ed · Mechanism: access keys
- Resource: contosodevbaddev0sa · Mechanism: access keys
- Resource: contosodevbaddev2sa · Mechanism: access keys
- Resource: auth0test · Mechanism: access keys
- Resource: jdhalfkjadhflaskh · Mechanism: access keys
- Resource: argstacct004 · Mechanism: access keys
- Resource: yetanotherbad2 · Mechanism: access keys
- Resource: argstacct197 · Mechanism: access keys
- Resource: argstacct002 · Mechanism: access keys
- Resource: yetanotherbadstorage · Mechanism: access keys
- Resource: storageaccountfunct936f · Mechanism: access keys
- Resource: azureiamparking · Mechanism: access keys
- Resource: contosocontosodb00081013560 · Mechanism: access keys
- Resource: contosodevrgb75f · Mechanism: access keys
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service publishing credentials
- Resource: orderproducts1 · Mechanism: app service application settings
- Resource: argstacct003 · Mechanism: access keys
- Resource: contosodevinsecurergba9f · Mechanism: access keys
- Resource: argstacct196 · Mechanism: access keys
- Resource: contosodevbaddev1sa · Mechanism: access keys
- Resource: argstacct001 · Mechanism: access keys
- Resource: argstacct199 · Mechanism: access keys
- Resource: orderproducts1 · Mechanism: app service publishing credentials
- Resource: orderproducts1 · Mechanism: app service key replacement
- Resource: contosodevrgb910 · Mechanism: access keys
- Resource: contosodevbaddev3sa · Mechanism: access keys
- Resource: contosodevrg8ae3 · Mechanism: access keys
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service application settings
- Resource: argstacct006 · Mechanism: access keys
- Resource: cs1100320034a5146ba · Mechanism: access keys
- Resource: newcontosobadsa · Mechanism: access keys
- Resource: gfgsrfdgdsfgfsdg · Mechanism: app service key replacement
- Resource: argstacct198 · Mechanism: access keys
- Resource: contosocontosoweb0081015270 · Mechanism: access keys
- Resource: sflogscontosodevcluste2038 · Mechanism: access keys

Why first: Removing the access or disabling the mechanism before every client has moved off it breaks those clients.

Current state: Sam Taylor currently has a role assignment granting access at a broad scope over subscription 56914835-2c07-4bdf-a088-72e94ee7eb82.

Implementation steps

Review impact - Remove or scope down the Owner role assignment granting principal Sam Taylor access to 56914835-2c07-4bdf-a088-72e94ee7eb82. Replace it with a least-privilege role granting only the access the principal genuinely needs. Assignment: /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/65d59f2f-05f2-45ec-a89e-b47c683a897a. Matched action(s): Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. If access is still required, replace this assignment with a custom role that excludes Microsoft.Resources/subscriptions/resourceGroups/write, Microsoft.Resources/subscriptions/resourceGroups/delete, Microsoft.Compute/virtualMachines/write, Microsoft.Storage/storageAccounts/write, Microsoft.KeyVault/vaults/write, Microsoft.Network/networkSecurityGroups/write, Microsoft.Sql/servers/write, Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/write, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Compute/virtualMachines/read, Microsoft.Storage/storageAccounts/read, Microsoft.Resources/subscriptions/resourceGroups/read. Re-run the ARGOS attack-path assessment afterward and confirm this principal no longer has this path.
Prerequisite - validate before changing anything: Replacement identity and access are in place, and pipelines are validated - Give each deployment pipeline its own Microsoft Entra identity (managed identity or OpenID Connect) with the least-privileged role that deploys, give administrators a role that does not list settings, publishing credentials or keys, move secrets to Key Vault references, and confirm every pipeline, caller and the app itself still work. Then remove this assignment, disable basic publishing authentication, and rotate the secrets, publishing credentials and keys it could read.
Identify the narrowest role and scope - Determine the least-privileged Azure role, at the narrowest scope, that still gives the principal the access it needs. Where it only needs data, prefer a data-plane role over a control-plane role such as Contributor or Owner.
Create the replacement role assignment (if needed) - Assign the narrower role at that scope before removing the broader one
Remove the original role assignment - Delete or scope down the original assignment

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

20. Remove public exposure from jumpbox MEDIUM HIGH CONFIDENCE FILL-IN

Remove public exposure from its assigned scope

Change effort
Low
Preparation
Low (3 steps)

Findings resolved
1

Findings neutralised
0

Attack paths removed
1

Why this priority: Closes a confirmed compromise blast radius. Involves a high-impact finding (score 8). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.

Dependency sequence

Preparatory task: A replacement access path exists (see "Before you change anything" above)
Resource: jumpbox · Mechanism: public network access
Preparatory task: Private name resolution works for every client (see "Before you change anything" above)
Resource: jumpbox · Mechanism: public network access
Validation gate: Every client is validated on the replacement path (see "Before you change anything" above)
Resource: jumpbox · Mechanism: public network access
This change (suggested action 20)

Why first: Restricting public access before every client is validated on the replacement path cuts those clients off.

Current state: The resource its assigned scope is currently exposed to the internet without proper access controls.

Security risk: Internet-accessible resources are entry points for attackers. This resource is exposed and reachable via an attack path.

Do this: Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.

Target state: Apply a trusted-ingress pattern: place internet-accessible resources behind a WAF, API Gateway, or authentication layer. Restrict direct public access.

Implementation steps

Review impact - Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.
Prerequisite - validate before changing anything: A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Prerequisite - validate before changing anything: Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Prerequisite - validate before changing anything: Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.
Apply the change - Use your Azure console or CLI to apply: Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

21. Remove public exposure from web002 MEDIUM HIGH CONFIDENCE FILL-IN

Remove public exposure from its assigned scope

Change effort
Low
Preparation
Low (3 steps)

Findings resolved
1

Findings neutralised
0

Attack paths removed
1

Before you change anything

A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.

Dependency sequence

Preparatory task: A replacement access path exists (see "Before you change anything" above)
Resource: web002 · Mechanism: public network access
Preparatory task: Private name resolution works for every client (see "Before you change anything" above)
Resource: web002 · Mechanism: public network access
Validation gate: Every client is validated on the replacement path (see "Before you change anything" above)
Resource: web002 · Mechanism: public network access
This change (suggested action 21)

Why first: Restricting public access before every client is validated on the replacement path cuts those clients off.

Current state: The resource its assigned scope is currently exposed to the internet without proper access controls.

Security risk: Internet-accessible resources are entry points for attackers. This resource is exposed and reachable via an attack path.

Target state: Apply a trusted-ingress pattern: place internet-accessible resources behind a WAF, API Gateway, or authentication layer. Restrict direct public access.

Implementation steps

Review impact - Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.
Prerequisite - validate before changing anything: A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Prerequisite - validate before changing anything: Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Prerequisite - validate before changing anything: Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.
Apply the change - Use your Azure console or CLI to apply: Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

22. Remove public exposure from webserver001 MEDIUM HIGH CONFIDENCE FILL-IN

Remove public exposure from its assigned scope

Change effort
Low
Preparation
Low (3 steps)

Findings resolved
1

Findings neutralised
0

Attack paths removed
1

Before you change anything

A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.

Dependency sequence

Preparatory task: A replacement access path exists (see "Before you change anything" above)
Resource: webserver001 · Mechanism: public network access
Preparatory task: Private name resolution works for every client (see "Before you change anything" above)
Resource: webserver001 · Mechanism: public network access
Validation gate: Every client is validated on the replacement path (see "Before you change anything" above)
Resource: webserver001 · Mechanism: public network access
This change (suggested action 22)

Why first: Restricting public access before every client is validated on the replacement path cuts those clients off.

Current state: The resource its assigned scope is currently exposed to the internet without proper access controls.

Security risk: Internet-accessible resources are entry points for attackers. This resource is exposed and reachable via an attack path.

Target state: Apply a trusted-ingress pattern: place internet-accessible resources behind a WAF, API Gateway, or authentication layer. Restrict direct public access.

Implementation steps

Review impact - Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.
Prerequisite - validate before changing anything: A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Prerequisite - validate before changing anything: Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Prerequisite - validate before changing anything: Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.
Apply the change - Use your Azure console or CLI to apply: Restrict public access to this Virtual Machine: update its Network Security Group to limit inbound access to trusted networks/sources (e.g., corporate subnets, Bastion jump hosts). Consider using Azure Bastion for secure shell access without exposing RDP/SSH publicly, or enable DDoS Protection Standard for broader mitigation. This closes every attack path that starts by reaching this VM from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

23. Remove public exposure from orderproducts1 MEDIUM HIGH CONFIDENCE FILL-IN

Remove public exposure from its assigned scope

Change effort
Low
Preparation
Low (3 steps)

Findings resolved
1

Findings neutralised
0

Attack paths removed
1

Why this priority: Closes a confirmed compromise blast radius. Involves a high-impact finding (score 9). Business criticality is unknown: no environment tag was observed on the affected resources.

Before you change anything

A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.

Dependency sequence

Preparatory task: A replacement access path exists (see "Before you change anything" above)
Resource: orderproducts1 · Mechanism: public network access
Preparatory task: Private name resolution works for every client (see "Before you change anything" above)
Resource: orderproducts1 · Mechanism: public network access
Validation gate: Every client is validated on the replacement path (see "Before you change anything" above)
Resource: orderproducts1 · Mechanism: public network access
This change (suggested action 23)

Why first: Restricting public access before every client is validated on the replacement path cuts those clients off.

Current state: The resource its assigned scope is currently exposed to the internet without proper access controls.

Security risk: Internet-accessible resources are entry points for attackers. This resource is exposed and reachable via an attack path.

Do this: Restrict public access to this App Service: place it behind Azure Application Gateway or Front Door with a Web Application Firewall, and use Access Restrictions (or a Private Endpoint) to limit inbound traffic to trusted sources. This closes every attack path that starts by reaching this App Service from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.

Target state: Apply a trusted-ingress pattern: place internet-accessible resources behind a WAF, API Gateway, or authentication layer. Restrict direct public access.

Implementation steps

Review impact - Restrict public access to this App Service: place it behind Azure Application Gateway or Front Door with a Web Application Firewall, and use Access Restrictions (or a Private Endpoint) to limit inbound traffic to trusted sources. This closes every attack path that starts by reaching this App Service from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.
Prerequisite - validate before changing anything: A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Prerequisite - validate before changing anything: Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Prerequisite - validate before changing anything: Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.
Apply the change - Use your Azure console or CLI to apply: Restrict public access to this App Service: place it behind Azure Application Gateway or Front Door with a Web Application Firewall, and use Access Restrictions (or a Private Endpoint) to limit inbound traffic to trusted sources. This closes every attack path that starts by reaching this App Service from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

24. Remove public exposure from webappcontosotest MEDIUM HIGH CONFIDENCE FILL-IN

Remove public exposure from its assigned scope

Change effort
Low
Preparation
Low (3 steps)

Findings resolved
1

Findings neutralised
0

Attack paths removed
1

Before you change anything

A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.

Dependency sequence

Preparatory task: A replacement access path exists (see "Before you change anything" above)
Resource: webappcontosotest · Mechanism: public network access
Preparatory task: Private name resolution works for every client (see "Before you change anything" above)
Resource: webappcontosotest · Mechanism: public network access
Validation gate: Every client is validated on the replacement path (see "Before you change anything" above)
Resource: webappcontosotest · Mechanism: public network access
This change (suggested action 24)

Why first: Restricting public access before every client is validated on the replacement path cuts those clients off.

Current state: The resource its assigned scope is currently exposed to the internet without proper access controls.

Security risk: Internet-accessible resources are entry points for attackers. This resource is exposed and reachable via an attack path.

Target state: Apply a trusted-ingress pattern: place internet-accessible resources behind a WAF, API Gateway, or authentication layer. Restrict direct public access.

Implementation steps

Review impact - Restrict public access to this App Service: place it behind Azure Application Gateway or Front Door with a Web Application Firewall, and use Access Restrictions (or a Private Endpoint) to limit inbound traffic to trusted sources. This closes every attack path that starts by reaching this App Service from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.
Prerequisite - validate before changing anything: A replacement access path exists - Before restricting the public path, put the replacement in place - a private endpoint for each sub-resource the clients use (blob, file, queue, table, dfs, web, vault...), an allowed virtual network or IP range, Azure Bastion or a VPN - and confirm it is supported by the resource's plan or SKU and is the path the clients will actually take. Observed: no approved private endpoint connection.
Prerequisite - validate before changing anything: Private name resolution works for every client - Where the replacement path is a private endpoint, confirm the private DNS zone is linked to every virtual network (and on-premises resolver) the clients use, and that the resource's name resolves to its private address from each of them.
Prerequisite - validate before changing anything: Every client is validated on the replacement path - Identify the applications, pipelines, administrators and monitoring that use the public path today, and confirm each one succeeds over the replacement path before the public path is restricted.
Apply the change - Use your Azure console or CLI to apply: Restrict public access to this App Service: place it behind Azure Application Gateway or Front Door with a Web Application Firewall, and use Access Restrictions (or a Private Endpoint) to limit inbound traffic to trusted sources. This closes every attack path that starts by reaching this App Service from the internet - including paths through its managed identity's own role assignments - without changing those role assignments.

Validation steps

Confirm access works - Success: The workload continues to function normally
Confirm prohibited access fails - Success: The attempt fails with 'access denied' or 'forbidden'
Rescan with ARGOS - Success: The detection no longer appears in the scan results

High: this action's evidence was collected in full by this scan.

Remediation leverage

Action	Confirmed paths addressed	Findings addressed	Effort
Reduce contoso-contributor's access to resource group team-dev-rg	2	2	Low
Reduce Jordan Lee's access to resource group team-dev-rg	2	2	Low
Reduce orderproducts1's access to importantsql	9	10	Low
Reduce webappcontosotest's access to dummysacontoso	7	7	Low
Reduce orderproducts1's access to contosolocaldev	10	10	Low
Reduce web002's access to contosolocaldev	9	9	Low
Reduce jumpbox's access to kvaueprd	7	7	Low
Reduce 370a931473355be74a9dc3ad's access to dev	1	1	Trivial
Reduce Sam Taylor's access to dev	2	3	Trivial
Reduce Sam Taylor's access to contoso-foundry-dev	2	3	Trivial
Reduce Jordan Lee's access to dc001	1	1	Trivial
Reduce Sam Taylor's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82	2	4	Low
Reduce Contoso Cloud - Projects Team's access to 97a795e8-b7fb-430c-af82-ecbc152813a6	2	4	Low
Reduce 7e310e21f217b02ca2bb0892's access to 97a795e8-b7fb-430c-af82-ecbc152813a6	79	65	Low
Reduce contoso-github-actions's access to 97a795e8-b7fb-430c-af82-ecbc152813a6	79	65	Low
Reduce f39a965a9abe7ac328578764's access to 97a795e8-b7fb-430c-af82-ecbc152813a6	79	65	Low
Review unresolved Owner assignment on subscription 56914835-2c07-4bdf-a088-72e94ee7eb82	80	67	Low
Reduce Contoso Cloud - Projects Team's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82	80	67	Low
Reduce Sam Taylor's access to subscription 56914835-2c07-4bdf-a088-72e94ee7eb82	80	67	Low
Remove public exposure from jumpbox	1	1	Low
Remove public exposure from web002	1	1	Low
Remove public exposure from webserver001	1	1	Low
Remove public exposure from orderproducts1	1	1	Low
Remove public exposure from webappcontosotest	1	1	Low

Potential Attack Paths Requiring Validation

3 potential attack path(s) could not be confirmed either way, so they are excluded from every confirmed attack-path figure in this report - counted neither as risk nor as safe. They break down by cause as follows.

Reason	Paths	Findings	What would resolve it
Role-definition write access observed; no escalation through it demonstrated	2	2	Narrow this principal's Microsoft.Authorization/roleDefinitions/write access. The exposure stands on its own - nothing further ARGOS collects will turn it into a demonstrated escalation, and nothing has to before it is worth closing.
The database plane is outside what ARGOS assesses	1	1	—

Highest Blast-Radius Identities

Principals holding a control on the most confirmed attack paths. Ranked by distinct confirmed paths, then by the distinct attack-path targets and environments they reach. Reach through the graph, not an assessment of the identity's importance.

Principal	Type	Confirmed paths	Targets	Environments	Findings	In plan
Sam Taylor	Entra user	86	79	1	76	4
Contoso Cloud - Projects Team	Entra user	82	78	1	70	2
Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac)	ForeignGroup	80	77	1	67	1
f39a965a9abe7ac328578764	Entra service principal	79	77	1	65	1
7e310e21f217b02ca2bb0892	Entra service principal	79	77	1	65	1
contoso-github-actions	Entra service principal	79	77	1	65	1
orderproducts1	Entra service principal	19	2	1	13	2
web002	Entra service principal	9	1	1	9	1
webappcontosotest	Entra service principal	7	1	1	7	1
jumpbox	Entra service principal	7	1	1	7	1

Other Priority Actions

The strongest conclusions from the assessments in this report, ordered by urgency. Each one links back to the section that produced it, where the full evidence remains.

1. Migrate from Public IP address (Basic SKU) before 2025-09-30 IMMEDIATE SERVICE RETIREMENT Azure

Why: The Microsoft retirement date for this service has passed. Resources still using it are running on an unsupported platform.

Do: Validate the replacement service and migration path now, then schedule the migration of the affected resources.

13 resource(s) are affected. The retirement date passed 406 day(s) ago.

Deadline passed: 2025-09-30

2. Migrate from Load balancer (Basic Load Balancer) before 2025-09-30 IMMEDIATE SERVICE RETIREMENT Azure

Why: The Microsoft retirement date for this service has passed. Resources still using it are running on an unsupported platform.

Do: Validate the replacement service and migration path now, then schedule the migration of the affected resources.

2 resource(s) are affected. The retirement date passed 406 day(s) ago.

Deadline passed: 2025-09-30

3. Migrate from Storage Account (Support for TLS 1.0 and 1.1) before 2026-02-03 IMMEDIATE SERVICE RETIREMENT Azure

Why: The Microsoft retirement date for this service has passed. Resources still using it are running on an unsupported platform.

Do: Validate the replacement service and migration path now, then schedule the migration of the affected resources.

33 resource(s) are affected. The retirement date passed 280 day(s) ago.

Deadline passed: 2026-02-03

4. Restrict Public App Service and Function Ingress IMMEDIATE SYSTEMIC

Why: Internet-facing applications are a primary entry point for exploitation. Restricting ingress reduces exposure to application vulnerabilities, credential attacks, and direct access to workloads that can reach sensitive services.

Do: Remove unrestricted internet access from the affected App Services and Functions. Allow only approved clients and routes, and use private connectivity for administrative and backend access.

1 affected resource(s).

5. Restrict east-west connectivity with subnet-level network security groups HIGH NETWORK Azure

Why: Subnets without a network security group accept traffic from anything that can already reach the virtual network, so a single compromised workload can move laterally across the estate unimpeded.

Do: Attach workload-aligned network security groups to the unprotected subnets and restrict flows to the application paths each workload actually needs.

26 of 32 assessed subnet(s) have no network security group.

Architecture Reviews

Design choices to review against your requirements. ARGOS cannot see the dependency or requirement that decides whether each one is a risk, so these are not established security failures: they are excluded from the detection totals, the risk rating and the remediation plan. Where a benchmark maps the configuration, the mapped control may still fail for that benchmark version.

Review	Count	Benchmark mapping	Compliance outcome
Ensure that 'Enable Infrastructure Encryption' for each Storage Account in Azure Storage is set to 'enabled' Infrastructure encryption is not enabled on this storage account. Azure Storage already encrypts all data at the service level with 256-bit AES. Infrastructure encryption adds a second layer for double encryption, which Microsoft recommends for scenarios where double encryption is necessary for compliance; for most other scenarios it is unlikely to add a benefit. Whether it is required depends on the organisation's compliance requirements, which ARGOS does not observe, so this is an architecture review: it fails the mapped benchmark control but is not an established security failure.	45	None recorded	No mapped control
Private Endpoints should be used to access Storage Accounts The storage account has no approved private endpoint connection. This is the check the mapped benchmark control's Microsoft policy ('Storage accounts should use private link') makes - an approved connection exists or it does not - and it is recorded so the control's compliance outcome is correct. It does not assess which sub-resources (blob, dfs, file, queue, table, web) an endpoint serves, and an approved connection is not evidence that DNS resolves to it, that traffic is routed through it or that clients use it. Whether private access is required depends on how the account is used and reached, which ARGOS cannot see, so this is an architecture review: it fails the mapped control but is kept out of security totals and scores and is notified only where reviews are opted in. Coverage of the sub-resources the account is configured to need is reviewed separately.	45	None recorded	No mapped control
Ensure that VM is member of Availability Set An Azure Virtual Machine that is not in an availability set, not deployed into an availability zone and not a member of a scale set has no platform-level redundancy for planned maintenance or hardware failure. Zonal VMs and scale-set members use a different resilience design and are not reported. Whether a workload needs more than one instance depends on its availability requirement, which ARGOS does not observe, so this is an architecture review, not an established security failure.	8	None recorded	No mapped control
Review how this app authenticates requests App Service platform authentication (Easy Auth) does not block anonymous requests to this app: it is disabled, or it is enabled with unauthenticated requests allowed through to the application (the finding's authenticationEnforcement value says which). This is a platform configuration choice ARGOS observed, not evidence that the application lacks authentication: authentication in the application's own code, an authenticating gateway or API management layer in front of it, Function keys, or content that is intentionally public are valid alternatives that ARGOS cannot observe. It is therefore an architecture review rather than an established security failure. Where platform authentication is required, configured excluded paths are a stated exemption and are not reported. Benchmark compliance is assessed separately: the CIS control on App Service authentication is mapped to the rule that checks whether platform authentication is enabled, which is what that control's Microsoft policies check.	3	None recorded	No mapped control
Ensure App Service Authentication is set up for apps in Azure App Service App Service platform authentication (Easy Auth) is not enabled on this app. That is what the mapped benchmark control's Microsoft policies check, and it is recorded so the control's compliance outcome is correct; it does not establish that the application is unauthenticated. Authentication in the application's own code, an authenticating gateway or API management layer in front of it, Function keys, or content that is intentionally public are valid alternatives ARGOS cannot observe, so this is an architecture review, not an established security failure: it fails the mapped control but is kept out of security totals and scores and is notified only where reviews are opted in. Whether an enabled app still allows anonymous requests is reviewed separately.	3	Microsoft Cloud Security Benchmark IM-1 - Assesses whether App Service platform authentication is enabled; whether an enabled app still allows anonymous requests is not assessed under this mapping.	Mapped control failed - excluded from the security totals, not passed
Use virtual network integration where a Function App requires outbound private connectivity The Function App has no virtual network integration subnet. Virtual network integration gives the app OUTBOUND connectivity into a virtual network, so it can reach privately reachable resources such as private endpoints, or route its outbound traffic through the network's controls. It does not restrict who can reach the app: inbound access is controlled by access restrictions or private endpoints on the app itself. Whether an app needs it depends on its dependencies and outbound routing requirements, which ARGOS does not observe, so an absent subnet is an architecture review, not an established security failure. The rule's benchmark mappings are kept.	2	NIST SP 800-171 Rev. 2 (Azure) AC-4; Microsoft Cloud Security Benchmark NS-2; PCI-DSS v3.2.1 1.1; PCI-DSS v3.2.1 1.2; PCI-DSS v3.2.1 1.3	Mapped control failed - excluded from the security totals, not passed
Ensure SQL Server is using TDE with customer managed key Transparent data encryption on this server uses a service-managed key. Data at rest is encrypted either way: Microsoft enables service-managed TDE by default for new databases. A customer-managed key (BYOK) in Azure Key Vault or Managed HSM adds control over the key - rotation, permissions, auditing and separation of duties - where policy or regulation requires it. Whether it is required depends on the organisation's key-management requirements, which ARGOS does not observe, so this is an architecture review: it fails the mapped benchmark control but is not an established security failure.	2	None recorded	No mapped control
Ensure Private Endpoints are used to access Azure Key Vault The vault has no private endpoint connection. A private endpoint gives clients in a virtual network a private path to the vault; whether that is needed depends on where the vault's clients run and on the organisation's network requirements, which ARGOS does not observe, so this is an architecture review, not an established security failure. Whether the vault accepts public network access is assessed separately.	2	Microsoft Cloud Security Benchmark NS-2	Mapped control failed - excluded from the security totals, not passed
Ensure Public Network Access is Disabled for Azure Key Vault The vault's public network access is not Disabled - the CIS 8.3.7 predicate exactly, which this rule keeps, together with its CIS and Microsoft Cloud Security Benchmark NS-2 mappings, so the benchmark control still fails. Public endpoint enablement alone does not establish unrestricted access: the vault firewall may deny by default and admit only selected networks, and every request must still be authorised by Microsoft Entra ID with Azure RBAC or an access policy. Whether the vault must be reachable only through a private endpoint depends on where its clients run and on the organisation's network requirements, which ARGOS does not observe, so this is an architecture review, not an established security failure. Private endpoint use is assessed separately.	2	Microsoft Cloud Security Benchmark NS-2	Mapped control failed - excluded from the security totals, not passed
Ensure Azure Automation Account is using private endpoints The Automation account has no private endpoint connection. A private endpoint gives clients in a virtual network a private path to the account's webhook or Hybrid Runbook Worker/DSC endpoints. Whether that path is needed depends on where the account's callers and workers run, which ARGOS does not observe, so this is an architecture review, not an established security failure. Whether the account accepts public network access is assessed separately.	1	NIST SP 800-53 Rev. 4 AC-4; NIST SP 800-53 Rev. 4 AC-17; NIST SP 800-53 Rev. 4 SC-7; NIST SP 800-53 Rev. 4 SC-7 (3); Microsoft Cloud Security Benchmark NS-2	Mapped control failed - excluded from the security totals, not passed
Ensure Azure AI Services are accessible only through Private Link The Azure AI Services account has no private endpoint connection. A private endpoint gives clients in a virtual network a private path to the account; whether that is needed depends on where its clients run and on the organisation's network requirements, which ARGOS does not observe, so this is an architecture review, not an established security failure. Public network access is assessed separately.	1	NIST SP 800-53 Rev. 4 AC-4; NIST SP 800-53 Rev. 4 AC-17; NIST SP 800-53 Rev. 4 SC-7; NIST SP 800-53 Rev. 4 SC-7 (3); Microsoft Cloud Security Benchmark NS2	Mapped control failed - excluded from the security totals, not passed
Service Bus should use a virtual network private endpoint The Service Bus namespace has no approved private endpoint connection. A private endpoint (a Premium tier feature) gives clients in a virtual network a private path to the namespace; whether that is needed depends on where its clients run and on the organisation's network requirements, which ARGOS does not observe, so this is an architecture review, not an established security failure.	1	Microsoft Cloud Security Benchmark NS-2; NIST SP 800-53 Rev. 4 AC-4; NIST SP 800-53 Rev. 4 SC-2; NIST SP 800-53 Rev. 4 SC-7; PCI-DSS v3.2.1 1.1; PCI-DSS v3.2.1 1.2; PCI-DSS v3.2.1 1.3	Mapped control failed - excluded from the security totals, not passed
Service Bus should use a virtual network service endpoint The Service Bus namespace has no approved private endpoint and no virtual network rule. Virtual network rules (service endpoints) and private endpoints are Premium tier ways to restrict which networks reach the namespace; IP rules, or a namespace whose clients are not in a virtual network, are valid alternatives ARGOS does not weigh, so this is an architecture review, not an established security failure.	1	Microsoft Cloud Security Benchmark NS-2; NIST SP 800-53 Rev. 4 AC-4; NIST SP 800-53 Rev. 4 SC-2; NIST SP 800-53 Rev. 4 SC-7; PCI-DSS v3.2.1 1.1; PCI-DSS v3.2.1 1.2; PCI-DSS v3.2.1 1.3	Mapped control failed - excluded from the security totals, not passed
Ensure restrictive RBAC controls are applied to snapshot operations Lists the principals holding a built-in role that can create, delete or export a snapshot (Owner, Contributor, Virtual Machine Contributor, Disk Snapshot Contributor) at the snapshot's scope or above. This is an architecture review, not an established security failure: holding such a role is the normal state of every subscription administrator, and whether it is excessive depends on who should administer the workload, which ARGOS does not observe. Effective, proven snapshot and disk export exposure - after deny assignments, locks and policy - is assessed by attackPaths_managedDiskSnapshotExport.	1	None recorded	No mapped control

Section 4

Assessment Scope

This assessment covers 1 Azure subscription containing 5,820 active resources.

Dev

Resources assessed

5820

Findings

1548

Internet-exposed resources

Findings per 100 resources

26.6

Microsoft Defender for Cloud secure score: 16%. A provider-native measure of Microsoft's own control set, shown for comparison. It is separate from the ARGOS risk rating and is not combined with it.

Assessment Coverage

Which optional assessments ran for the clouds in scope. Anything marked not assessed was not evaluated: its state is unknown rather than acceptable.

Network architecture	ASSESSED
Defender for Cloud secure score	ASSESSED
Service retirements	ASSESSED	11 upcoming retirement(s) identified.
Agentic AI	ASSESSED

Section 5

Security Posture

Compliance by Environment

azure Dev

Framework	Assessment	Findings
ISM Protected (Azure)	50%	77
ISO27001:2013 (version 2013)	54% (partial)	759
ISO27001:2022 (version 2022)	55% (partial)	759
Microsoft Cloud Security Benchmark	50% (partial)	821
NIST SP 800-171 Rev. 2 (Azure)	0%	5
NIST SP 800-53 Rev. 4	24%	636
PCI-DSS v3.2.1	49% (partial)	658
OWASP Top 10 for Agentic Applications 2026	57%	5

Security Control Score by Service

Scores summarise how the assessed ARGOS controls for each service performed. They are separate from the overall environment risk rating. Architecture reviews earn a service neither points nor a penalty; a service with no security control to score is not assessed.

Service	Score	Grade
Azure Storage Accounts	32.5%	F
Azure Service Fabric	100%	A+
Azure Service Bus	50%	E
Microsoft Defender	100%	A+
Azure Cache for Redis	50%	E
Azure Monitoring	50%	E
Azure Key Vault	66.7%	D
Azure Miscellaneous	100%	A+
Azure Kubernetes	100%	A+
Azure Identity	80.9%	B-
Azure Networking	40%	F
Azure Databricks	100%	A+
Azure Database Services	86.2%	B
Azure Container Registries	100%	A+
Azure AI Services	86.4%	B
Azure Agentic AI	100%	A+
Azure Automation Accounts	87.5%	B+
Azure App Services	66.1%	D
Azure Virtual Machines	70.7%	C-
Azure Arc	85.7%	B
Azure API Management	100%	A+
Azure Application Gateway	Not assessed	-

Controls assessed

Results reflect findings in the assessed scope. A control with no recorded findings is shown as passed only when an unrestricted assessment was recorded for every environment. Otherwise its coverage is unconfirmed. Controls that were not executed and architecture reviews are shown separately.

Azure Storage Accounts (25 controls) 15 failed 0 passed 1 not assessed 4 unconfirmed 5 review

Control	Result	Findings
Azure Storage Account Blob containers allow public access	Coverage unconfirmed	0
Azure Storage Accounts allow public network access	Failed	40
Azure Compute Snapshots allow public network access	Failed	1
Azure Managed Disks allow public network access	Failed	16
Attack Path: Principal can extract a Storage Account's access keys or generate a SAS	Failed	273
Azure Storage Account allows shared key access	Coverage unconfirmed	0
Azure Storage Account cross-tenant replication is enabled	Failed	28
Principals hold built-in roles that can operate on snapshots (architecture review)	Architecture review	1 review(s)
Azure Storage Account container soft delete is not enabled	Failed	36
Storage Accounts lack immutable storage protection against ransomware	Failed	45
Azure Storage Account file share soft delete is not enabled	Failed	1
Azure storage account is not using TLS 1.2 version	Failed	33
Azure Policy missing to prevent public disk/snapshot access	Failed	1
Azure Storage Account blob versioning is not enabled	Failed	45
Azure Storage Account access keys have not been regenerated in over 90 days	Coverage unconfirmed	0
Storage accounts should be migrated to new Azure Resource Manager resources	Not assessed	-
Azure Storage Account has no approved private endpoint connection (benchmark deviation, architecture review)	Architecture review	45 review(s)
Azure Storage Accounts are not requiring HTTPS connections	Failed	13
Azure Storage Account Blob Service does not have logging enabled	Failed	45
Azure Storage Account does not use infrastructure (double) encryption (architecture review)	Architecture review	45 review(s)
Azure Storage Account requires private access but a sub-resource it uses has no approved private endpoint (architecture review)	Architecture review	0 review(s)
Azure Storage Account Table Service does not have logging enabled	Failed	45
Azure Storage Account Queues do not have logging enabled	Failed	45
Azure Storage Account blob / container not using soft delete	Coverage unconfirmed	0
Azure Storage Account firewall has no trusted Microsoft services exception (architecture review)	Architecture review	0 review(s)

Azure Service Fabric (2 controls) 0 failed 0 passed 1 unconfirmed 1 review

Control	Result	Findings
Service Fabric cluster has no configured Entra authentication tenant (architecture review)	Architecture review	0 review(s)
Azure Service Fabric does not have EncryptAndSign property set	Coverage unconfirmed	0

Azure Service Bus (5 controls) 2 failed 0 passed 1 unconfirmed 2 review

Control	Result	Findings
Attack Path: Principal can extract a Service Bus namespace's shared access keys	Failed	6
Azure Service Bus Namespace has more than just RootManageSharedAccessKey policy configured	Coverage unconfirmed	0
Azure Service Bus namespace has no private endpoint (architecture review)	Architecture review	1 review(s)
Azure Service Bus namespace has neither a private endpoint nor a virtual network rule (architecture review)	Architecture review	1 review(s)
Diagnostic logs in Service Bus should be enabled	Failed	1

Microsoft Defender (21 controls) 0 failed 0 passed 15 not assessed 6 unconfirmed

Control	Result	Findings
Defender for Cloud has default policy to monitor for OS Vulnerabilities disabled	Coverage unconfirmed	0
Microsoft Defender CSPM should be enabled	Not assessed	-
Microsoft Defender for IoT Hub should be enabled for IoT device security.	Coverage unconfirmed	0
Microsoft Defender for APIs should be enabled	Not assessed	-
Microsoft Defender for App Service should be enabled	Not assessed	-
Microsoft Defender for Azure SQL Database servers should be enabled	Not assessed	-
Microsoft Defender for Containers should be enabled	Not assessed	-
Microsoft Defender for DNS should be enabled	Not assessed	-
Microsoft Defender for Key Vault should be enabled	Not assessed	-
Microsoft Defender for open-source relational databases should be enabled	Not assessed	-
Microsoft Defender for Resource Manager should be enabled	Not assessed	-
Microsoft Defender for servers should be enabled	Not assessed	-
Microsoft Defender for SQL servers on machines should be enabled	Not assessed	-
Microsoft Defender for SQL should be enabled for unprotected Azure SQL servers	Not assessed	-
Microsoft Defender for SQL should be enabled for unprotected SQL Managed Instances	Not assessed	-
Microsoft Defender for SQL status should be protected for Arc-enabled SQL Servers	Not assessed	-
Microsoft Defender for Storage plan should be enabled with Malware Scanning and Sensitive Data Threat Detection	Not assessed	-
Defender for Cloud Monitor Vulnerability Assessment policy is disabled	Coverage unconfirmed	0
Security Center Send Email Notifications	Coverage unconfirmed	0
Security Center Send Email Notifications To Owners	Coverage unconfirmed	0
Security Center Contact Emails Set	Coverage unconfirmed	0

Azure Cache for Redis (1 controls) 1 failed 0 passed

Control	Result	Findings
Azure Cache for Redis is not enforcing secure connections	Failed	1

Azure Monitoring (1 controls) 1 failed 0 passed

Control	Result	Findings
Azure Activity Logs are not connected to Log Analytics	Failed	1

Azure Key Vault (8 controls) 3 failed 0 passed 1 not assessed 2 unconfirmed 2 review

Control	Result	Findings
Azure Key Vault accepts connections on its public endpoint (architecture review)	Architecture review	2 review(s)
Attack Path: Principal can self-grant Key Vault secret access via legacy access policies	Failed	8
Azure Key Vault has no private endpoint (architecture review)	Architecture review	2 review(s)
Azure Key Vault does not have RBAC authorization enabled	Failed	1
Key vaults should have soft delete enabled	Not assessed	-
Azure Key Vault Keys do not have expiration date set	Coverage unconfirmed	0
Azure Key Vault is not configured to be recoverable	Failed	2
Azure Key Vault Secrets do not have expiration date set	Coverage unconfirmed	0

Azure Miscellaneous (358 controls) 0 failed 0 passed 358 unconfirmed

Control	Result	Findings
Centralised inventory and asset management is not established for Azure resources.	Coverage unconfirmed	0
ISO 27001:2013 A.5.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.5.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.6.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.6.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.6.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.6.1.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.6.1.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.6.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.6.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.7.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.7.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.7.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.7.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.7.2.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.7.3.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.1.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.2.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.3.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.3.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.8.3.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.2.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.2.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.2.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.2.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.3.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.4.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.4.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.4.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.4.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.9.4.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.10.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.10.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.1.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.1.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.1.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.7: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.8: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.11.2.9: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.1.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.3.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.4.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.4.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.4.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.4.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.5.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.6.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.6.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.12.7.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.13.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.13.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.13.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.13.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.13.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.13.2.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.13.2.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.7: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.8: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.2.9: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.14.3.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.15.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.15.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.15.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.15.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.15.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.16.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.16.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.16.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.16.1.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.16.1.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.16.1.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.16.1.7: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.17.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.17.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.17.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.17.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.1.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.1.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 A.18.2.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.4.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.4.2.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.4.2.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.4.3.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.4.3.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.4.3.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.4.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.g: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.1.h: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.2.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.2.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.2.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.2.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.2.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.2.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.2.g: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.3.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.5.3.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.1.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.1.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.1.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.1.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.1.e.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.1.e.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.a.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.a.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.c.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.c.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.d.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.d.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.d.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.e.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.2.e.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.3.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.3.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.3.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.3.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.3.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.1.3.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.g: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.h: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.i: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.6.2.j: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.2.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.2.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.2.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.2.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.3.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.3.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.3.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.4.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.4.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.4.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.4.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.4.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.1.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.1.b.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.1.b.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.1.b.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.2.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.2.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.2.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.3.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.3.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.3.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.3.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.3.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.7.5.3.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.8.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.8.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.8.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.1.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.1.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.1.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.1.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.1.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.1.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.a.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.a.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.2.g: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.a: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.b: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.c.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.c.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.c.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.c.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.9.3.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.a.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.a.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.b.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.b.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.b.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.c: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.d: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.e: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.f: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.1.g: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2013 C.10.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.4.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.4.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.4.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.4.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.5.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.5.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.5.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.6.1.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.6.1.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.6.1.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.6.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.6.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.7.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.7.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.7.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.7.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.7.5.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.7.5.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.7.5.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.8.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.8.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.8.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.9.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.9.2.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.9.2.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.9.3.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.9.3.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.9.3.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.10.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 C.10.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.7: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.8: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.9: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.10: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.11: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.12: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.13: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.14: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.15: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.16: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.17: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.18: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.19: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.20: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.21: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.22: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.23: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.24: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.25: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.26: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.27: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.28: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.29: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.30: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.31: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.32: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.33: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.34: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.35: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.36: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.5.37: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.7: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.6.8: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.7: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.8: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.9: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.10: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.11: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.12: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.13: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.7.14: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.1: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.2: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.3: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.4: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.5: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.6: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.7: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.8: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.9: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.10: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.11: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.12: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.13: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.14: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.15: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.16: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.17: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.18: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.19: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.20: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.21: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.22: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.23: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.24: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.25: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.26: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.27: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.28: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.29: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.30: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.31: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.32: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.33: manual evidence review required	Coverage unconfirmed	0
ISO 27001:2022 A.8.34: manual evidence review required	Coverage unconfirmed	0
Azure Log Analytics Pricing Tier should not be PAYG	Coverage unconfirmed	0

Azure Kubernetes (20 controls) 0 failed 0 passed 12 not assessed 8 unconfirmed

Control	Result	Findings
Attack Path: Principal can extract an AKS cluster's admin credentials	Coverage unconfirmed	0
Attack Path: Principal can execute commands on an AKS cluster via Run Command	Coverage unconfirmed	0
Azure AKS allows public access to control plane	Coverage unconfirmed	0
Azure AKS cluster nodes should prevent public access	Coverage unconfirmed	0
Attack Path: Principal can extract an AKS cluster's user credentials	Coverage unconfirmed	0
Container images should be deployed from trusted registries only.	Not assessed	-
Kubernetes clusters should disable automounting API credentials.	Not assessed	-
Kubernetes clusters should not grant CAPSYSADMIN security capabilities	Not assessed	-
Kubernetes clusters should be accessible only over HTTPS	Not assessed	-
Kubernetes clusters should disable automounting API credentials	Not assessed	-
Attack Path: Principal can extract an AKS cluster's monitoring credentials	Coverage unconfirmed	0
Azure AKS clusters do not have the Policy add-on installed	Coverage unconfirmed	0
Container CPU and memory limits should be enforced	Not assessed	-
Privileged containers should be avoided	Not assessed	-
Container services should listen on allowed ports only.	Not assessed	-
Least privileged Linux capabilities should be enforced for containers.	Not assessed	-
Immutable (read-only) root filesystem should be enforced for containers.	Not assessed	-
Azure Kubernetes Service clusters should have Defender profile enabled	Not assessed	-
Kubernetes clusters should not use the default namespace.	Not assessed	-
Azure AKS does not have RBAC enabled	Coverage unconfirmed	0

Azure Identity (35 controls) 9 failed 0 passed 9 not assessed 16 unconfirmed 1 review

Control	Result	Findings
Attack Path: Principal has Azure Kubernetes Fleet Manager RBAC Cluster Admin role assigned	Coverage unconfirmed	0
Attack Path: Principal has Azure Kubernetes Service Cluster Admin role assigned	Coverage unconfirmed	0
Attack Path: Principal can self-escalate Azure RBAC privilege	Failed	7
Attack Path: Principal can modify a role definition it already holds to self-escalate privilege	Coverage unconfirmed	0
Attack Path: Principal can execute code as a managed identity that holds Microsoft Entra directory privilege	Coverage unconfirmed	0
Attack Path: Principal has Owner role assigned	Failed	4
Attack Path: Principal has User Access Administrator role assigned	Failed	3
Overprivileged Azure System Managed Identity detected.	Failed	2
Overprivileged Azure User Managed Identity detected	Coverage unconfirmed	0
Attack Path: Principal has App Compliance Automation Administrator role assigned	Coverage unconfirmed	0
Attack Path: Principal has Azure Kubernetes Service RBAC Admin role assigned	Coverage unconfirmed	0
Attack Path: Principal has Contributor role assigned	Failed	10
Attack Path: Principal can add a federated credential to a privileged managed identity	Coverage unconfirmed	0
Attack Path: Principal can attach a privileged managed identity to a workload it can execute code on	Coverage unconfirmed	0
Attack Path: Principal can hijack a custom policy definition enforced by a privileged policy assignment identity	Coverage unconfirmed	0
Attack Path: Principal can sign in to virtual machines as administrator	Coverage unconfirmed	0
Attack Path: Principal can delete Azure role assignments or role definitions	Failed	7
Attack Path: Principal is eligible through Privileged Identity Management to activate a privileged Azure role	Coverage unconfirmed	0
Attack Path: Principal has Virtual Machine User Login role assigned	Coverage unconfirmed	0
There are more than 3 owners designated on this Azure Subscription	Coverage unconfirmed	0
Fewer than two distinct active Owners are assigned to this Azure subscription	Failed	1
Accounts with owner permissions on Azure resources should be MFA enabled	Not assessed	-
Accounts with read permissions on Azure resources should be MFA enabled	Not assessed	-
Accounts with write permissions on Azure resources should be MFA enabled	Not assessed	-
Guest accounts with owner permissions on Azure resources should be removed	Not assessed	-
Guest accounts with read permissions on Azure resources should be removed	Not assessed	-
Guest accounts with write permissions on Azure resources should be removed	Not assessed	-
Permissions of inactive identities in your Azure subscription should be revoked	Not assessed	-
Attack Path: Principal has broad ability to modify custom role definitions	Failed	2
Blocked accounts with owner permissions on Azure resources should be removed	Not assessed	-
Blocked accounts with read and write permissions on Azure resources should be removed	Not assessed	-
Custom Azure RBAC role requires review	Architecture review	0 review(s)
Azure Resource Groups do not have a Service Principal configured.	Coverage unconfirmed	0
Azure Resource Group does not have specific Entra ID Groups assigned for RBAC	Failed	26
Azure Subscription does not have Entra ID Groups assigned for RBAC	Coverage unconfirmed	0

Azure Networking (11 controls) 7 failed 0 passed 3 unconfirmed 1 review

Control	Result	Findings
Azure SQL server firewall admits every internet address or every Azure service	Failed	2
Attack Path: Principal can mutate network configuration to expose a private Virtual Machine	Failed	30
Azure Front Door Domain is not using the latest TLS version	Coverage unconfirmed	0
Azure NSG is allowing unrestricted RDP Access from internet	Failed	424
Azure NSG is allowing unrestricted remote management access from internet	Failed	3
Azure NSG allows unrestricted SSH access from internet	Failed	15
Azure Subnet does not have an NSG associated	Failed	25
Azure DDos Protection Standard is not enabled	Coverage unconfirmed	0
Azure Network Watcher is not enabled	Failed	33
Azure NSG Flow Log Retention is not configured to more than 90 days	Coverage unconfirmed	0
Azure virtual network flow log retention is below the ARGOS 90-day default (architecture review)	Architecture review	0 review(s)

Azure Databricks (11 controls) 0 failed 0 passed 8 unconfirmed 3 review

Control	Result	Findings
Azure Databricks is not deployed in a customer-managed VNet (architecture review)	Architecture review	0 review(s)
Azure Databricks 'No Public IP' is not enabled (architecture review)	Architecture review	0 review(s)
Private endpoints should be configured for Databricks workspaces.	Coverage unconfirmed	0
Azure Databricks public network access is enabled (architecture review)	Architecture review	0 review(s)
Traffic between Databricks cluster worker nodes should be encrypted.	Coverage unconfirmed	0
Critical data in Databricks should be encrypted using customer-managed keys.	Coverage unconfirmed	0
Network Security Groups should be configured for Databricks subnets.	Coverage unconfirmed	0
Personal Access Token usage should be restricted and token expiry should be enforced.	Coverage unconfirmed	0
Diagnostic logs should be configured for Azure Databricks workspaces.	Coverage unconfirmed	0
Users and groups should be synced from Microsoft Entra ID to Databricks for centralized identity management.	Coverage unconfirmed	0
Unity Catalog should be configured for centralized data governance.	Coverage unconfirmed	0

Azure Database Services (30 controls) 7 failed 0 passed 5 not assessed 17 unconfirmed 1 review

Control	Result	Findings
Azure PostgreSQL Server Firewall allows access from all Azure Services	Failed	2
Azure SQL Servers are not denying access from public networks / internet.	Coverage unconfirmed	0
Attack Path: Principal can extract a Cosmos DB account's keys or connection strings	Coverage unconfirmed	0
Attack Path: Principal can replace an Azure SQL server's Entra administrator	Failed	13
SQL managed instances should have vulnerability assessment configured	Not assessed	-
SQL Server is not using latest TLS	Coverage unconfirmed	0
SQL servers should have vulnerability assessment configured	Not assessed	-
Microsoft Defender for Cosmos DB should be enabled to protect Cosmos DB accounts.	Coverage unconfirmed	0
Geo-redundant backup should be enabled for Azure Database for MariaDB	Not assessed	-
Geo-redundant backup should be enabled for Azure Database for MySQL	Not assessed	-
Geo-redundant backup should be enabled for Azure Database for PostgreSQL	Not assessed	-
Azure SQL server TDE uses a service-managed key rather than a customer-managed key (architecture review)	Architecture review	2 review(s)
Azure Cosmos DB keys have not been regenerated in 90 days	Coverage unconfirmed	0
Azure MySql is not enforcing SSL	Coverage unconfirmed	0
Azure PostgreSQL does not have SSL Connection enforced	Coverage unconfirmed	0
Azure SQL Server does not have Advanced Threat Protection enabled	Coverage unconfirmed	0
Azure SQL databases do not have transparent data encryption enabled	Failed	1
Azure SQL servers do not have Threat Detection Type set to all	Coverage unconfirmed	0
Azure PostgreSQL does not have Connection Throttling turned On	Coverage unconfirmed	0
Azure PostgreSQL does not have Log Checkpoints turned On	Coverage unconfirmed	0
Azure PostgreSQL does not have Log Connections turned On	Coverage unconfirmed	0
Azure PostgreSQL does not have Log Disconnections turned On	Coverage unconfirmed	0
Azure PostgreSQL does not have Log Duration turned On	Coverage unconfirmed	0
Azure PostgreSQL does not have Log Retention turned on to more than 3 days	Coverage unconfirmed	0
Azure SQL Server does not have Entra ID Admin configured	Failed	1
Azure SQL Server does not have Alert Email set	Coverage unconfirmed	0
Azure SQL Server does not have Audit Actions and Groups configured	Failed	2
Azure SQL Server does not have Auditing enabled	Failed	2
Azure SQL server audit logs in a storage account are kept for fewer than 90 days	Failed	2
Azure SQL servers do not have emails sent to service and co-admins	Coverage unconfirmed	0

Azure Container Registries (4 controls) 0 failed 0 passed 2 not assessed 2 unconfirmed

Control	Result	Findings
Container registry images should have vulnerability findings resolved	Not assessed	-
Attack Path: Principal can extract Azure Container Registry admin credentials	Coverage unconfirmed	0
Azure Container Registries are allowing public access	Coverage unconfirmed	0
Container registries should use private link	Not assessed	-

Azure AI Services (23 controls) 6 failed 0 passed 16 unconfirmed 1 review

Control	Result	Findings
AI Foundry agent system prompt contains a hard-coded secret	Failed	1
Attack Path: AI Foundry agent managed identity can disable or modify its own audit logs	Coverage unconfirmed	0
AI Foundry agent combines code execution with storage access tools	Coverage unconfirmed	0
Attack Path: AI Foundry agent managed identity can assign or modify Azure roles	Coverage unconfirmed	0
Attack Path: AI Foundry agent managed identity has excessive Azure RBAC permissions	Coverage unconfirmed	0
Attack Path: AI Foundry agent managed identity can read or manage Key Vault secrets	Coverage unconfirmed	0
Attack Path: Agent-connected RAG or memory store has broad write access in Azure RBAC	Coverage unconfirmed	0
Attack Path: AI Foundry agent RAG or memory store connection uses weak authentication (public access inferred)	Coverage unconfirmed	0
Attack Path: AI Foundry RAG or memory store is shared between dev/test and production agents (inferred)	Coverage unconfirmed	0
Attack Path: Multiple AI Foundry agents share the same RAG or memory store without segmentation	Coverage unconfirmed	0
Attack Path: Multiple AI Foundry projects share the same managed identity	Coverage unconfirmed	0
Attack Path: AI Foundry agent combines RAG retrieval tools with outbound OpenAPI or function tools (indirect prompt injection path)	Coverage unconfirmed	0
Attack Path: AI Foundry workspace connection uses anonymous or static API key authentication	Failed	2
Attack Path: User-controlled content can reach an AI Foundry agent with code execution capability via RAG	Coverage unconfirmed	0
Azure AI Services account has no private endpoint (architecture review)	Architecture review	1 review(s)
AI Foundry agent has no system prompt configured	Coverage unconfirmed	0
Azure AI Services account has no diagnostic settings configured	Failed	1
AI Foundry agent has an OpenAPI or HTTP function tool attached	Coverage unconfirmed	0
AI Foundry project does not have managed network isolation	Failed	1
Azure AI Services are not using Managed Identity	Coverage unconfirmed	0
Disable Local Authentication for Azure AI Services	Failed	1
Restrict public network access to Azure AI Services	Failed	1
Cognitive Services account has no diagnostic settings configured	Coverage unconfirmed	0

Azure Agentic AI (8 controls) 0 failed 0 passed 8 unconfirmed

Control	Result	Findings
Agent RAG index likely contains low-trust or unverified content sources (attestation required)	Coverage unconfirmed	0
No evidence that RAG/vector-index retrieval enforces per-user or per-source ACLs at query time	Coverage unconfirmed	0
Agent actions cannot be attributed to both user identity and agent identity	Coverage unconfirmed	0
No evidence that agent memory or RAG writes include source, actor, timestamp, and trust metadata	Coverage unconfirmed	0
No evidence that persistent agent memory has TTL, versioning, or rollback capability	Coverage unconfirmed	0
No evidence of adversarial prompt-injection or safety evaluation for production agent	Coverage unconfirmed	0
Prompt templates, tool manifests or agent definitions are not version controlled	Coverage unconfirmed	0
Third-party tools, plugins or MCP servers used by agents are not inventoried	Coverage unconfirmed	0

Azure Automation Accounts (5 controls) 1 failed 0 passed 1 not assessed 2 unconfirmed 1 review

Control	Result	Findings
Attack Path: Principal can take over an Automation Account and inherit its managed identity's privilege	Coverage unconfirmed	0
Azure Automation Account is publicly accessible	Failed	1
Automation account variables should be encrypted	Not assessed	-
Azure Automation Account should use managed identity	Coverage unconfirmed	0
Azure Automation Account has no private endpoint (architecture review)	Architecture review	1 review(s)

Azure App Services (31 controls) 17 failed 0 passed 1 not assessed 10 unconfirmed 3 review

Control	Result	Findings
Attack Path: Azure App Service Identity has access to Database	Failed	1
Attack Path: Azure App Service Identity has access to Key Vault	Failed	1
Attack Path: Principal can take over an App Service/Function App via code or deployment access	Failed	12
Attack Path: Principal can obtain an App Service/Function App credential	Failed	18
Azure App Services Functions are not restricting access from the internet.	Failed	2
Azure App Services Web App are not restricting access from the internet.	Failed	1
Attack Path: Azure App Service Identity has admin privileges	Failed	2
Azure App Services Function App is not using the latest TLS version	Coverage unconfirmed	0
Azure App Services Function App have been found to have secrets set in app settings	Failed	1
Azure Function App has no virtual network integration (architecture review)	Architecture review	2 review(s)
Azure App Services Web App have been found to have secrets set in app settings	Coverage unconfirmed	0
FTPS should be required in API apps	Coverage unconfirmed	0
FTPS should be required in function apps	Coverage unconfirmed	0
FTPS should be required in web apps	Failed	1
Function apps should have vulnerability findings resolved	Not assessed	-
Azure App Services Web App is not using the latest TLS version	Coverage unconfirmed	0
Azure Function App runs an Azure Functions host version that is no longer supported	Coverage unconfirmed	0
Azure App Services Function App is not using Application Insights	Failed	2
Azure Functions does not have a TLS/SSL certificate associated	Failed	1
Azure App Services are not enforcing HTTPS	Failed	1
Azure App Services is not using the latest HTTP version	Failed	3
Azure App Service runs a Java runtime or application server past its end of security support	Coverage unconfirmed	0
Azure App Service runs a .NET runtime past its end of support	Coverage unconfirmed	0
Azure App Service runs a PHP branch past its end of security support	Coverage unconfirmed	0
Azure App Service runs a Python branch past its end of security support	Failed	1
Azure App Services Function App does not have CORS configured.	Coverage unconfirmed	0
Managed identity should be used in App Services	Failed	1
Azure Web App does not have a TLS/SSL certificate associated	Failed	1
Azure App Service platform authentication (Easy Auth) does not block anonymous requests (architecture review)	Architecture review	3 review(s)
Azure App Services does not have Client Cert Enabled	Failed	3
Azure App Service platform authentication (Easy Auth) is not enabled (benchmark deviation, architecture review)	Architecture review	3 review(s)

Azure Virtual Machines (31 controls) 11 failed 0 passed 10 not assessed 8 unconfirmed 2 review

Control	Result	Findings
Attack Path: Azure VM Identity has access to a Database	Coverage unconfirmed	0
Attack Path: Azure VM Identity has access to Key Vault	Failed	2
Attack Path: Unprotected Network Access to Azure VMs	Coverage unconfirmed	0
Machines should have secret findings resolved	Not assessed	-
Azure VMs allow RDP access from internet	Failed	2
Azure VMs allow SSH access from internet	Failed	4
Azure VMs have a public IP associated and are publicly accessible	Failed	5
Azure VM is using a deprecated Linux Server Operating System.	Coverage unconfirmed	0
Azure VM is using a deprecated Windows Server Operating System.	Coverage unconfirmed	0
Attack Path: Principal can execute code on a Virtual Machine and inherit its managed identity's privilege	Failed	12
Machines should be configured to periodically check for missing system updates	Not assessed	-
Azure VMs do not have system updates installed	Coverage unconfirmed	0
MFA should be required for accessing privileged virtual machines.	Coverage unconfirmed	0
Attack Path: Principal can export a managed disk or snapshot	Failed	12
Adaptive network hardening recommendations should be applied on internet facing virtual machines	Not assessed	-
All network ports should be restricted on network security groups associated to your virtual machine	Not assessed	-
Azure Backup should be enabled for virtual machines	Not assessed	-
File integrity monitoring should be enabled on machines	Not assessed	-
Azure VM OS disk uses unmanaged VHD storage (architecture review)	Architecture review	0 review(s)
Azure VM network interface is not effectively filtered by a network security group	Failed	3
Azure VMs do not have Adaptive Application Controls enabled	Not assessed	-
Allowlist rules in your adaptive application control policy should be updated	Not assessed	-
Azure Linux VMs are not requiring SSH keys	Coverage unconfirmed	0
Azure VMs do not have Defender Exploit Guard enabled	Failed	1
Virtual machines should be migrated to new Azure Resource Manager resources	Not assessed	-
Azure VMs do not have Endpoint Protection installed	Failed	10
Endpoint protection should be installed on virtual machine scale sets	Not assessed	-
Vulnerabilities on Linux VMs have not been remediated	Coverage unconfirmed	0
Azure disks that are unattached are not encrypted	Failed	5
Orphaned Azure managed disks have not been removed	Failed	5
Azure VM has no platform-level redundancy (no availability set, zone or scale set) (architecture review)	Architecture review	8 review(s)

Azure Arc (7 controls) 1 failed 0 passed 6 unconfirmed

Control	Result	Findings
Attack Path: Principal can use an Azure Arc-enabled server to inherit its managed identity's downstream access	Coverage unconfirmed	0
Attack Path: Principal can execute a runbook on an Azure Arc-enabled server via a Hybrid Runbook Worker	Coverage unconfirmed	0
Attack Path: Principal can control workloads reconciled by a Flux GitOps configuration on an Azure Arc-enabled Kubernetes cluster	Coverage unconfirmed	0
Attack Path: Principal can deploy privileged pods on an Azure Arc-enabled Kubernetes cluster	Coverage unconfirmed	0
Attack Path: Principal can interactively log in to an Azure Arc-enabled server	Coverage unconfirmed	0
Attack Path: Principal can execute privileged code on an Azure Arc-enabled server via a Machine Configuration assignment	Coverage unconfirmed	0
Attack Path: Principal can execute privileged code on an Azure Arc-enabled server	Failed	6

Azure Application Gateway (2 controls) 0 failed 0 passed 2 review

Control	Result	Findings
Azure Application Gateway has a site or path without an enabled WAF (architecture review)	Architecture review	0 review(s)
Azure Application Gateway has an enabled WAF in Detection mode (architecture review)	Architecture review	0 review(s)

Azure API Management (5 controls) 0 failed 0 passed 5 not assessed

Control	Result	Findings
API endpoints in Azure API Management should be authenticated	Not assessed	-
API Management APIs should use only encrypted protocols	Not assessed	-
API Management service platform version should be stv2	Not assessed	-
Unused API operations in API Management should be disabled and removed	Not assessed	-
Azure API Management APIs should be onboarded to Defender for APIs	Not assessed	-

Detection Summary by Severity

Score	Open findings
6	492
10	261
8	191
5	142
7	109
9	109
1	75
3	28
4	16
2	8

Section 6

Priority Risks

High-priority groups and the relationship between internet exposure and confirmed paths provide additional context for the recommended actions. A group may represent an aggregate rather than a single resource.

Top high-priority finding groups

Resource	Environment	Type	Score	Why
contosocontosodb00081013560	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosocontosodb00081014340	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosocontosodb00081015100	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosocontosofile081015510	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosocontosojump081015360	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosocontosoweb0081015270	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevbaddev0sa	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevbaddev2sa	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevbaddev3sa	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevbaddev4sa	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevinsecurergba9f	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevrg8ae3	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevrgb75f	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
contosodevrgb910	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors
argstacct001	Dev	microsoft.storage/storageaccounts	10	Score increased from 8 to 10 due to high-risk factors

Internet Exposure with Attack-Path Impact

50 resource(s) were verified as internet exposed. 46 of them participate in 350 confirmed attack path(s). 5 confirmed path(s) begin from a resource ARGOS verified as internet reachable.

Exposed resource	Type	Confirmed paths	Findings	Path entry point
orderproducts1	microsoft.web/sites	46	16	Confirmed entry point
gfgsrfdgdsfgfsdg	microsoft.web/sites	30	6	Participates
webappcontosotest	microsoft.web/sites	13	13	Confirmed entry point
fhjfhdjfhadsjfhd	microsoft.storage/storageaccounts	8	8	Participates
dummysacontoso	microsoft.storage/storageaccounts	7	7	Participates
contosodevbaddev0sa	microsoft.storage/storageaccounts	6	6	Participates
contosodevbaddev2sa	microsoft.storage/storageaccounts	6	6	Participates
contosodevbaddev3sa	microsoft.storage/storageaccounts	6	6	Participates
contosodevbaddev4sa	microsoft.storage/storageaccounts	6	6	Participates
contosodevinsecurergba9f	microsoft.storage/storageaccounts	6	6	Participates

Findings on Internet-Exposed Resources

This view shows resource types where ARGOS identified findings on resources that are externally accessible. It is not a complete inventory of every internet-facing resource: the environment-wide exposure count is in Assessment Scope.

Resource type	Exposed resources with findings	Findings
microsoft.storage/storageaccounts	43	622
microsoft.web/sites	3	52
microsoft.network/networksecuritygroups	2	3
microsoft.cache/redis	1	1
microsoft.cognitiveservices/accounts/projects	1	1

Section 7

Agentic AI Security Assessment

Agentic AI Security Posture

An Agentic AI security assessment was conducted across 1 Azure AI Foundry agent and 1 project, identifying 8 detections. The assessment identified 2 attack-path risks, both involving workspace connections that use anonymous or static API key authentication, which could enable unauthorized access if credentials are exposed or insufficiently controlled. Additional findings indicate gaps in network isolation, authentication hardening, monitoring, and secret management.

Key Findings

2 attack-path detections: AI Foundry workspace connections use anonymous or static API key authentication, increasing the risk of credential misuse and unauthorized access.
1 finding: The AI Foundry project does not use managed network isolation.
1 finding: Local authentication remains enabled for Azure AI Services.
1 finding: An AI Foundry agent system prompt contains a hard-coded secret.
2 findings: Azure AI Services lacks diagnostic settings and a private endpoint, limiting visibility and exposing the service to broader network access.

Priority Recommendations

Replace anonymous and static API key workspace connections with Microsoft Entra ID-based authentication or managed identities, and rotate any existing exposed or long-lived keys.
Remove the hard-coded secret from the agent system prompt, store it in Azure Key Vault, and implement secure secret retrieval through managed identity.
Strengthen network and monitoring controls by enabling managed network isolation, restricting public network access, configuring private endpoints, disabling local authentication where supported, and enabling diagnostic logging.

Section 8

Azure Service Retirements

11 retiring service/feature(s) affect 84 resource(s) in the assessed subscriptions.

Service	Retiring feature	Retirement date	Days remaining	Urgency	Impacted resources	More information
Public IP address	Basic SKU	2025-09-30	-406	OVERDUE	13	https://azure.microsoft.com/updates?id=upgrade-to-standard-sku-public-ip-addresses-in-azure-by-30-september-2025-basic-sku-will-be-retired
Load balancer	Basic Load Balancer	2025-09-30	-406	OVERDUE	2	https://azure.microsoft.com/updates?id=azure-basic-load-balancer-will-be-retired-on-30-september-2025-upgrade-to-standard-load-balancer
Storage Account	Support for TLS 1.0 and 1.1	2026-02-03	-280	OVERDUE	33	https://techcommunity.microsoft.com/blog/azurestorageblog/tls-1-0-and-1-1-support-will-be-removed-for-new--existing-azure-storage-accounts/4026181
Azure Database for PostgreSQL flexible server	FlexibleServers- Version 11	2026-03-31	-224	OVERDUE	1	https://learn.microsoft.com/azure/postgresql/flexible-server/concepts-version-policy?WT.mc_id=Portal-AppInsightsExtension#postgresql-11-support
Storage Account	Legacy Blob and General-Purpose v1 storage accounts	2026-10-13	-28	OVERDUE	7	https://azure.microsoft.com/updates/?id=496964
App service	App Service TLS 1.0 and 1.1 support	2027-05-31	202	PLANNING	1	https://azure.microsoft.com/updates/?id=557852
Load balancer	Azure Load Balancer Inbound NAT Pools	2027-09-30	324	PLANNING	1	https://learn.microsoft.com/azure/load-balancer/load-balancer-nat-pool-migration?tabs=azure-cli
Disk	Operating System (OS) Disks on Standard HDD	2028-09-08	668	PLANNING	16	https://azure.microsoft.com/updates/?id=500157
Redis Cache Server	Redis Cache	2028-09-30	690	PLANNING	1	https://azure.microsoft.com/updates/?id=499577
Virtual machine	LSv2, G, GS, F, FS, Fsv2, B, Av2 - Series	2028-11-15	736	PLANNING	8	https://azure.microsoft.com/updates/?id=500682
Virtual machine	DSv3, Dv3, ESv3, Ev3 series virtual machines	2029-09-14	1039	PLANNING	1	https://learn.microsoft.com/azure/virtual-machines/sizes/lifecycle/retirement/d-ds-dv2-dsv2-ls-series-migration-guide

Section 9

Azure Network Well-Architected Assessment

The architectural shape of the assessed Azure networks: every virtual network in scope, its address space, its peering, and how its subnets are segmented and routed. Topology diagrams and per-resource detail are not printed here - open the ARGOS links at the end of this report for those.

Architecture Summary

Virtual networks

Subnets

Peering relationships

Gateway subnets

Address overlap	26 overlapping address-space relationship(s)
Segmentation	6 of 32 subnet(s) protected by network security groups
Routing	Every route next hop resolves inside the assessed address space
Hybrid connectivity	No virtual network gateway subnet identified
Hygiene	13 virtual network(s) contain no assessed resources

Virtual Networks

Network	Address spaces	Region	Subnets	Resources	Peered with
ustest-vnet	10.0.0.0/16	East US	1	0	Not peered
vnet-test-scan	10.5.0.0/16	South Central US	2	0	Not peered
contosodevrgvnet856	172.19.0.0/16	Japan East	1	4	badVnet, badVnet
contoso-dev-insecure-rg-vnet	10.0.0.0/8	Australia East	2	0	Not peered
badVnet	10.1.0.0/16	Australia East	3	1	contosodevrgvnet856, contosodevrgvnet856
thisisanokayvnet	10.6.0.0/16	Australia East	1	0	Not peered
vnetdev05e1a6ca	10.0.0.0/16	Australia East	1	0	Not peered
contosodevrgvnet194	172.16.0.0/16	Australia East	2	9	domaincontroller-vnet, domaincontroller-vnet
privatesubnetvnet	10.0.0.0/22	Australia East	2	0	Not peered
VNet-contosodevcluster	10.0.0.0/16	Australia East	1	0	Not peered
vnet-sqlmitestfdfsadfsad	10.0.0.0/16	Australia East	1	0	Not peered
fsafasdfsda-vnet	172.17.0.0/16	Australia East	1	1	Not peered
functions-vnet-test	172.18.0.0/16	Australia East	1	0	Not peered
vnet	172.21.0.0/16	Australia East	5	0	Not peered
VNET1	10.1.0.0/24	Australia East	1	1	Not peered
VNET2	10.1.1.0/24	Australia East	1	2	Not peered
VNET3	10.2.0.0/24	Australia Southeast	1	0	Not peered
VNET4	10.2.1.0/24	Australia Southeast	1	0
team-dev-rg-vnet	10.4.0.0/16	Germany West Central	1	0	Not peered
domaincontroller-vnet	10.3.0.0/16	Germany West Central	3	1	contosodevrgvnet194, contosodevrgvnet194

Segmentation and Routing

Network	Subnets	Without an NSG	With a route table	Via a network appliance
ustest-vnet	1	1	0	0
vnet-test-scan	2	2	0	0
contosodevrgvnet856	1	0	0	0
contoso-dev-insecure-rg-vnet	2	2	0	0
badVnet	3	1	0	0
thisisanokayvnet	1	1	0	0
vnetdev05e1a6ca	1	0	0	0
contosodevrgvnet194	2	2	1	1
privatesubnetvnet	2	2	0	0
VNet-contosodevcluster	1	1	0	0
vnet-sqlmitestfdfsadfsad	1	0	1	0
fsafasdfsda-vnet	1	1	0	0
functions-vnet-test	1	1	0	0
vnet	5	5	0	0
VNET1	1	1	0	0
VNET2	1	1	0	0
VNET3	1	1	0	0
VNET4	1	1	0	0
team-dev-rg-vnet	1	1	0	0
domaincontroller-vnet	3	2	0	0

Assessment

Key Findings

Overall compliance: The network estate has low to partial alignment with the Azure Well-Architected Framework. Positive controls include virtual network segmentation, 2 peerings, several NSGs, and some custom routing. However, substantial address-space overlap, limited subnet filtering, no clear hub-and-spoke architecture, an apparently unreachable virtual appliance next hop, numerous empty networks, and no confirmed network gateway reduce security, reliability, and operational efficiency.

Network topology: A hub-and-spoke design is not evident. The configured peerings are isolated point-to-point relationships between contosodevrgvnet856 and badVnet, and between contosodevrgvnet194 and domaincontroller-vnet. No shared hub provides centralized connectivity, inspection, or egress control.

Firewall or virtual appliance routing: The appgateway subnet in contosodevrgvnet194 has a custom route through virtual appliance IP 10.1.0.22. That IP falls within multiple overlapping assessed spaces: badVnet (10.1.0.0/16), VNET1 (10.1.0.0/24), and contoso-dev-insecure-rg-vnet (10.0.0.0/8). However, contosodevrgvnet194 is peered only with domaincontroller-vnet, so none of the networks containing the next-hop address is reachable through the documented peerings. The route is therefore likely ineffective unless connectivity outside the supplied configuration exists. The supplied unaccounted next-hop count is 0, which means the address is covered by an assessed address space, not that it is reachable. No operational centralized firewall can be confirmed from the data.

Subnet security: Of 32 subnets, only 6 have an NSG, while 26 do not. This leaves most subnet boundaries without an identified local filtering control. Workload-bearing subnets without an NSG include the default subnet in contosodevrgvnet194, the default subnet in fsafasdfsda-vnet, VNET1/subnet1, and VNET2/subnet1. NSG presence alone does not establish security because the actual inbound and outbound rules were not supplied.

Hybrid connectivity: The confirmed gateway count is 0. Although contoso-dev-insecure-rg-vnet contains a subnet named GatewaySubnet, the data does not confirm a deployed virtual network gateway. Therefore, no VPN or ExpressRoute gateway is demonstrated. ExpressRoute or a site-to-site VPN should be considered if private, resilient connectivity to on-premises or other external environments is required.

Overlapping address spaces: The supplied exact overlapping address-space count is 26. Networks participating in those overlaps are:
- ustest-vnet: 10.0.0.0/16
- vnet-test-scan: 10.5.0.0/16
- contoso-dev-insecure-rg-vnet: 10.0.0.0/8
- badVnet: 10.1.0.0/16
- thisisanokayvnet: 10.6.0.0/16
- vnetdev05e1a6ca: 10.0.0.0/16
- privatesubnetvnet: 10.0.0.0/22
- VNet-contosodevcluster: 10.0.0.0/16
- vnet-sqlmitestfdfsadfsad: 10.0.0.0/16
- VNET1: 10.1.0.0/24
- VNET2: 10.1.1.0/24
- VNET3: 10.2.0.0/24
- VNET4: 10.2.1.0/24
- team-dev-rg-vnet: 10.4.0.0/16
- domaincontroller-vnet: 10.3.0.0/16
The broad 10.0.0.0/8 allocation is particularly restrictive. These overlaps can prevent future peering, complicate route selection, and create ambiguity about destinations such as 10.1.0.22.

Unused networks: The supplied empty virtual network count is 13. These are ustest-vnet, vnet-test-scan, contoso-dev-insecure-rg-vnet, thisisanokayvnet, vnetdev05e1a6ca, privatesubnetvnet, VNet-contosodevcluster, vnet-sqlmitestfdfsadfsad, functions-vnet-test, vnet, VNET3, VNET4, and team-dev-rg-vnet. Their business purpose and dependencies should be validated before removing them. Empty networks can still contain configuration objects such as route tables or NSGs.

Default outbound internet access: Compliance cannot be determined because the data does not show NAT Gateway associations, public IP configuration, outbound load-balancer rules, or another explicit egress service. Subnets that rely on Azure's implicit default outbound access may lose outbound connectivity under the no-default-outbound model. The customer should review Microsoft's current default outbound access documentation and verify every active subnet. Empty networks should be removed if unnecessary rather than updated solely to preserve implicit outbound connectivity.

Recommendations

Establish a deliberate connectivity architecture: Adopt a hub-and-spoke design, or Azure Virtual WAN where scale and multi-region transit justify it. Place shared connectivity, DNS, private hybrid access, and centralized ingress and egress inspection in the hub. Keep workload environments in segmented spokes and permit only required traffic flows.

Correct the virtual appliance route: Confirm which resource owns 10.1.0.22 and whether it is an operational firewall appliance. Provide an intentional routed and peered path from contosodevrgvnet194, including any required forwarding and peering transit settings, or replace the next hop with the correct reachable address. Validate return routing to prevent asymmetric traffic. Remove the route if it is obsolete.

Create an enterprise IP address plan: Eliminate the 26 measured overlaps through controlled renumbering and reserve non-overlapping ranges by region, environment, and workload. Prioritize removal or reduction of 10.0.0.0/8, followed by duplicate 10.0.0.0/16 ranges and the overlapping 10.1.x ranges. Record address ownership centrally before adding peerings or hybrid connectivity.

Apply defense-in-depth filtering: Associate appropriately scoped NSGs with workload subnets that currently lack them, subject to Azure service-specific requirements. Use least-privilege inbound and outbound rules based on documented application flows. Separate application, data, management, identity, and ingress components into security boundaries rather than relying on broad default subnets.

Centralize ingress and egress controls: Use Azure Firewall or an approved network virtual appliance for inspected traffic where required. Route only relevant flows through it, use explicit allow rules, and control both north-south and east-west traffic. Public applications should expose only their ingress tier while keeping application and data tiers private.

Implement explicit outbound connectivity: For every active private subnet, select a supported outbound method such as NAT Gateway for straightforward scalable egress or a centralized firewall for inspected egress. Do not depend on implicit default outbound access. Document the required destinations, ports, DNS behavior, route path, and failure behavior.

Assess hybrid requirements: If on-premises connectivity is needed, design redundant VPN gateways or ExpressRoute with resilient circuits and connections. The existing GatewaySubnet name does not confirm a functioning gateway. Ensure planned hybrid prefixes do not overlap with Azure address spaces before deployment.

Clean up unused resources: Validate ownership and purpose for the 13 empty virtual networks. Remove abandoned virtual networks, subnets, route tables, NSGs, peerings, and reserved address ranges after dependency and recovery checks. Retain intentional placeholders only when they have documented owners and deployment plans.

Standardize governance: Enforce naming, approved address ranges, required security controls, explicit outbound connectivity, and ownership tags through Azure Policy and infrastructure as code. Require architecture review for broad CIDR allocations, custom routes, peering, and exemptions from subnet filtering.

Validate resilience and operations: Test effective routes, DNS resolution, appliance health, failover, and permitted traffic paths. Maintain current network flow diagrams that classify public, private, ingress, egress, and cross-subnet traffic so each flow has an explicit business purpose and control boundary.

Section 10

Findings and evidence

Security findings included in this assessment. Status and scores reflect the report's point-in-time data. The register includes open, pending and acknowledged findings; risk signals and severity charts use open findings. A finding may represent a population rather than a single resource. Open ARGOS for additional technical evidence and current status.

Severity	Finding	Resource or scope	Environment	Status
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhd6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhd801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhd67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhdfb79fc1a-f1fb-4d3d-ad88-facf25f91be7:attackPaths_storageAccountKeyExtraction	Jordan Lee can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhdc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhdab8fe3bb-7c8e-428d-ad23-c40bb97a4f33:attackPaths_storageAccountKeyExtraction	contoso-contributor can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhd235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.storagestorageaccountsfhjfhdjfhadsjfhd2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev0sa6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev0sa801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev0sa67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev0sac88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev0sa235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev0sa2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev2sa6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev2sa801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev2sa67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev2sac88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev2sa235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev2sa2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev3sa6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev3sa801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev3sa67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev3sac88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev3sa235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev3sa2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev4sa6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev4sa801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev4sa67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev4sac88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev4sa235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev4sa2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevinsecurergba9f6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevinsecurergba9f801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevinsecurergba9f67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevinsecurergba9fc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevinsecurergba9f235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevinsecurergba9f2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb000810135606945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081013560801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb0008101356067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081013560c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081013560235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb000810135602eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb000810143406945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081014340801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb0008101434067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081014340c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081014340235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb000810143402eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb000810151006945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081015100801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb0008101510067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081015100c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb00081015100235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosodb000810151002eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosofile0810155106945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosofile081015510801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosofile08101551067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosofile081015510c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosofile081015510235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosofile0810155102eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosojump0810153606945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosojump081015360801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosojump08101536067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosojump081015360c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosojump081015360235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosojump0810153602eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosoweb00810152706945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosoweb0081015270801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosoweb008101527067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosoweb0081015270c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosoweb0081015270235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosocontosoweb00810152702eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrg8ae36945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrg8ae3801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrg8ae367d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrg8ae3c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrg8ae3235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrg8ae32eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb75f6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb75f801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb75f67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb75fc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb75f235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb75f2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb9106945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb910801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb91067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb910c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb910235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountscontosodevrgb9102eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0016945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct001801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00167d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct001c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct001235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0012eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0026945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct002801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00267d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct002c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct002235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0022eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0036945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct003801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00367d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct003c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct003235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0032eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0046945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct004801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00467d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct004c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct004235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0042eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0056945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct005801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00567d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct005c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct005235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0052eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0066945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct006801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00667d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct006c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct006235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0062eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0076945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct007801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00767d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct007c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct007235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0072eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0086945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct008801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct00867d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct008c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct008235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct0082eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1966945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct196801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct19667d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct196c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct196235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1962eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1976945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct197801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct19767d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct197c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct197235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1972eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1986945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct198801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct19867d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct198c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct198235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1982eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1996945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct199801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct19967d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct199c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct199235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct1992eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct2006945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct200801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct20067d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct200c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct200235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsargstacct2002eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdsfsdfsdfgff6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdsfsdfsdfgff801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdsfsdfsdfgff67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdsfsdfsdfgffc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdsfsdfsdfgff235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdsfsdfsdfgff2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdummysacontoso6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdummysacontoso801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdummysacontoso67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdummysacontosoc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdummysacontosoe6687757-a43e-4436-a3a9-8942f008a380:attackPaths_storageAccountKeyExtraction	webappcontosotest can extract credentials from dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdummysacontoso235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsdummysacontoso2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsnewcontosobadsa6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsnewcontosobadsa801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsnewcontosobadsa67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsnewcontosobadsac88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsnewcontosobadsa235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsnewcontosobadsa2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsrewrfaeraewrfaesrfasef6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsrewrfaeraewrfaesrfasef801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsrewrfaeraewrfaesrfasef67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsrewrfaeraewrfaesrfasefc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsrewrfaeraewrfaesrfasef235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsrewrfaeraewrfaesrfasef2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountssflogscontosodevcluste20386945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountssflogscontosodevcluste2038801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountssflogscontosodevcluste203867d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountssflogscontosodevcluste2038c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountssflogscontosodevcluste2038235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountssflogscontosodevcluste20382eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontoso82986945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontoso8298801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontoso829867d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontoso8298c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontoso8298235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontoso82982eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontosobfbe6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontosobfbe801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontosobfbe67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontosobfbec88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontosobfbe235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsstorageaccountcontosobfbe2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsvdxfvsdfsdfv6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsvdxfvsdfsdfv801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsvdxfvsdfsdfv67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsvdxfvsdfsdfvc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsvdxfvsdfsdfv235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsvdxfvsdfsdfv2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbad26945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbad2801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbad267d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbad2c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbad2235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbad22eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbadstorage6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbadstorage801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbadstorage67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbadstoragec88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbadstorage235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.storagestorageaccountsyetanotherbadstorage2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsazure-iamprovidersmicrosoft.storagestorageaccountsazureiamparking6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsazure-iamprovidersmicrosoft.storagestorageaccountsazureiamparking801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsazure-iamprovidersmicrosoft.storagestorageaccountsazureiamparking67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsazure-iamprovidersmicrosoft.storagestorageaccountsazureiamparkingc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsazure-iamprovidersmicrosoft.storagestorageaccountsazureiamparking235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsazure-iamprovidersmicrosoft.storagestorageaccountsazureiamparking2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs110032000f71044ed6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs110032000f71044ed801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs110032000f71044ed67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs110032000f71044edc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs110032000f71044ed235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs110032000f71044ed2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs1100320034a5146ba6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs1100320034a5146ba801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs1100320034a5146ba67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs1100320034a5146bac88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs1100320034a5146ba235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscloud-shell-storage-southeastasiaprovidersmicrosoft.storagestorageaccountscs1100320034a5146ba2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-consumption-flexprovidersmicrosoft.storagestorageaccountsfunctionsconsumptio9fc66945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-consumption-flexprovidersmicrosoft.storagestorageaccountsfunctionsconsumptio9fc6801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-consumption-flexprovidersmicrosoft.storagestorageaccountsfunctionsconsumptio9fc667d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-consumption-flexprovidersmicrosoft.storagestorageaccountsfunctionsconsumptio9fc6c88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-consumption-flexprovidersmicrosoft.storagestorageaccountsfunctionsconsumptio9fc6235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-consumption-flexprovidersmicrosoft.storagestorageaccountsfunctionsconsumptio9fc62eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-vnet-testprovidersmicrosoft.storagestorageaccountsstorageaccountfunct936f6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-vnet-testprovidersmicrosoft.storagestorageaccountsstorageaccountfunct936f801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-vnet-testprovidersmicrosoft.storagestorageaccountsstorageaccountfunct936f67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-vnet-testprovidersmicrosoft.storagestorageaccountsstorageaccountfunct936fc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-vnet-testprovidersmicrosoft.storagestorageaccountsstorageaccountfunct936f235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (10)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfunctions-vnet-testprovidersmicrosoft.storagestorageaccountsstorageaccountfunct936f2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure that App Services Functions are not accessible by anybody from the Internet appServices_AppServicesPublic / gfgsrfdgdsfgfsdg:appServices_AppServicesPublic	gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure that App Services Functions are not accessible by anybody from the Internet appServices_AppServicesPublic / orderproducts1:appServices_AppServicesPublic	orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure that App Services Web Apps are not accessible by anybody from the Internet appServices_webAppPublic / webappcontosotest:appServices_webAppPublic	webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts16945d750-ef98-4624-aafe-fd9cd5e8ecf5execute:attackPaths_appServiceCodeTakeover	f39a965a9abe7ac328578764 can execute code on orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts1801256c9-cc77-4531-af67-b477812e0b95execute:attackPaths_appServiceCodeTakeover	7e310e21f217b02ca2bb0892 can execute code on orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts167d029fa-3f7d-454f-a851-932048b1b074execute:attackPaths_appServiceCodeTakeover	contoso-github-actions can execute code on orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts1c88d1633-95f9-49d0-a865-889361308164execute:attackPaths_appServiceCodeTakeover	Sam Taylor can execute code on orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts1235b348b-db57-446c-ae5c-9e4b5d8053b3execute:attackPaths_appServiceCodeTakeover	Contoso Cloud - Projects Team can execute code on orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts12eb4f07f-c67d-441e-a51c-3014874798acexecute:attackPaths_appServiceCodeTakeover	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can execute code on orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest6945d750-ef98-4624-aafe-fd9cd5e8ecf5execute:attackPaths_appServiceCodeTakeover	f39a965a9abe7ac328578764 can execute code on webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest801256c9-cc77-4531-af67-b477812e0b95execute:attackPaths_appServiceCodeTakeover	7e310e21f217b02ca2bb0892 can execute code on webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest67d029fa-3f7d-454f-a851-932048b1b074execute:attackPaths_appServiceCodeTakeover	contoso-github-actions can execute code on webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotestc88d1633-95f9-49d0-a865-889361308164execute:attackPaths_appServiceCodeTakeover	Sam Taylor can execute code on webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest235b348b-db57-446c-ae5c-9e4b5d8053b3execute:attackPaths_appServiceCodeTakeover	Contoso Cloud - Projects Team can execute code on webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path attackPaths_appServiceCodeTakeover / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest2eb4f07f-c67d-441e-a51c-3014874798acexecute:attackPaths_appServiceCodeTakeover	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can execute code on webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesgfgsrfdgdsfgfsdg6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_appServiceCredentialExtraction	f39a965a9abe7ac328578764 can retrieve the Functions host keys and master key of gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesgfgsrfdgdsfgfsdg801256c9-cc77-4531-af67-b477812e0b95:attackPaths_appServiceCredentialExtraction	7e310e21f217b02ca2bb0892 can retrieve the Functions host keys and master key of gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesgfgsrfdgdsfgfsdg67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_appServiceCredentialExtraction	contoso-github-actions can retrieve the Functions host keys and master key of gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesgfgsrfdgdsfgfsdgc88d1633-95f9-49d0-a865-889361308164:attackPaths_appServiceCredentialExtraction	Sam Taylor can retrieve the Functions host keys and master key of gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesgfgsrfdgdsfgfsdg235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_appServiceCredentialExtraction	Contoso Cloud - Projects Team can retrieve the Functions host keys and master key of gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesgfgsrfdgdsfgfsdg2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_appServiceCredentialExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can retrieve the Functions host keys and master key of gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts16945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_appServiceCredentialExtraction	f39a965a9abe7ac328578764 can retrieve the Functions host keys and master key of orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts1801256c9-cc77-4531-af67-b477812e0b95:attackPaths_appServiceCredentialExtraction	7e310e21f217b02ca2bb0892 can retrieve the Functions host keys and master key of orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts167d029fa-3f7d-454f-a851-932048b1b074:attackPaths_appServiceCredentialExtraction	contoso-github-actions can retrieve the Functions host keys and master key of orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts1c88d1633-95f9-49d0-a865-889361308164:attackPaths_appServiceCredentialExtraction	Sam Taylor can retrieve the Functions host keys and master key of orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts1235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_appServiceCredentialExtraction	Contoso Cloud - Projects Team can retrieve the Functions host keys and master key of orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websitesorderproducts12eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_appServiceCredentialExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can retrieve the Functions host keys and master key of orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_appServiceCredentialExtraction	f39a965a9abe7ac328578764 can retrieve usable publishing credentials for webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest801256c9-cc77-4531-af67-b477812e0b95:attackPaths_appServiceCredentialExtraction	7e310e21f217b02ca2bb0892 can retrieve usable publishing credentials for webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_appServiceCredentialExtraction	contoso-github-actions can retrieve usable publishing credentials for webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotestc88d1633-95f9-49d0-a865-889361308164:attackPaths_appServiceCredentialExtraction	Sam Taylor can retrieve usable publishing credentials for webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_appServiceCredentialExtraction	Contoso Cloud - Projects Team can retrieve usable publishing credentials for webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need attackPaths_appServiceCredentialExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.websiteswebappcontosotest2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_appServiceCredentialExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can retrieve usable publishing credentials for webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Azure App Service managed identity has been found to have access to a Database attackPaths_appServiceWithIdentityAccessToDatabase / 82d298d228a8ae075ce523ad377937c4b584ec1274f68a821cbb4ec7a9e65171:attackPaths_appServiceWithIdentityAccessToDatabase	orderproducts1 can access a database via orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Azure App Service managed identity has been found to have access to a Key Vault attackPaths_appServiceWithIdentityAccessToKeyVault / 2f13418fadb4ea451714893798c969ac487eeeb385e228943b9591390a6f256d:attackPaths_appServiceWithIdentityAccessToKeyVault	orderproducts1 can access Key Vault via orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure that your Azure App Services are not configured with an identity with admin privileges attackPaths_appServiceWithIdentityUsingAdminPrivileges / 2f13418fadb4ea451714893798c969ac487eeeb385e228943b9591390a6f256d:attackPaths_appServiceWithIdentityUsingAdminPrivileges	App Service orderproducts1 uses a managed identity with administrative access to resource contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure that your Azure App Services are not configured with an identity with admin privileges attackPaths_appServiceWithIdentityUsingAdminPrivileges / 82d298d228a8ae075ce523ad377937c4b584ec1274f68a821cbb4ec7a9e65171:attackPaths_appServiceWithIdentityUsingAdminPrivileges	App Service orderproducts1 uses a managed identity with administrative access to resource importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot write role assignments or role definitions outside of a controlled process attackPaths_azureRbacSelfEscalation / providersmicrosoft.authorizationroleassignments18904bce-fe9c-49bf-ad19-08d411a454c6:attackPaths_azureRbacSelfEscalation	Sam Taylor can self-escalate Azure RBAC privilege at subscription 'Dev' /providers/microsoft.authorization/roleassignments/18904bce-fe9c-49bf-ad19-08d411a454c6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot write role assignments or role definitions outside of a controlled process attackPaths_azureRbacSelfEscalation / providersmicrosoft.managementmanagementgroups97a795e8-b7fb-430c-af82-ecbc152813a6providersmicrosoft.authorizationroleassignments5c690fb6-febc-42e2-a799-11984ff9c7e0:attackPaths_azureRbacSelfEscalation	Contoso Cloud - Projects Team can self-escalate Azure RBAC privilege at the management group/tenant root /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/5c690fb6-febc-42e2-a799-11984ff9c7e0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot write role assignments or role definitions outside of a controlled process attackPaths_azureRbacSelfEscalation / providersmicrosoft.managementmanagementgroupsdevprovidersmicrosoft.authorizationroleassignmentsf2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d:attackPaths_azureRbacSelfEscalation	Sam Taylor can self-escalate Azure RBAC privilege at the management group/tenant root /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/f2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot write role assignments or role definitions outside of a controlled process attackPaths_azureRbacSelfEscalation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments61470f9d-5fab-47af-a96d-f828dd124966:attackPaths_azureRbacSelfEscalation	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can self-escalate Azure RBAC privilege at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot write role assignments or role definitions outside of a controlled process attackPaths_azureRbacSelfEscalation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments71fedb2c-68f7-447b-ace4-1fe0455939bc:attackPaths_azureRbacSelfEscalation	Contoso Cloud - Projects Team can self-escalate Azure RBAC privilege at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/71fedb2c-68f7-447b-ace4-1fe0455939bc	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot write role assignments or role definitions outside of a controlled process attackPaths_azureRbacSelfEscalation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments65d59f2f-05f2-45ec-a89e-b47c683a897a:attackPaths_azureRbacSelfEscalation	Sam Taylor can self-escalate Azure RBAC privilege at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/65d59f2f-05f2-45ec-a89e-b47c683a897a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot write role assignments or role definitions outside of a controlled process attackPaths_azureRbacSelfEscalation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfoundryprovidersmicrosoft.cognitiveservicesaccountscontoso-foundry-devprovidersmicrosoft.authorizationroleassignments65808402-f39f-45b1-a283-dfc78ab071b2:attackPaths_azureRbacSelfEscalation	Sam Taylor can self-escalate Azure RBAC privilege at resource 'contoso-foundry-dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/providers/microsoft.authorization/roleassignments/65808402-f39f-45b1-a283-dfc78ab071b2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldevprovidersmicrosoft.authorizationroleassignmentsb3308c7e-ef4b-413a-a98e-b815131bd426:attackPaths_contributorRole	orderproducts1 has Contributor-equivalent access at resource 'contosolocaldev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/b3308c7e-ef4b-413a-a98e-b815131bd426	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldevprovidersmicrosoft.authorizationroleassignments18b9926e-0a0b-4d2f-a2b2-8ee6c51618b8:attackPaths_contributorRole	web002 has Contributor-equivalent access at resource 'contosolocaldev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev/providers/microsoft.authorization/roleassignments/18b9926e-0a0b-4d2f-a2b2-8ee6c51618b8	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldev6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_keyVaultAccessPolicySelfGrant	f39a965a9abe7ac328578764 can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldev801256c9-cc77-4531-af67-b477812e0b95:attackPaths_keyVaultAccessPolicySelfGrant	7e310e21f217b02ca2bb0892 can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldevbcab44f7-2dc0-486d-a224-54955648d810:attackPaths_keyVaultAccessPolicySelfGrant	orderproducts1 can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldev67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_keyVaultAccessPolicySelfGrant	contoso-github-actions can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldevc88d1633-95f9-49d0-a865-889361308164:attackPaths_keyVaultAccessPolicySelfGrant	Sam Taylor can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldev235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_keyVaultAccessPolicySelfGrant	Contoso Cloud - Projects Team can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldev812fc112-7499-4a45-abd7-2b5a2782da4d:attackPaths_keyVaultAccessPolicySelfGrant	web002 can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access attackPaths_keyVaultAccessPolicySelfGrant / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-local-dev-supportprovidersmicrosoft.keyvaultvaultscontosolocaldev2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_keyVaultAccessPolicySelfGrant	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can self-grant Key Vault access to contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversbadsqlservercontoso6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_sqlEntraAdministratorReplacement	f39a965a9abe7ac328578764 can replace the Entra administrator on badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversbadsqlservercontoso801256c9-cc77-4531-af67-b477812e0b95:attackPaths_sqlEntraAdministratorReplacement	7e310e21f217b02ca2bb0892 can replace the Entra administrator on badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversbadsqlservercontoso67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_sqlEntraAdministratorReplacement	contoso-github-actions can replace the Entra administrator on badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversbadsqlservercontosoc88d1633-95f9-49d0-a865-889361308164:attackPaths_sqlEntraAdministratorReplacement	Sam Taylor can replace the Entra administrator on badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversbadsqlservercontoso235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_sqlEntraAdministratorReplacement	Contoso Cloud - Projects Team can replace the Entra administrator on badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversbadsqlservercontoso2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_sqlEntraAdministratorReplacement	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can replace the Entra administrator on badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsql6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_sqlEntraAdministratorReplacement	f39a965a9abe7ac328578764 can replace the Entra administrator on importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsql801256c9-cc77-4531-af67-b477812e0b95:attackPaths_sqlEntraAdministratorReplacement	7e310e21f217b02ca2bb0892 can replace the Entra administrator on importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsqlbcab44f7-2dc0-486d-a224-54955648d810:attackPaths_sqlEntraAdministratorReplacement	orderproducts1 can replace the Entra administrator on importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsql67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_sqlEntraAdministratorReplacement	contoso-github-actions can replace the Entra administrator on importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsqlc88d1633-95f9-49d0-a865-889361308164:attackPaths_sqlEntraAdministratorReplacement	Sam Taylor can replace the Entra administrator on importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsql235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_sqlEntraAdministratorReplacement	Contoso Cloud - Projects Team can replace the Entra administrator on importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process attackPaths_sqlEntraAdministratorReplacement / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsql2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_sqlEntraAdministratorReplacement	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can replace the Entra administrator on importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev1sa6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev1sa801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev1sa67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev1sac88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev1sa235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.storagestorageaccountscontosodevbaddev1sa2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsnetwork-testprovidersmicrosoft.storagestorageaccountsauth0test6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_storageAccountKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsnetwork-testprovidersmicrosoft.storagestorageaccountsauth0test801256c9-cc77-4531-af67-b477812e0b95:attackPaths_storageAccountKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsnetwork-testprovidersmicrosoft.storagestorageaccountsauth0test67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_storageAccountKeyExtraction	contoso-github-actions can extract credentials from auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsnetwork-testprovidersmicrosoft.storagestorageaccountsauth0testc88d1633-95f9-49d0-a865-889361308164:attackPaths_storageAccountKeyExtraction	Sam Taylor can extract credentials from auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsnetwork-testprovidersmicrosoft.storagestorageaccountsauth0test235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_storageAccountKeyExtraction	Contoso Cloud - Projects Team can extract credentials from auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process attackPaths_storageAccountKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsnetwork-testprovidersmicrosoft.storagestorageaccountsauth0test2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_storageAccountKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure that the server's firewall is correctly configured. databaseServices_postgresAllowAllServices / contosopostgresqlnonflexible:databaseServices_postgresAllowAllServices	contosopostgresqlnonflexible /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.dbforpostgresql/flexibleservers/contosopostgresqlnonflexible	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure that the server's firewall is correctly configured. databaseServices_postgresAllowAllServices / postgrescontosobad:databaseServices_postgresAllowAllServices	postgrescontosobad /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.dbforpostgresql/flexibleservers/postgrescontosobad	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure no Azure SQL server firewall rule admits every internet address (0.0.0.0 - 255.255.255.255) or every Azure service (0.0.0.0 - 0.0.0.0) while public network access is enabled networking_sqlAccessRestrictedInternet / badsqlservercontoso:networking_sqlAccessRestrictedInternet	badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure no Azure SQL server firewall rule admits every internet address (0.0.0.0 - 255.255.255.255) or every Azure service (0.0.0.0 - 0.0.0.0) while public network access is enabled networking_sqlAccessRestrictedInternet / importantsql:networking_sqlAccessRestrictedInternet	importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosocontosodb00081013560:storageAccounts_crossTenantReplicationDisabled	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosocontosodb00081014340:storageAccounts_crossTenantReplicationDisabled	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosocontosodb00081015100:storageAccounts_crossTenantReplicationDisabled	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosocontosofile081015510:storageAccounts_crossTenantReplicationDisabled	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosocontosojump081015360:storageAccounts_crossTenantReplicationDisabled	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosocontosoweb0081015270:storageAccounts_crossTenantReplicationDisabled	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosodevbaddev0sa:storageAccounts_crossTenantReplicationDisabled	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosodevbaddev2sa:storageAccounts_crossTenantReplicationDisabled	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosodevbaddev3sa:storageAccounts_crossTenantReplicationDisabled	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosodevbaddev4sa:storageAccounts_crossTenantReplicationDisabled	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosodevinsecurergba9f:storageAccounts_crossTenantReplicationDisabled	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosodevrgb75f:storageAccounts_crossTenantReplicationDisabled	contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / azureiamparking:storageAccounts_crossTenantReplicationDisabled	azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / cs110032000f71044ed:storageAccounts_crossTenantReplicationDisabled	cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / dsfsdfsdfgff:storageAccounts_crossTenantReplicationDisabled	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / dummysacontoso:storageAccounts_crossTenantReplicationDisabled	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / fhjfhdjfhadsjfhd:storageAccounts_crossTenantReplicationDisabled	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / newcontosobadsa:storageAccounts_crossTenantReplicationDisabled	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / rewrfaeraewrfaesrfasef:storageAccounts_crossTenantReplicationDisabled	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / sflogscontosodevcluste2038:storageAccounts_crossTenantReplicationDisabled	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / storageaccountcontoso8298:storageAccounts_crossTenantReplicationDisabled	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / storageaccountcontosobfbe:storageAccounts_crossTenantReplicationDisabled	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / storageaccountfunct936f:storageAccounts_crossTenantReplicationDisabled	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / vdxfvsdfsdfv:storageAccounts_crossTenantReplicationDisabled	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / yetanotherbad2:storageAccounts_crossTenantReplicationDisabled	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Critical (9)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / yetanotherbadstorage:storageAccounts_crossTenantReplicationDisabled	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure AI Foundry agent system prompts do not contain hard-coded credentials aiFoundry_agentSecretInSystemPrompt / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfoundryprovidersmicrosoft.cognitiveservicesaccountscontoso-foundry-devprojectsproj-defaultagentstest-agent:aiFoundry_agentSecretInSystemPrompt	test-agent /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/projects/proj-default/agents/test-agent	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Use Entra ID or managed identity authentication for AI Foundry workspace connections aiFoundry_openApiToolAllowsAnonymousOrApiKeyAuth / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfoundryprovidersmicrosoft.cognitiveservicesaccountscontoso-foundry-devprojectsproj-defaultconnectionscontosoopenaij9kdyn:aiFoundry_openApiToolAllowsAnonymousOrApiKeyAuth	contosoopenaij9kdyn /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/projects/proj-default/connections/contosoopenaij9kdyn	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Use Entra ID or managed identity authentication for AI Foundry workspace connections aiFoundry_openApiToolAllowsAnonymousOrApiKeyAuth / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfoundryprovidersmicrosoft.cognitiveservicesaccountscontoso-foundry-devprojectsproj-defaultconnectionsazureiamparkingj9kdyn:aiFoundry_openApiToolAllowsAnonymousOrApiKeyAuth	azureiamparkingj9kdyn /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/projects/proj-default/connections/azureiamparkingj9kdyn	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Run Command or extension-management access to Azure Arc-enabled servers do not have unreviewed privileged execution capability attackPaths_arcServerPrivilegedExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsarcprovidersmicrosoft.hybridcomputemachineswin-6uefkaijsjv6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_arcServerPrivilegedExecution	f39a965a9abe7ac328578764 can execute privileged code on WIN-6UEFKAIJSJV /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/arc/providers/microsoft.hybridcompute/machines/win-6uefkaijsjv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Run Command or extension-management access to Azure Arc-enabled servers do not have unreviewed privileged execution capability attackPaths_arcServerPrivilegedExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsarcprovidersmicrosoft.hybridcomputemachineswin-6uefkaijsjv801256c9-cc77-4531-af67-b477812e0b95:attackPaths_arcServerPrivilegedExecution	7e310e21f217b02ca2bb0892 can execute privileged code on WIN-6UEFKAIJSJV /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/arc/providers/microsoft.hybridcompute/machines/win-6uefkaijsjv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Run Command or extension-management access to Azure Arc-enabled servers do not have unreviewed privileged execution capability attackPaths_arcServerPrivilegedExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsarcprovidersmicrosoft.hybridcomputemachineswin-6uefkaijsjv67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_arcServerPrivilegedExecution	contoso-github-actions can execute privileged code on WIN-6UEFKAIJSJV /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/arc/providers/microsoft.hybridcompute/machines/win-6uefkaijsjv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Run Command or extension-management access to Azure Arc-enabled servers do not have unreviewed privileged execution capability attackPaths_arcServerPrivilegedExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsarcprovidersmicrosoft.hybridcomputemachineswin-6uefkaijsjvc88d1633-95f9-49d0-a865-889361308164:attackPaths_arcServerPrivilegedExecution	Sam Taylor can execute privileged code on WIN-6UEFKAIJSJV /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/arc/providers/microsoft.hybridcompute/machines/win-6uefkaijsjv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Run Command or extension-management access to Azure Arc-enabled servers do not have unreviewed privileged execution capability attackPaths_arcServerPrivilegedExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsarcprovidersmicrosoft.hybridcomputemachineswin-6uefkaijsjv235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_arcServerPrivilegedExecution	Contoso Cloud - Projects Team can execute privileged code on WIN-6UEFKAIJSJV /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/arc/providers/microsoft.hybridcompute/machines/win-6uefkaijsjv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Run Command or extension-management access to Azure Arc-enabled servers do not have unreviewed privileged execution capability attackPaths_arcServerPrivilegedExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsarcprovidersmicrosoft.hybridcomputemachineswin-6uefkaijsjv2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_arcServerPrivilegedExecution	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can execute privileged code on WIN-6UEFKAIJSJV /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/arc/providers/microsoft.hybridcompute/machines/win-6uefkaijsjv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / providersmicrosoft.managementmanagementgroups97a795e8-b7fb-430c-af82-ecbc152813a6providersmicrosoft.authorizationroleassignments55d108d7-2db1-4d70-aeb0-49495e8fe57a:attackPaths_contributorRole	7e310e21f217b02ca2bb0892 has Contributor-equivalent access at the management group/tenant root /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/55d108d7-2db1-4d70-aeb0-49495e8fe57a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / providersmicrosoft.managementmanagementgroups97a795e8-b7fb-430c-af82-ecbc152813a6providersmicrosoft.authorizationroleassignmentsf96e4f8a-75e9-4fda-a0fc-7fef24a18aea:attackPaths_contributorRole	contoso-github-actions has Contributor-equivalent access at the management group/tenant root /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/f96e4f8a-75e9-4fda-a0fc-7fef24a18aea	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / providersmicrosoft.managementmanagementgroups97a795e8-b7fb-430c-af82-ecbc152813a6providersmicrosoft.authorizationroleassignmentsecf68ece-61e5-4ee8-adb8-3376e2435422:attackPaths_contributorRole	f39a965a9abe7ac328578764 has Contributor-equivalent access at the management group/tenant root /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/ecf68ece-61e5-4ee8-adb8-3376e2435422	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / providersmicrosoft.managementmanagementgroupsdevprovidersmicrosoft.authorizationroleassignments80a336f6-ef1b-4171-a2da-0e1fe7c48e21:attackPaths_contributorRole	370a931473355be74a9dc3ad has Contributor-equivalent access at the management group/tenant root /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/80a336f6-ef1b-4171-a2da-0e1fe7c48e21	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.authorizationroleassignmentsad53b955-e8db-4722-a959-9eb5145d3612:attackPaths_contributorRole	contoso-contributor has Contributor-equivalent access at resource group 'team-dev-rg' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/ad53b955-e8db-4722-a959-9eb5145d3612	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.authorizationroleassignments74e3fccd-a6cb-4913-a870-f7dde226a5db:attackPaths_contributorRole	Jordan Lee has Contributor-equivalent access at resource group 'team-dev-rg' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.authorization/roleassignments/74e3fccd-a6cb-4913-a870-f7dde226a5db	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.sqlserversimportantsqlprovidersmicrosoft.authorizationroleassignments7baeb04f-7b2f-464f-af47-02709d921880:attackPaths_contributorRole	orderproducts1 has Contributor-equivalent access at resource 'importantsql' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql/providers/microsoft.authorization/roleassignments/7baeb04f-7b2f-464f-af47-02709d921880	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Contributor role are properly monitored attackPaths_contributorRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinesdc001providersmicrosoft.authorizationroleassignments65921218-7b1a-4a24-a840-34e0f5d7c01a:attackPaths_contributorRole	Jordan Lee has Contributor-equivalent access at resource 'dc001' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/dc001/providers/microsoft.authorization/roleassignments/65921218-7b1a-4a24-a840-34e0f5d7c01a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Owner role are properly monitored attackPaths_ownerRole / providersmicrosoft.managementmanagementgroupsdevprovidersmicrosoft.authorizationroleassignmentsf2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d:attackPaths_ownerRole	Sam Taylor has Owner-equivalent access at the management group/tenant root /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/f2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Owner role are properly monitored attackPaths_ownerRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments61470f9d-5fab-47af-a96d-f828dd124966:attackPaths_ownerRole	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) has Owner-equivalent access at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Owner role are properly monitored attackPaths_ownerRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments71fedb2c-68f7-447b-ace4-1fe0455939bc:attackPaths_ownerRole	Contoso Cloud - Projects Team has Owner-equivalent access at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/71fedb2c-68f7-447b-ace4-1fe0455939bc	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with Owner role are properly monitored attackPaths_ownerRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments65d59f2f-05f2-45ec-a89e-b47c683a897a:attackPaths_ownerRole	Sam Taylor has Owner-equivalent access at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/65d59f2f-05f2-45ec-a89e-b47c683a897a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with User Access Administrator role are properly monitored attackPaths_userAccessAdministratorRole / providersmicrosoft.authorizationroleassignments18904bce-fe9c-49bf-ad19-08d411a454c6:attackPaths_userAccessAdministratorRole	Sam Taylor has User Access Administrator-equivalent access at subscription 'Dev' /providers/microsoft.authorization/roleassignments/18904bce-fe9c-49bf-ad19-08d411a454c6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with User Access Administrator role are properly monitored attackPaths_userAccessAdministratorRole / providersmicrosoft.managementmanagementgroups97a795e8-b7fb-430c-af82-ecbc152813a6providersmicrosoft.authorizationroleassignments5c690fb6-febc-42e2-a799-11984ff9c7e0:attackPaths_userAccessAdministratorRole	Contoso Cloud - Projects Team has User Access Administrator-equivalent access at the management group/tenant root /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/5c690fb6-febc-42e2-a799-11984ff9c7e0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with User Access Administrator role are properly monitored attackPaths_userAccessAdministratorRole / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfoundryprovidersmicrosoft.cognitiveservicesaccountscontoso-foundry-devprovidersmicrosoft.authorizationroleassignments65808402-f39f-45b1-a283-dfc78ab071b2:attackPaths_userAccessAdministratorRole	Sam Taylor can create role assignments at resource 'contoso-foundry-dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/providers/microsoft.authorization/roleassignments/65808402-f39f-45b1-a283-dfc78ab071b2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesjumpbox6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_virtualMachineRunCommandExecution	f39a965a9abe7ac328578764 can execute code on jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesjumpbox801256c9-cc77-4531-af67-b477812e0b95:attackPaths_virtualMachineRunCommandExecution	7e310e21f217b02ca2bb0892 can execute code on jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesjumpbox67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_virtualMachineRunCommandExecution	contoso-github-actions can execute code on jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesjumpboxc88d1633-95f9-49d0-a865-889361308164:attackPaths_virtualMachineRunCommandExecution	Sam Taylor can execute code on jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesjumpbox235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_virtualMachineRunCommandExecution	Contoso Cloud - Projects Team can execute code on jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesjumpbox2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_virtualMachineRunCommandExecution	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can execute code on jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb0026945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_virtualMachineRunCommandExecution	f39a965a9abe7ac328578764 can execute code on web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb002801256c9-cc77-4531-af67-b477812e0b95:attackPaths_virtualMachineRunCommandExecution	7e310e21f217b02ca2bb0892 can execute code on web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb00267d029fa-3f7d-454f-a851-932048b1b074:attackPaths_virtualMachineRunCommandExecution	contoso-github-actions can execute code on web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb002c88d1633-95f9-49d0-a865-889361308164:attackPaths_virtualMachineRunCommandExecution	Sam Taylor can execute code on web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb002235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_virtualMachineRunCommandExecution	Contoso Cloud - Projects Team can execute code on web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity attackPaths_virtualMachineRunCommandExecution / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb0022eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_virtualMachineRunCommandExecution	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can execute code on web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Azure VM managed identity has been found to have access to a Key Vault attackPaths_vmWithIdentityAccessToKeyVault / 00ac4fff781e927f97aaf198ac702049d87a35a44217678bd5d36998bd6c8ed8:attackPaths_vmWithIdentityAccessToKeyVault	jumpbox can access Key Vault via jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Azure VM managed identity has been found to have access to a Key Vault attackPaths_vmWithIdentityAccessToKeyVault / 26f9b8bac10bca8b58b1f7b8e1b473c3e996f455762c218d98237e6c192eb399:attackPaths_vmWithIdentityAccessToKeyVault	web002 can access Key Vault via web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that public network access to Azure AI Services is restricted. cognitiveServices_publicAccess / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfoundryprovidersmicrosoft.cognitiveservicesaccountscontoso-foundry-dev:cognitiveServices_publicAccess	contoso-foundry-dev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/foundry/providers/Microsoft.CognitiveServices/accounts/contoso-foundry-dev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksavailabilityset-vm_osdisk_1_5b12673de3ef4048806a635e0ecae28e:disks_diskPublicAccessDisabled	availabilityset-vm_OsDisk_1_5b12673de3ef4048806a635e0ecae28e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/availabilityset-vm_osdisk_1_5b12673de3ef4048806a635e0ecae28e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksdb002-os-vhd:disks_diskPublicAccessDisabled	db002-os-vhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/db002-os-vhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksdomaincontroller01_osdisk_1_2c7c3d3da48d4c9489f8c12b69a9647d:disks_diskPublicAccessDisabled	domaincontroller01_OsDisk_1_2c7c3d3da48d4c9489f8c12b69a9647d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/domaincontroller01_osdisk_1_2c7c3d3da48d4c9489f8c12b69a9647d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksdummyvmcontoso_osdisk_1_20271aaec66241be9a37f87e21a5a26e:disks_diskPublicAccessDisabled	dummyvmcontoso_OsDisk_1_20271aaec66241be9a37f87e21a5a26e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/dummyvmcontoso_osdisk_1_20271aaec66241be9a37f87e21a5a26e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksfdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed:disks_diskPublicAccessDisabled	fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksfileserver001-os-vhd:disks_diskPublicAccessDisabled	fileserver001-os-vhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/fileserver001-os-vhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksjumpbox-os-vhd:disks_diskPublicAccessDisabled	jumpbox-os-vhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/jumpbox-os-vhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksomigodahhhhhhhhhh_osdisk_1_5ed64e61acaa40aab2f90c8346239188:disks_diskPublicAccessDisabled	omigodahhhhhhhhhh_OsDisk_1_5ed64e61acaa40aab2f90c8346239188 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/omigodahhhhhhhhhh_osdisk_1_5ed64e61acaa40aab2f90c8346239188	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24:disks_diskPublicAccessDisabled	ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksthebestestvm_osdisk_1_a5e6d76de06845db8da3f18e90640e72:disks_diskPublicAccessDisabled	thebestestvm_OsDisk_1_a5e6d76de06845db8da3f18e90640e72 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/thebestestvm_osdisk_1_a5e6d76de06845db8da3f18e90640e72	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksvmss-test_44a61f7d_osdisk_1_d5c239fd4252437d86633f699d1cab90:disks_diskPublicAccessDisabled	vmss-test_44a61f7d_OsDisk_1_d5c239fd4252437d86633f699d1cab90 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/vmss-test_44a61f7d_osdisk_1_d5c239fd4252437d86633f699d1cab90	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksvmss-test_50ea3b8a_osdisk_1_4e327b87a8d046a19b6f025e40a39098:disks_diskPublicAccessDisabled	vmss-test_50ea3b8a_OsDisk_1_4e327b87a8d046a19b6f025e40a39098 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/vmss-test_50ea3b8a_osdisk_1_4e327b87a8d046a19b6f025e40a39098	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computedisksweb002-os-vhd:disks_diskPublicAccessDisabled	web002-os-vhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/web002-os-vhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computediskswebserver001_osdisk_1_cc3d728148a748398ec77d8f345c7ac9:disks_diskPublicAccessDisabled	webserver001_OsDisk_1_cc3d728148a748398ec77d8f345c7ac9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/disks/webserver001_osdisk_1_cc3d728148a748398ec77d8f345c7ac9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computedisksdc001_osdisk_1_0d057172a5a2492e8cba1317c6a4aa5f:disks_diskPublicAccessDisabled	dc001_OsDisk_1_0d057172a5a2492e8cba1317c6a4aa5f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/disks/dc001_osdisk_1_0d057172a5a2492e8cba1317c6a4aa5f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is disabled for Azure managed disks disks_diskPublicAccessDisabled / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computediskssql002_osdisk_1_3c443928c7474625abe1abb06e256068:disks_diskPublicAccessDisabled	sql002_OsDisk_1_3c443928c7474625abe1abb06e256068 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/disks/sql002_osdisk_1_3c443928c7474625abe1abb06e256068	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure System Managed Identity is using limited permissions to other Azure resources. iam_overprivilegedSystemAssignedIdentity / bcab44f7-2dc0-486d-a224-54955648d810identity:iam_overprivilegedSystemAssignedIdentity	orderproducts1-identity bcab44f7-2dc0-486d-a224-54955648d810/identity	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure System Managed Identity is using limited permissions to other Azure resources. iam_overprivilegedSystemAssignedIdentity / 812fc112-7499-4a45-abd7-2b5a2782da4didentity:iam_overprivilegedSystemAssignedIdentity	web002-identity 812fc112-7499-4a45-abd7-2b5a2782da4d/identity	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure Role Based Access Control for Azure Key Vault is enabled keyVault_rbacEnabled / contosolocaldev:keyVault_rbacEnabled	contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-local-dev-support/providers/microsoft.keyvault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure public network access is restricted for Azure compute snapshots snapshots_snapshotPublicAccessRestricted / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computesnapshotssnapshot-public:snapshots_snapshotPublicAccessRestricted	snapshot-public /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/snapshots/snapshot-public	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosocontosodb00081013560:storageAccounts_containerSoftDeleteEnabled	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosocontosodb00081014340:storageAccounts_containerSoftDeleteEnabled	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosocontosodb00081015100:storageAccounts_containerSoftDeleteEnabled	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosocontosofile081015510:storageAccounts_containerSoftDeleteEnabled	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosocontosojump081015360:storageAccounts_containerSoftDeleteEnabled	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosocontosoweb0081015270:storageAccounts_containerSoftDeleteEnabled	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevbaddev0sa:storageAccounts_containerSoftDeleteEnabled	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevbaddev2sa:storageAccounts_containerSoftDeleteEnabled	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevbaddev3sa:storageAccounts_containerSoftDeleteEnabled	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevbaddev4sa:storageAccounts_containerSoftDeleteEnabled	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevinsecurergba9f:storageAccounts_containerSoftDeleteEnabled	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevrg8ae3:storageAccounts_containerSoftDeleteEnabled	contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevrgb910:storageAccounts_containerSoftDeleteEnabled	contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct001:storageAccounts_containerSoftDeleteEnabled	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct002:storageAccounts_containerSoftDeleteEnabled	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct003:storageAccounts_containerSoftDeleteEnabled	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct004:storageAccounts_containerSoftDeleteEnabled	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct005:storageAccounts_containerSoftDeleteEnabled	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct006:storageAccounts_containerSoftDeleteEnabled	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct007:storageAccounts_containerSoftDeleteEnabled	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct008:storageAccounts_containerSoftDeleteEnabled	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct196:storageAccounts_containerSoftDeleteEnabled	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct197:storageAccounts_containerSoftDeleteEnabled	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct198:storageAccounts_containerSoftDeleteEnabled	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct199:storageAccounts_containerSoftDeleteEnabled	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / argstacct200:storageAccounts_containerSoftDeleteEnabled	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / cs110032000f71044ed:storageAccounts_containerSoftDeleteEnabled	cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / cs1100320034a5146ba:storageAccounts_containerSoftDeleteEnabled	cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / dummysacontoso:storageAccounts_containerSoftDeleteEnabled	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / fhjfhdjfhadsjfhd:storageAccounts_containerSoftDeleteEnabled	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / functionsconsumptio9fc6:storageAccounts_containerSoftDeleteEnabled	functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / sflogscontosodevcluste2038:storageAccounts_containerSoftDeleteEnabled	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / storageaccountcontoso8298:storageAccounts_containerSoftDeleteEnabled	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / storageaccountcontosobfbe:storageAccounts_containerSoftDeleteEnabled	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / storageaccountfunct936f:storageAccounts_containerSoftDeleteEnabled	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / contosodevbaddev1sa:storageAccounts_crossTenantReplicationDisabled	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure cross-tenant replication is disabled on Azure Storage Accounts storageAccounts_crossTenantReplicationDisabled / auth0test:storageAccounts_crossTenantReplicationDisabled	auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosocontosodb00081013560:storageAccounts_defaultNetworkAccessDenied	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosocontosodb00081014340:storageAccounts_defaultNetworkAccessDenied	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosocontosodb00081015100:storageAccounts_defaultNetworkAccessDenied	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosocontosofile081015510:storageAccounts_defaultNetworkAccessDenied	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosocontosojump081015360:storageAccounts_defaultNetworkAccessDenied	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosocontosoweb0081015270:storageAccounts_defaultNetworkAccessDenied	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosodevbaddev0sa:storageAccounts_defaultNetworkAccessDenied	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosodevbaddev3sa:storageAccounts_defaultNetworkAccessDenied	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosodevbaddev4sa:storageAccounts_defaultNetworkAccessDenied	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosodevinsecurergba9f:storageAccounts_defaultNetworkAccessDenied	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosodevrg8ae3:storageAccounts_defaultNetworkAccessDenied	contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosodevrgb75f:storageAccounts_defaultNetworkAccessDenied	contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / contosodevrgb910:storageAccounts_defaultNetworkAccessDenied	contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct001:storageAccounts_defaultNetworkAccessDenied	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct002:storageAccounts_defaultNetworkAccessDenied	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct003:storageAccounts_defaultNetworkAccessDenied	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct004:storageAccounts_defaultNetworkAccessDenied	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct005:storageAccounts_defaultNetworkAccessDenied	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct006:storageAccounts_defaultNetworkAccessDenied	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct007:storageAccounts_defaultNetworkAccessDenied	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct008:storageAccounts_defaultNetworkAccessDenied	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct196:storageAccounts_defaultNetworkAccessDenied	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct197:storageAccounts_defaultNetworkAccessDenied	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct198:storageAccounts_defaultNetworkAccessDenied	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct199:storageAccounts_defaultNetworkAccessDenied	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / argstacct200:storageAccounts_defaultNetworkAccessDenied	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / azureiamparking:storageAccounts_defaultNetworkAccessDenied	azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / cs1100320034a5146ba:storageAccounts_defaultNetworkAccessDenied	cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / dummysacontoso:storageAccounts_defaultNetworkAccessDenied	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / fhjfhdjfhadsjfhd:storageAccounts_defaultNetworkAccessDenied	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / functionsconsumptio9fc6:storageAccounts_defaultNetworkAccessDenied	functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / newcontosobadsa:storageAccounts_defaultNetworkAccessDenied	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / rewrfaeraewrfaesrfasef:storageAccounts_defaultNetworkAccessDenied	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / sflogscontosodevcluste2038:storageAccounts_defaultNetworkAccessDenied	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / storageaccountcontoso8298:storageAccounts_defaultNetworkAccessDenied	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / storageaccountcontosobfbe:storageAccounts_defaultNetworkAccessDenied	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / storageaccountfunct936f:storageAccounts_defaultNetworkAccessDenied	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / vdxfvsdfsdfv:storageAccounts_defaultNetworkAccessDenied	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / yetanotherbad2:storageAccounts_defaultNetworkAccessDenied	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure default network access rule for Storage Accounts is set to deny storageAccounts_defaultNetworkAccessDenied / yetanotherbadstorage:storageAccounts_defaultNetworkAccessDenied	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosocontosodb00081013560:storageAccounts_diskSnapshotSettingsProtected	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosocontosodb00081014340:storageAccounts_diskSnapshotSettingsProtected	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosocontosodb00081015100:storageAccounts_diskSnapshotSettingsProtected	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosocontosofile081015510:storageAccounts_diskSnapshotSettingsProtected	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosocontosojump081015360:storageAccounts_diskSnapshotSettingsProtected	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosocontosoweb0081015270:storageAccounts_diskSnapshotSettingsProtected	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevbaddev0sa:storageAccounts_diskSnapshotSettingsProtected	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevbaddev2sa:storageAccounts_diskSnapshotSettingsProtected	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevbaddev3sa:storageAccounts_diskSnapshotSettingsProtected	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevbaddev4sa:storageAccounts_diskSnapshotSettingsProtected	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevinsecurergba9f:storageAccounts_diskSnapshotSettingsProtected	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevrg8ae3:storageAccounts_diskSnapshotSettingsProtected	contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevrgb75f:storageAccounts_diskSnapshotSettingsProtected	contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevrgb910:storageAccounts_diskSnapshotSettingsProtected	contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct001:storageAccounts_diskSnapshotSettingsProtected	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct002:storageAccounts_diskSnapshotSettingsProtected	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct003:storageAccounts_diskSnapshotSettingsProtected	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct004:storageAccounts_diskSnapshotSettingsProtected	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct005:storageAccounts_diskSnapshotSettingsProtected	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct006:storageAccounts_diskSnapshotSettingsProtected	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct007:storageAccounts_diskSnapshotSettingsProtected	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct008:storageAccounts_diskSnapshotSettingsProtected	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct196:storageAccounts_diskSnapshotSettingsProtected	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct197:storageAccounts_diskSnapshotSettingsProtected	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct198:storageAccounts_diskSnapshotSettingsProtected	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct199:storageAccounts_diskSnapshotSettingsProtected	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / argstacct200:storageAccounts_diskSnapshotSettingsProtected	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / azureiamparking:storageAccounts_diskSnapshotSettingsProtected	azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / cs110032000f71044ed:storageAccounts_diskSnapshotSettingsProtected	cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / cs1100320034a5146ba:storageAccounts_diskSnapshotSettingsProtected	cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / dsfsdfsdfgff:storageAccounts_diskSnapshotSettingsProtected	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / dummysacontoso:storageAccounts_diskSnapshotSettingsProtected	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / fhjfhdjfhadsjfhd:storageAccounts_diskSnapshotSettingsProtected	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / functionsconsumptio9fc6:storageAccounts_diskSnapshotSettingsProtected	functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / newcontosobadsa:storageAccounts_diskSnapshotSettingsProtected	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / rewrfaeraewrfaesrfasef:storageAccounts_diskSnapshotSettingsProtected	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / sflogscontosodevcluste2038:storageAccounts_diskSnapshotSettingsProtected	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / storageaccountcontoso8298:storageAccounts_diskSnapshotSettingsProtected	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / storageaccountcontosobfbe:storageAccounts_diskSnapshotSettingsProtected	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / storageaccountfunct936f:storageAccounts_diskSnapshotSettingsProtected	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / vdxfvsdfsdfv:storageAccounts_diskSnapshotSettingsProtected	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / yetanotherbad2:storageAccounts_diskSnapshotSettingsProtected	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / yetanotherbadstorage:storageAccounts_diskSnapshotSettingsProtected	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure soft delete for Azure File Shares is enabled storageAccounts_fileSoftDeleteEnabled / fhjfhdjfhadsjfhd:storageAccounts_fileSoftDeleteEnabled	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs restrict RDP access from the internet virtualMachines_rdpAccessRestrictedInternet / 442ad9303f49b2c04c98e9a48a7055bcdadc24345659a05cad208717b12e0cc7:virtualMachines_rdpAccessRestrictedInternet	domaincontroller01-RDP /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs restrict RDP access from the internet virtualMachines_rdpAccessRestrictedInternet / e3c6f51249584c499072585b5e7bd42309fffcda6a16b939203aee1524dfe2e1:virtualMachines_rdpAccessRestrictedInternet	domaincontroller01-Port_all /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs restrict SSH access from the internet virtualMachines_sshAccessRestrictedInternet / 73a8e4ed5405e2340c9fabc3242b14c75b5fc1a93b5672fe52874a647f59c463:virtualMachines_sshAccessRestrictedInternet	fileserver001-SSH /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/fileserver001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs restrict SSH access from the internet virtualMachines_sshAccessRestrictedInternet / 8b87a4fe2bb4dc71e6a12b70a3696af3904ed4f263c4874e8011c062a4c7df30:virtualMachines_sshAccessRestrictedInternet	webserver001-SSH /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/webserver001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs restrict SSH access from the internet virtualMachines_sshAccessRestrictedInternet / d9a6dcd6e48a43c53f20b1c905cf112d67360b175d5bbb14278b0bcedff8632f:virtualMachines_sshAccessRestrictedInternet	domaincontroller01-SSH /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs restrict SSH access from the internet virtualMachines_sshAccessRestrictedInternet / eff76aa6a16587d7894abc482d984d0d589bc5968b18ce0a5b9ad7fa15bff161:virtualMachines_sshAccessRestrictedInternet	jumpbox-SSH /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs do not have a public IP associated with them. virtualMachines_vmHasPublicIp / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesfileserver001:virtualMachines_vmHasPublicIp	fileserver001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/fileserver001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs do not have a public IP associated with them. virtualMachines_vmHasPublicIp / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesjumpbox:virtualMachines_vmHasPublicIp	jumpbox /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs do not have a public IP associated with them. virtualMachines_vmHasPublicIp / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb002:virtualMachines_vmHasPublicIp	web002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs do not have a public IP associated with them. virtualMachines_vmHasPublicIp / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachineswebserver001:virtualMachines_vmHasPublicIp	webserver001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/webserver001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (8)	Ensure that Azure VMs do not have a public IP associated with them. virtualMachines_vmHasPublicIp / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinesdc001:virtualMachines_vmHasPublicIp	dc001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/dc001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Enable diagnostic settings on Azure AI Services accounts aiFoundry_cognitiveServicesDiagnosticsDisabled / contoso-foundry-dev:aiFoundry_cognitiveServicesDiagnosticsDisabled	contoso-foundry-dev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/foundry/providers/Microsoft.CognitiveServices/accounts/contoso-foundry-dev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure AppServices Function App does not have secrets configured in its App Settings. appServices_appServicesFunctionsSecrets / gfgsrfdgdsfgfsdgdeployment_storage_connection_string:appServices_appServicesFunctionsSecrets	gfgsrfdgdsfgfsdg-DEPLOYMENT_STORAGE_CONNECTION_STRING /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot delete role assignments or role definitions outside of a controlled process attackPaths_azureIamRecordDestruction / providersmicrosoft.authorizationroleassignments18904bce-fe9c-49bf-ad19-08d411a454c6:attackPaths_azureIamRecordDestruction	Sam Taylor can delete Azure role assignments/definitions at subscription 'Dev' /providers/microsoft.authorization/roleassignments/18904bce-fe9c-49bf-ad19-08d411a454c6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot delete role assignments or role definitions outside of a controlled process attackPaths_azureIamRecordDestruction / providersmicrosoft.managementmanagementgroups97a795e8-b7fb-430c-af82-ecbc152813a6providersmicrosoft.authorizationroleassignments5c690fb6-febc-42e2-a799-11984ff9c7e0:attackPaths_azureIamRecordDestruction	Contoso Cloud - Projects Team can delete Azure role assignments/definitions at the management group/tenant root /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/5c690fb6-febc-42e2-a799-11984ff9c7e0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot delete role assignments or role definitions outside of a controlled process attackPaths_azureIamRecordDestruction / providersmicrosoft.managementmanagementgroupsdevprovidersmicrosoft.authorizationroleassignmentsf2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d:attackPaths_azureIamRecordDestruction	Sam Taylor can delete Azure role assignments/definitions at the management group/tenant root /providers/microsoft.management/managementgroups/dev/providers/microsoft.authorization/roleassignments/f2ffb1d5-50e7-403e-a1d7-46a0fbe94e5d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot delete role assignments or role definitions outside of a controlled process attackPaths_azureIamRecordDestruction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments61470f9d-5fab-47af-a96d-f828dd124966:attackPaths_azureIamRecordDestruction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can delete Azure role assignments/definitions at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/61470f9d-5fab-47af-a96d-f828dd124966	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot delete role assignments or role definitions outside of a controlled process attackPaths_azureIamRecordDestruction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments71fedb2c-68f7-447b-ace4-1fe0455939bc:attackPaths_azureIamRecordDestruction	Contoso Cloud - Projects Team can delete Azure role assignments/definitions at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/71fedb2c-68f7-447b-ace4-1fe0455939bc	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot delete role assignments or role definitions outside of a controlled process attackPaths_azureIamRecordDestruction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82providersmicrosoft.authorizationroleassignments65d59f2f-05f2-45ec-a89e-b47c683a897a:attackPaths_azureIamRecordDestruction	Sam Taylor can delete Azure role assignments/definitions at subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/providers/microsoft.authorization/roleassignments/65d59f2f-05f2-45ec-a89e-b47c683a897a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot delete role assignments or role definitions outside of a controlled process attackPaths_azureIamRecordDestruction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsfoundryprovidersmicrosoft.cognitiveservicesaccountscontoso-foundry-devprovidersmicrosoft.authorizationroleassignments65808402-f39f-45b1-a283-dfc78ab071b2:attackPaths_azureIamRecordDestruction	Sam Taylor can delete Azure role assignments/definitions at resource 'contoso-foundry-dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/providers/microsoft.authorization/roleassignments/65808402-f39f-45b1-a283-dfc78ab071b2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 1b3bba11029a6973734dddeae81f5a515eee6380adebf0c576a140b5ac9a3097:attackPaths_managedDiskSnapshotExport	7e310e21f217b02ca2bb0892 can export snapshot-public /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/snapshots/snapshot-public Scope: Resource Affected count: 1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 2b8b7fedac2729ba62b82d638256c2f869ef61b3fe6fe6b9a6714a9c37f4acf8:attackPaths_managedDiskSnapshotExport	Sam Taylor can export snapshot-public /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/snapshots/snapshot-public Scope: Resource Affected count: 1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 401b9109700e767ee44238a61c226d24a4e08860dd933e203b766e221f647e75:attackPaths_managedDiskSnapshotExport	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can export 16 managed disks in subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82 Scope: Population Affected count: 16	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 4addbb8244fc1194a7682e228767cdab905513a7d05aa5774db574911664a0b2:attackPaths_managedDiskSnapshotExport	Sam Taylor can export 16 managed disks in subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82 Scope: Population Affected count: 16	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 4b12f0e7a34a68a884d9ce651ee0b6608a8b69899ee95ea44ecfeed94735bf94:attackPaths_managedDiskSnapshotExport	contoso-github-actions can export snapshot-public /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/snapshots/snapshot-public Scope: Resource Affected count: 1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 53f9007b1cba7190a9277510e96fc157cc25cd92448b3710bfa167c046937b2e:attackPaths_managedDiskSnapshotExport	f39a965a9abe7ac328578764 can export snapshot-public /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/snapshots/snapshot-public Scope: Resource Affected count: 1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 56345c48bf01478cfb99873aeccbefae9463ac716404d48755f13e79bbd4ca11:attackPaths_managedDiskSnapshotExport	Contoso Cloud - Projects Team can export 16 managed disks in subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82 Scope: Population Affected count: 16	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 603e1942530a74e56be3a2b28207e5041cdd41e97506409693fd9646ccbf0e9c:attackPaths_managedDiskSnapshotExport	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can export snapshot-public /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/snapshots/snapshot-public Scope: Resource Affected count: 1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 8c066bf5431912223c7af7bf3f0c6dbfa713c3a496d5eb62ab56afa95fb3abe1:attackPaths_managedDiskSnapshotExport	f39a965a9abe7ac328578764 can export 16 managed disks in subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82 Scope: Population Affected count: 16	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 8f2788c63400a4ea0ac611b3919d24735d8d1dd6472d12b3567e4f89289da201:attackPaths_managedDiskSnapshotExport	contoso-github-actions can export 16 managed disks in subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82 Scope: Population Affected count: 16	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / 99f52958e835d13a0f8d8aad70193a3277dc3857cad2ee600b1aa7803378ed6b:attackPaths_managedDiskSnapshotExport	7e310e21f217b02ca2bb0892 can export 16 managed disks in subscription 'Dev' /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82 Scope: Population Affected count: 16	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process attackPaths_managedDiskSnapshotExport / a3cbe32ee1b8a09c59dbd8b3fc326fc04b6d7622cfcbbd9f7c5458b1b7104483:attackPaths_managedDiskSnapshotExport	Contoso Cloud - Projects Team can export snapshot-public /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/snapshots/snapshot-public Scope: Resource Affected count: 1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdb0026945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_networkExposureMutation	f39a965a9abe7ac328578764 can modify network exposure for db002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdb002801256c9-cc77-4531-af67-b477812e0b95:attackPaths_networkExposureMutation	7e310e21f217b02ca2bb0892 can modify network exposure for db002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdb00267d029fa-3f7d-454f-a851-932048b1b074:attackPaths_networkExposureMutation	contoso-github-actions can modify network exposure for db002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdb002c88d1633-95f9-49d0-a865-889361308164:attackPaths_networkExposureMutation	Sam Taylor can modify network exposure for db002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdb002235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_networkExposureMutation	Contoso Cloud - Projects Team can modify network exposure for db002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdb0022eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_networkExposureMutation	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can modify network exposure for db002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdomaincontroller016945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_networkExposureMutation	f39a965a9abe7ac328578764 can modify network exposure for domaincontroller01 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdomaincontroller01801256c9-cc77-4531-af67-b477812e0b95:attackPaths_networkExposureMutation	7e310e21f217b02ca2bb0892 can modify network exposure for domaincontroller01 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdomaincontroller0167d029fa-3f7d-454f-a851-932048b1b074:attackPaths_networkExposureMutation	contoso-github-actions can modify network exposure for domaincontroller01 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdomaincontroller01c88d1633-95f9-49d0-a865-889361308164:attackPaths_networkExposureMutation	Sam Taylor can modify network exposure for domaincontroller01 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdomaincontroller01235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_networkExposureMutation	Contoso Cloud - Projects Team can modify network exposure for domaincontroller01 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdomaincontroller012eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_networkExposureMutation	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can modify network exposure for domaincontroller01 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_44a61f7d6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_networkExposureMutation	f39a965a9abe7ac328578764 can modify network exposure for vmss-test_44a61f7d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_44a61f7d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_44a61f7d801256c9-cc77-4531-af67-b477812e0b95:attackPaths_networkExposureMutation	7e310e21f217b02ca2bb0892 can modify network exposure for vmss-test_44a61f7d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_44a61f7d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_44a61f7d67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_networkExposureMutation	contoso-github-actions can modify network exposure for vmss-test_44a61f7d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_44a61f7d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_44a61f7dc88d1633-95f9-49d0-a865-889361308164:attackPaths_networkExposureMutation	Sam Taylor can modify network exposure for vmss-test_44a61f7d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_44a61f7d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_44a61f7d235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_networkExposureMutation	Contoso Cloud - Projects Team can modify network exposure for vmss-test_44a61f7d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_44a61f7d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_44a61f7d2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_networkExposureMutation	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can modify network exposure for vmss-test_44a61f7d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_44a61f7d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_50ea3b8a6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_networkExposureMutation	f39a965a9abe7ac328578764 can modify network exposure for vmss-test_50ea3b8a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_50ea3b8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_50ea3b8a801256c9-cc77-4531-af67-b477812e0b95:attackPaths_networkExposureMutation	7e310e21f217b02ca2bb0892 can modify network exposure for vmss-test_50ea3b8a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_50ea3b8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_50ea3b8a67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_networkExposureMutation	contoso-github-actions can modify network exposure for vmss-test_50ea3b8a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_50ea3b8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_50ea3b8ac88d1633-95f9-49d0-a865-889361308164:attackPaths_networkExposureMutation	Sam Taylor can modify network exposure for vmss-test_50ea3b8a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_50ea3b8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_50ea3b8a235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_networkExposureMutation	Contoso Cloud - Projects Team can modify network exposure for vmss-test_50ea3b8a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_50ea3b8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesvmss-test_50ea3b8a2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_networkExposureMutation	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can modify network exposure for vmss-test_50ea3b8a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/vmss-test_50ea3b8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinessql0026945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_networkExposureMutation	f39a965a9abe7ac328578764 can modify network exposure for sql002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/sql002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinessql002801256c9-cc77-4531-af67-b477812e0b95:attackPaths_networkExposureMutation	7e310e21f217b02ca2bb0892 can modify network exposure for sql002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/sql002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinessql00267d029fa-3f7d-454f-a851-932048b1b074:attackPaths_networkExposureMutation	contoso-github-actions can modify network exposure for sql002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/sql002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinessql002c88d1633-95f9-49d0-a865-889361308164:attackPaths_networkExposureMutation	Sam Taylor can modify network exposure for sql002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/sql002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinessql002235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_networkExposureMutation	Contoso Cloud - Projects Team can modify network exposure for sql002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/sql002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure no principal holds every permission needed to make a private VM reachable from the internet attackPaths_networkExposureMutation / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.computevirtualmachinessql0022eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_networkExposureMutation	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can modify network exposure for sql002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.compute/virtualmachines/sql002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot extract standing Service Bus shared access keys outside of a controlled process attackPaths_serviceBusKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.servicebusnamespacesjdhalfkjadhflaskh6945d750-ef98-4624-aafe-fd9cd5e8ecf5:attackPaths_serviceBusKeyExtraction	f39a965a9abe7ac328578764 can extract credentials from jdhalfkjadhflaskh /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.servicebus/namespaces/jdhalfkjadhflaskh	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot extract standing Service Bus shared access keys outside of a controlled process attackPaths_serviceBusKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.servicebusnamespacesjdhalfkjadhflaskh801256c9-cc77-4531-af67-b477812e0b95:attackPaths_serviceBusKeyExtraction	7e310e21f217b02ca2bb0892 can extract credentials from jdhalfkjadhflaskh /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.servicebus/namespaces/jdhalfkjadhflaskh	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot extract standing Service Bus shared access keys outside of a controlled process attackPaths_serviceBusKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.servicebusnamespacesjdhalfkjadhflaskh67d029fa-3f7d-454f-a851-932048b1b074:attackPaths_serviceBusKeyExtraction	contoso-github-actions can extract credentials from jdhalfkjadhflaskh /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.servicebus/namespaces/jdhalfkjadhflaskh	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot extract standing Service Bus shared access keys outside of a controlled process attackPaths_serviceBusKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.servicebusnamespacesjdhalfkjadhflaskhc88d1633-95f9-49d0-a865-889361308164:attackPaths_serviceBusKeyExtraction	Sam Taylor can extract credentials from jdhalfkjadhflaskh /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.servicebus/namespaces/jdhalfkjadhflaskh	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot extract standing Service Bus shared access keys outside of a controlled process attackPaths_serviceBusKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.servicebusnamespacesjdhalfkjadhflaskh235b348b-db57-446c-ae5c-9e4b5d8053b3:attackPaths_serviceBusKeyExtraction	Contoso Cloud - Projects Team can extract credentials from jdhalfkjadhflaskh /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.servicebus/namespaces/jdhalfkjadhflaskh	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure principals cannot extract standing Service Bus shared access keys outside of a controlled process attackPaths_serviceBusKeyExtraction / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.servicebusnamespacesjdhalfkjadhflaskh2eb4f07f-c67d-441e-a51c-3014874798ac:attackPaths_serviceBusKeyExtraction	Unresolved foreign group (2eb4f07f-c67d-441e-a51c-3014874798ac) can extract credentials from jdhalfkjadhflaskh /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.servicebus/namespaces/jdhalfkjadhflaskh	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure Azure Automation Account is not publicly accessible automation_accountPubliclyAccessible / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.automationautomationaccountsinventory:automation_accountPubliclyAccessible	inventory /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Automation/automationAccounts/inventory	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	FTPS should be required in web apps dfc_ftpsshouldberequiredinwebapps / webappcontosotest:dfc_ftpsshouldberequiredinwebapps	webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsfdsfsadfdsf-nsgsecurityrulesrdp:networking_rdpAccessRestrictedInternet	fdsfsadfdsf-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/fdsfsadfdsf-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsfdsfsadfdsf-nsgsecurityrulesssh:networking_sshAccessRestrictedInternet	fdsfsadfdsf-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/fdsfsadfdsf-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupswebserver001-nsgsecurityrulesssh:networking_sshAccessRestrictedInternet	webserver001-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/webserver001-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure that only secure connections are accepted on Azure Cache for Redis. redis_redisOnlySecureConnections / contosobadredis:redis_redisOnlySecureConnections	contosobadredis /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Cache/Redis/contosobadredis	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosocontosodb00081013560:storageAccounts_blobVersioningEnabled	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosocontosodb00081014340:storageAccounts_blobVersioningEnabled	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosocontosodb00081015100:storageAccounts_blobVersioningEnabled	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosocontosofile081015510:storageAccounts_blobVersioningEnabled	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosocontosojump081015360:storageAccounts_blobVersioningEnabled	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosocontosoweb0081015270:storageAccounts_blobVersioningEnabled	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevbaddev0sa:storageAccounts_blobVersioningEnabled	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevbaddev2sa:storageAccounts_blobVersioningEnabled	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevbaddev3sa:storageAccounts_blobVersioningEnabled	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevbaddev4sa:storageAccounts_blobVersioningEnabled	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevinsecurergba9f:storageAccounts_blobVersioningEnabled	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevrg8ae3:storageAccounts_blobVersioningEnabled	contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevrgb75f:storageAccounts_blobVersioningEnabled	contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevrgb910:storageAccounts_blobVersioningEnabled	contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct001:storageAccounts_blobVersioningEnabled	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct002:storageAccounts_blobVersioningEnabled	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct003:storageAccounts_blobVersioningEnabled	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct004:storageAccounts_blobVersioningEnabled	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct005:storageAccounts_blobVersioningEnabled	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct006:storageAccounts_blobVersioningEnabled	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct007:storageAccounts_blobVersioningEnabled	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct008:storageAccounts_blobVersioningEnabled	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct196:storageAccounts_blobVersioningEnabled	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct197:storageAccounts_blobVersioningEnabled	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct198:storageAccounts_blobVersioningEnabled	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct199:storageAccounts_blobVersioningEnabled	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / argstacct200:storageAccounts_blobVersioningEnabled	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / azureiamparking:storageAccounts_blobVersioningEnabled	azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/azure-iam/providers/microsoft.storage/storageaccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / cs110032000f71044ed:storageAccounts_blobVersioningEnabled	cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / cs1100320034a5146ba:storageAccounts_blobVersioningEnabled	cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/cloud-shell-storage-southeastasia/providers/microsoft.storage/storageaccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / dsfsdfsdfgff:storageAccounts_blobVersioningEnabled	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / dummysacontoso:storageAccounts_blobVersioningEnabled	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / fhjfhdjfhadsjfhd:storageAccounts_blobVersioningEnabled	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / functionsconsumptio9fc6:storageAccounts_blobVersioningEnabled	functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-consumption-flex/providers/microsoft.storage/storageaccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / newcontosobadsa:storageAccounts_blobVersioningEnabled	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / rewrfaeraewrfaesrfasef:storageAccounts_blobVersioningEnabled	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / sflogscontosodevcluste2038:storageAccounts_blobVersioningEnabled	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / storageaccountcontoso8298:storageAccounts_blobVersioningEnabled	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / storageaccountcontosobfbe:storageAccounts_blobVersioningEnabled	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / storageaccountfunct936f:storageAccounts_blobVersioningEnabled	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/functions-vnet-test/providers/microsoft.storage/storageaccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / vdxfvsdfsdfv:storageAccounts_blobVersioningEnabled	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / yetanotherbad2:storageAccounts_blobVersioningEnabled	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / yetanotherbadstorage:storageAccounts_blobVersioningEnabled	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled storageAccounts_containerSoftDeleteEnabled / contosodevbaddev1sa:storageAccounts_containerSoftDeleteEnabled	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / contosodevbaddev1sa:storageAccounts_diskSnapshotSettingsProtected	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
High (7)	Ensure storage accounts have immutable storage configurations to protect against ransomware attacks storageAccounts_diskSnapshotSettingsProtected / auth0test:storageAccounts_diskSnapshotSettingsProtected	auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure AI Foundry projects have managed network isolation configured aiFoundry_agentWithoutNetworkIsolation / proj-default:aiFoundry_agentWithoutNetworkIsolation	proj-default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/foundry/providers/microsoft.cognitiveservices/accounts/contoso-foundry-dev/projects/proj-default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Review broad Microsoft.Authorization/roleDefinitions/write access even without a confirmed exploitation target attackPaths_azureRoleDefinitionGovernanceAccess / c88d1633-95f9-49d0-a865-889361308164governance:attackPaths_azureRoleDefinitionGovernanceAccess	Sam Taylor has broad ability to modify custom role definitions at subscription 'Dev' /providers/microsoft.authorization/roleassignments/18904bce-fe9c-49bf-ad19-08d411a454c6 Confidence: Indeterminate	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Review broad Microsoft.Authorization/roleDefinitions/write access even without a confirmed exploitation target attackPaths_azureRoleDefinitionGovernanceAccess / 235b348b-db57-446c-ae5c-9e4b5d8053b3governance:attackPaths_azureRoleDefinitionGovernanceAccess	Contoso Cloud - Projects Team has broad ability to modify custom role definitions at the management group/tenant root /providers/microsoft.management/managementgroups/97a795e8-b7fb-430c-af82-ecbc152813a6/providers/microsoft.authorization/roleassignments/5c690fb6-febc-42e2-a799-11984ff9c7e0 Confidence: Indeterminate	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure Azure Policy is configured to prevent public access to disks and snapshots azurePolicy_diskSnapshotPublicAccessPolicy / 56914835-2c07-4bdf-a088-72e94ee7eb82:azurePolicy_diskSnapshotPublicAccessPolicy	Missing Disk/Snapshot Public Access Policy /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure local authentication methods are disabled for Azure AI Services cognitiveServices_noLocalAuth / contoso-foundry-dev:cognitiveServices_noLocalAuth	contoso-foundry-dev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/foundry/providers/Microsoft.CognitiveServices/accounts/contoso-foundry-dev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure at least two distinct active Owners per Azure subscription iam_minimum1OwnerPerSubscription / 56914835-2c07-4bdf-a088-72e94ee7eb82:iam_minimum1OwnerPerSubscription	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev004e334aesecurityrulesrulerdpdemobdev0b8641e74:networking_rdpAccessRestrictedInternet	nsgbdev004e334ae /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev004e334ae	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev633503cacc6securityrulesrulerdpdemodev63364bd8071:networking_rdpAccessRestrictedInternet	nsgdev633503cacc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev633503cacc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev63438f6cca1securityrulesrulerdpdemodev63471eb9609:networking_rdpAccessRestrictedInternet	nsgdev63438f6cca1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev63438f6cca1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6354d5879asecurityrulesrulerdpdemodev631aafabe1:networking_rdpAccessRestrictedInternet	nsgdev6354d5879a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6354d5879a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev635f2208eeesecurityrulesrulerdpdemodev635dc2d8902:networking_rdpAccessRestrictedInternet	nsgdev635f2208eee /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev635f2208eee	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev636d1a60073securityrulesrulerdpdemodev6368a7ed05f:networking_rdpAccessRestrictedInternet	nsgdev636d1a60073 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev636d1a60073	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6375b749c05securityrulesrulerdpdemodev637cee74115:networking_rdpAccessRestrictedInternet	nsgdev6375b749c05 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6375b749c05	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6387a3d0688securityrulesrulerdpdemodev63838b6695a:networking_rdpAccessRestrictedInternet	nsgdev6387a3d0688 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6387a3d0688	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev639f3eacdffsecurityrulesrulerdpdemodev639bbbb70a7:networking_rdpAccessRestrictedInternet	nsgdev639f3eacdff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev639f3eacdff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev640d581f4c8securityrulesrulerdpdemodev6403d7b8f91:networking_rdpAccessRestrictedInternet	nsgdev640d581f4c8 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev640d581f4c8	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6413eb8cddbsecurityrulesrulerdpdemodev641001fb00b:networking_rdpAccessRestrictedInternet	nsgdev6413eb8cddb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6413eb8cddb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6421883b1b4securityrulesrulerdpdemodev6429d7e647b:networking_rdpAccessRestrictedInternet	nsgdev6421883b1b4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6421883b1b4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6438d7b8f3esecurityrulesrulerdpdemodev64332512915:networking_rdpAccessRestrictedInternet	nsgdev6438d7b8f3e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6438d7b8f3e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev644cd7f0461securityrulesrulerdpdemodev644f3c270f5:networking_rdpAccessRestrictedInternet	nsgdev644cd7f0461 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev644cd7f0461	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev64565849ff0securityrulesrulerdpdemodev6454617c9b1:networking_rdpAccessRestrictedInternet	nsgdev64565849ff0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev64565849ff0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6463a7eca72securityrulesrulerdpdemodev64672d3c2fe:networking_rdpAccessRestrictedInternet	nsgdev6463a7eca72 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6463a7eca72	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev647b32220cbsecurityrulesrulerdpdemodev64721e679f6:networking_rdpAccessRestrictedInternet	nsgdev647b32220cb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev647b32220cb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev648023bab7csecurityrulesrulerdpdemodev6489f8237ea:networking_rdpAccessRestrictedInternet	nsgdev648023bab7c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev648023bab7c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev649a695b111securityrulesrulerdpdemodev649e365c882:networking_rdpAccessRestrictedInternet	nsgdev649a695b111 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev649a695b111	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev64a808d12securityrulesrulerdpdemodev647b55b79:networking_rdpAccessRestrictedInternet	nsgdev64a808d12 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev64a808d12	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev64b4fb850bsecurityrulesrulerdpdemodev648daa9926:networking_rdpAccessRestrictedInternet	nsgdev64b4fb850b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev64b4fb850b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev65084e003cesecurityrulesrulerdpdemodev65083d981e8:networking_rdpAccessRestrictedInternet	nsgdev65084e003ce /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev65084e003ce	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6516f4fdb75securityrulesrulerdpdemodev651501fbb08:networking_rdpAccessRestrictedInternet	nsgdev6516f4fdb75 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6516f4fdb75	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6529bbf78f5securityrulesrulerdpdemodev652f5d10dbe:networking_rdpAccessRestrictedInternet	nsgdev6529bbf78f5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6529bbf78f5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev653df8a1813securityrulesrulerdpdemodev65304331de1:networking_rdpAccessRestrictedInternet	nsgdev653df8a1813 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev653df8a1813	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev654c8740debsecurityrulesrulerdpdemodev654084b787d:networking_rdpAccessRestrictedInternet	nsgdev654c8740deb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev654c8740deb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev655d43adf24securityrulesrulerdpdemodev65517fb2323:networking_rdpAccessRestrictedInternet	nsgdev655d43adf24 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev655d43adf24	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev65658980d60securityrulesrulerdpdemodev65620e50b33:networking_rdpAccessRestrictedInternet	nsgdev65658980d60 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev65658980d60	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6578a56f295securityrulesrulerdpdemodev657d512fd27:networking_rdpAccessRestrictedInternet	nsgdev6578a56f295 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6578a56f295	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev65830fb0c37securityrulesrulerdpdemodev658295b56e2:networking_rdpAccessRestrictedInternet	nsgdev65830fb0c37 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev65830fb0c37	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev65858528d5securityrulesrulerdpdemodev65b449aed8:networking_rdpAccessRestrictedInternet	nsgdev65858528d5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev65858528d5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6591f0a064bsecurityrulesrulerdpdemodev65958f53922:networking_rdpAccessRestrictedInternet	nsgdev6591f0a064b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6591f0a064b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev660f9861a96securityrulesrulerdpdemodev660fe850a1f:networking_rdpAccessRestrictedInternet	nsgdev660f9861a96 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev660f9861a96	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev661b0e80a2dsecurityrulesrulerdpdemodev661093dac63:networking_rdpAccessRestrictedInternet	nsgdev661b0e80a2d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev661b0e80a2d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev662c3792f52securityrulesrulerdpdemodev6628b533be9:networking_rdpAccessRestrictedInternet	nsgdev662c3792f52 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev662c3792f52	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev663e5f7fdf1securityrulesrulerdpdemodev66360d51b12:networking_rdpAccessRestrictedInternet	nsgdev663e5f7fdf1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev663e5f7fdf1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev664b4fb5816securityrulesrulerdpdemodev664e053f7cd:networking_rdpAccessRestrictedInternet	nsgdev664b4fb5816 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev664b4fb5816	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev66517fa2791securityrulesrulerdpdemodev66587d6b240:networking_rdpAccessRestrictedInternet	nsgdev66517fa2791 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev66517fa2791	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev666c7611100securityrulesrulerdpdemodev666bb3a0c2e:networking_rdpAccessRestrictedInternet	nsgdev666c7611100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev666c7611100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6673dcb8d00securityrulesrulerdpdemodev667f98a06bd:networking_rdpAccessRestrictedInternet	nsgdev6673dcb8d00 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6673dcb8d00	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev668cf294bc3securityrulesrulerdpdemodev6685269df3e:networking_rdpAccessRestrictedInternet	nsgdev668cf294bc3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev668cf294bc3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev66940373f7esecurityrulesrulerdpdemodev669b597bc49:networking_rdpAccessRestrictedInternet	nsgdev66940373f7e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev66940373f7e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev66fbac9d63securityrulesrulerdpdemodev667e8e9757:networking_rdpAccessRestrictedInternet	nsgdev66fbac9d63 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev66fbac9d63	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev670c2643caesecurityrulesrulerdpdemodev6702c411039:networking_rdpAccessRestrictedInternet	nsgdev670c2643cae /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev670c2643cae	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev671b1ad5c74securityrulesrulerdpdemodev67125cbeab4:networking_rdpAccessRestrictedInternet	nsgdev671b1ad5c74 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev671b1ad5c74	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6720665efe4securityrulesrulerdpdemodev67289c3760c:networking_rdpAccessRestrictedInternet	nsgdev6720665efe4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6720665efe4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev67383f4cc9fsecurityrulesrulerdpdemodev6736e4beac9:networking_rdpAccessRestrictedInternet	nsgdev67383f4cc9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev67383f4cc9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6749e9af5d1securityrulesrulerdpdemodev674575f6fed:networking_rdpAccessRestrictedInternet	nsgdev6749e9af5d1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6749e9af5d1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev674c960ea4securityrulesrulerdpdemodev67ac8c5475:networking_rdpAccessRestrictedInternet	nsgdev674c960ea4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev674c960ea4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev675287c6bdbsecurityrulesrulerdpdemodev6752a3a75f0:networking_rdpAccessRestrictedInternet	nsgdev675287c6bdb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev675287c6bdb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev676f61adf0asecurityrulesrulerdpdemodev6766e5477f6:networking_rdpAccessRestrictedInternet	nsgdev676f61adf0a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev676f61adf0a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev677f2521545securityrulesrulerdpdemodev677d7861137:networking_rdpAccessRestrictedInternet	nsgdev677f2521545 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev677f2521545	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev678d6e7ca7esecurityrulesrulerdpdemodev67876bc726c:networking_rdpAccessRestrictedInternet	nsgdev678d6e7ca7e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev678d6e7ca7e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev679a3e4cc44securityrulesrulerdpdemodev6797834f688:networking_rdpAccessRestrictedInternet	nsgdev679a3e4cc44 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev679a3e4cc44	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6807eceb623securityrulesrulerdpdemodev68046aa2e6c:networking_rdpAccessRestrictedInternet	nsgdev6807eceb623 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6807eceb623	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev681a02b42b1securityrulesrulerdpdemodev681e24a6815:networking_rdpAccessRestrictedInternet	nsgdev681a02b42b1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev681a02b42b1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev682d7622b40securityrulesrulerdpdemodev682cb47e859:networking_rdpAccessRestrictedInternet	nsgdev682d7622b40 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev682d7622b40	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6833ea2b429securityrulesrulerdpdemodev683c34e5122:networking_rdpAccessRestrictedInternet	nsgdev6833ea2b429 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6833ea2b429	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6845825da9esecurityrulesrulerdpdemodev68474a9c5ba:networking_rdpAccessRestrictedInternet	nsgdev6845825da9e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6845825da9e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6852db0d23asecurityrulesrulerdpdemodev68549b84fc4:networking_rdpAccessRestrictedInternet	nsgdev6852db0d23a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6852db0d23a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev686146346a0securityrulesrulerdpdemodev6869f864768:networking_rdpAccessRestrictedInternet	nsgdev686146346a0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev686146346a0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev687db27526dsecurityrulesrulerdpdemodev687003aa04a:networking_rdpAccessRestrictedInternet	nsgdev687db27526d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev687db27526d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev688f92ca19csecurityrulesrulerdpdemodev6883b907878:networking_rdpAccessRestrictedInternet	nsgdev688f92ca19c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev688f92ca19c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev689bce1f630securityrulesrulerdpdemodev6898272c62e:networking_rdpAccessRestrictedInternet	nsgdev689bce1f630 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev689bce1f630	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev68f72d7d11securityrulesrulerdpdemodev685a8d2824:networking_rdpAccessRestrictedInternet	nsgdev68f72d7d11 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev68f72d7d11	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6907b65cba2securityrulesrulerdpdemodev6908c88001d:networking_rdpAccessRestrictedInternet	nsgdev6907b65cba2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6907b65cba2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6917da54376securityrulesrulerdpdemodev69172e58320:networking_rdpAccessRestrictedInternet	nsgdev6917da54376 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6917da54376	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev692ff656c40securityrulesrulerdpdemodev6920d6bfa00:networking_rdpAccessRestrictedInternet	nsgdev692ff656c40 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev692ff656c40	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev693e7e866c4securityrulesrulerdpdemodev6934ff27dfc:networking_rdpAccessRestrictedInternet	nsgdev693e7e866c4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev693e7e866c4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev69450e29525securityrulesrulerdpdemodev694fad45ca1:networking_rdpAccessRestrictedInternet	nsgdev69450e29525 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev69450e29525	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev695e8bec75asecurityrulesrulerdpdemodev6954049b08c:networking_rdpAccessRestrictedInternet	nsgdev695e8bec75a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev695e8bec75a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev695f20bdcbsecurityrulesrulerdpdemodev691d793b0e:networking_rdpAccessRestrictedInternet	nsgdev695f20bdcb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev695f20bdcb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev696899fe111securityrulesrulerdpdemodev69649949061:networking_rdpAccessRestrictedInternet	nsgdev696899fe111 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev696899fe111	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6978da2c40asecurityrulesrulerdpdemodev697c6f2d2b4:networking_rdpAccessRestrictedInternet	nsgdev6978da2c40a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6978da2c40a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6984560275fsecurityrulesrulerdpdemodev698c6a998ac:networking_rdpAccessRestrictedInternet	nsgdev6984560275f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6984560275f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev6997fc74cabsecurityrulesrulerdpdemodev699b8938d8b:networking_rdpAccessRestrictedInternet	nsgdev6997fc74cab /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev6997fc74cab	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev70ecf99a44securityrulesrulerdpdemodev7076dfc2f3:networking_rdpAccessRestrictedInternet	nsgdev70ecf99a44 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev70ecf99a44	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev713785ae20securityrulesrulerdpdemodev7190a39fe2:networking_rdpAccessRestrictedInternet	nsgdev713785ae20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev713785ae20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev72bd7c2888securityrulesrulerdpdemodev72e85b8717:networking_rdpAccessRestrictedInternet	nsgdev72bd7c2888 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev72bd7c2888	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev73ddc86495securityrulesrulerdpdemodev73ce132bd3:networking_rdpAccessRestrictedInternet	nsgdev73ddc86495 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev73ddc86495	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev743f476fd3securityrulesrulerdpdemodev743140f132:networking_rdpAccessRestrictedInternet	nsgdev743f476fd3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev743f476fd3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev754e9b0b92securityrulesrulerdpdemodev75fe376edd:networking_rdpAccessRestrictedInternet	nsgdev754e9b0b92 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev754e9b0b92	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev764de1613securityrulesrulerdpdemodev7a0507107:networking_rdpAccessRestrictedInternet	nsgdev764de1613 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev764de1613	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev76ec15158bsecurityrulesrulerdpdemodev769db5f995:networking_rdpAccessRestrictedInternet	nsgdev76ec15158b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev76ec15158b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev77b8b94137securityrulesrulerdpdemodev77d616f43a:networking_rdpAccessRestrictedInternet	nsgdev77b8b94137 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev77b8b94137	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev785f9a21e7securityrulesrulerdpdemodev78fcb17ae0:networking_rdpAccessRestrictedInternet	nsgdev785f9a21e7 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev785f9a21e7	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev790afa0868securityrulesrulerdpdemodev793eb852c0:networking_rdpAccessRestrictedInternet	nsgdev790afa0868 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev790afa0868	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev803df0a1c4securityrulesrulerdpdemodev80c7e84e94:networking_rdpAccessRestrictedInternet	nsgdev803df0a1c4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev803df0a1c4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev812ab01d49securityrulesrulerdpdemodev81b3f62630:networking_rdpAccessRestrictedInternet	nsgdev812ab01d49 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev812ab01d49	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev8219a1a84bsecurityrulesrulerdpdemodev8283124919:networking_rdpAccessRestrictedInternet	nsgdev8219a1a84b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev8219a1a84b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev8392981a5dsecurityrulesrulerdpdemodev83bed1a454:networking_rdpAccessRestrictedInternet	nsgdev8392981a5d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev8392981a5d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev845ee93c22securityrulesrulerdpdemodev844c5c914a:networking_rdpAccessRestrictedInternet	nsgdev845ee93c22 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev845ee93c22	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev8502bb83dsecurityrulesrulerdpdemodev87748aa59:networking_rdpAccessRestrictedInternet	nsgdev8502bb83d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev8502bb83d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev855811805fsecurityrulesrulerdpdemodev85a597df0c:networking_rdpAccessRestrictedInternet	nsgdev855811805f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev855811805f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev86aa9fae04securityrulesrulerdpdemodev86c95824a6:networking_rdpAccessRestrictedInternet	nsgdev86aa9fae04 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev86aa9fae04	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev874162a99fsecurityrulesrulerdpdemodev8731c81451:networking_rdpAccessRestrictedInternet	nsgdev874162a99f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev874162a99f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev886e195fe0securityrulesrulerdpdemodev88ff6618ad:networking_rdpAccessRestrictedInternet	nsgdev886e195fe0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev886e195fe0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev89a5ef2555securityrulesrulerdpdemodev89ca58c99f:networking_rdpAccessRestrictedInternet	nsgdev89a5ef2555 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev89a5ef2555	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev9036d65fc2securityrulesrulerdpdemodev905a53215b:networking_rdpAccessRestrictedInternet	nsgdev9036d65fc2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev9036d65fc2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev91ea7b0f21securityrulesrulerdpdemodev91f7afbd1d:networking_rdpAccessRestrictedInternet	nsgdev91ea7b0f21 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev91ea7b0f21	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev9225756087securityrulesrulerdpdemodev92f9ef0469:networking_rdpAccessRestrictedInternet	nsgdev9225756087 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev9225756087	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev93d92af6ddsecurityrulesrulerdpdemodev933f0e71b7:networking_rdpAccessRestrictedInternet	nsgdev93d92af6dd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev93d92af6dd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev940c2f21dfsecurityrulesrulerdpdemodev94d11bccad:networking_rdpAccessRestrictedInternet	nsgdev940c2f21df /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev940c2f21df	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev95337d05c6securityrulesrulerdpdemodev95ed44ddae:networking_rdpAccessRestrictedInternet	nsgdev95337d05c6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev95337d05c6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev96480a4188securityrulesrulerdpdemodev96144bcdc3:networking_rdpAccessRestrictedInternet	nsgdev96480a4188 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev96480a4188	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev9753a7e45bsecurityrulesrulerdpdemodev971dbb10a3:networking_rdpAccessRestrictedInternet	nsgdev9753a7e45b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev9753a7e45b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev98fda9e440securityrulesrulerdpdemodev9848600951:networking_rdpAccessRestrictedInternet	nsgdev98fda9e440 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev98fda9e440	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev9985465579securityrulesrulerdpdemodev9906dbd875:networking_rdpAccessRestrictedInternet	nsgdev9985465579 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev9985465579	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdev9d64da6f6securityrulesrulerdpdemodev99da8414b:networking_rdpAccessRestrictedInternet	nsgdev9d64da6f6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdev9d64da6f6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulerdpdev0a7773d31:networking_rdpAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulerdpdev1e8cf845e:networking_rdpAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulerdpdev2b3347ae7:networking_rdpAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulerdpdev36dd5f495:networking_rdpAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulerdpdev4c29fa577:networking_rdpAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsavailabilityset-vm-nsgsecurityrulesrdp:networking_rdpAccessRestrictedInternet	availabilityset-vm-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/availabilityset-vm-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsbasicnsgomigodahhhhnic2securityrulesrdp:networking_rdpAccessRestrictedInternet	basicNsgomigodahhhhnic2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/basicnsgomigodahhhhnic2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsdemovm1-nsgsecurityrulesrdp:networking_rdpAccessRestrictedInternet	demovm1-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/demovm1-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsdomaincontroller01-nsgsecurityrulesport_all:networking_rdpAccessRestrictedInternet	domaincontroller01-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/domaincontroller01-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsdomaincontroller01-nsgsecurityrulesrdp:networking_rdpAccessRestrictedInternet	domaincontroller01-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/domaincontroller01-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsfridaynsgsecurityrulesport_3389:networking_rdpAccessRestrictedInternet	fridaynsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/fridaynsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsnetworktest-nsgsecurityrulesrdp:networking_rdpAccessRestrictedInternet	networktest-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/networktest-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupstestinventorynsgsecurityrulesrdpallowed:networking_rdpAccessRestrictedInternet	testinventorynsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/testinventorynsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsustest-nsgsecurityrulesrdp:networking_rdpAccessRestrictedInternet	ustest-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/ustest-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev10075cb8d26securityrulesrulerdpdemobdev1003212c998:networking_rdpAccessRestrictedInternet	nsgbdev10075cb8d26 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev10075cb8d26	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev101b99c3b8bsecurityrulesrulerdpdemobdev1010b0bfa80:networking_rdpAccessRestrictedInternet	nsgbdev101b99c3b8b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev101b99c3b8b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1028c786157securityrulesrulerdpdemobdev1028fb53691:networking_rdpAccessRestrictedInternet	nsgbdev1028c786157 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1028c786157	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev10352c66061securityrulesrulerdpdemobdev103f0514b93:networking_rdpAccessRestrictedInternet	nsgbdev10352c66061 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev10352c66061	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev10400e6444fsecurityrulesrulerdpdemobdev1049c5c748f:networking_rdpAccessRestrictedInternet	nsgbdev10400e6444f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev10400e6444f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev10593172d5dsecurityrulesrulerdpdemobdev1053e81e020:networking_rdpAccessRestrictedInternet	nsgbdev10593172d5d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev10593172d5d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev106e517a805securityrulesrulerdpdemobdev1067ffa513a:networking_rdpAccessRestrictedInternet	nsgbdev106e517a805 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev106e517a805	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev10772a5bc18securityrulesrulerdpdemobdev107a15cae1e:networking_rdpAccessRestrictedInternet	nsgbdev10772a5bc18 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev10772a5bc18	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1089d0c3b98securityrulesrulerdpdemobdev108bdb8e350:networking_rdpAccessRestrictedInternet	nsgbdev1089d0c3b98 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1089d0c3b98	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1092137dbb8securityrulesrulerdpdemobdev1090189c197:networking_rdpAccessRestrictedInternet	nsgbdev1092137dbb8 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1092137dbb8	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev10b27e5dbesecurityrulesrulerdpdemobdev10a11550be:networking_rdpAccessRestrictedInternet	nsgbdev10b27e5dbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev10b27e5dbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev110e8cec599securityrulesrulerdpdemobdev110f453a308:networking_rdpAccessRestrictedInternet	nsgbdev110e8cec599 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev110e8cec599	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev111b671dc22securityrulesrulerdpdemobdev111ae381a11:networking_rdpAccessRestrictedInternet	nsgbdev111b671dc22 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev111b671dc22	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev112d561c8f9securityrulesrulerdpdemobdev112dd2072a7:networking_rdpAccessRestrictedInternet	nsgbdev112d561c8f9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev112d561c8f9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev113f9f2022csecurityrulesrulerdpdemobdev1134fb59d5f:networking_rdpAccessRestrictedInternet	nsgbdev113f9f2022c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev113f9f2022c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1143e81c45asecurityrulesrulerdpdemobdev1146832a80f:networking_rdpAccessRestrictedInternet	nsgbdev1143e81c45a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1143e81c45a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev115cdbedd67securityrulesrulerdpdemobdev115768cfaa0:networking_rdpAccessRestrictedInternet	nsgbdev115cdbedd67 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev115cdbedd67	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev11649891f41securityrulesrulerdpdemobdev116fc028428:networking_rdpAccessRestrictedInternet	nsgbdev11649891f41 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev11649891f41	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev11654ec818securityrulesrulerdpdemobdev1154405ced:networking_rdpAccessRestrictedInternet	nsgbdev11654ec818 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev11654ec818	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev117675648edsecurityrulesrulerdpdemobdev11732dc5b44:networking_rdpAccessRestrictedInternet	nsgbdev117675648ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev117675648ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev118efaaf4easecurityrulesrulerdpdemobdev118a235ee3d:networking_rdpAccessRestrictedInternet	nsgbdev118efaaf4ea /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev118efaaf4ea	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1196f990c64securityrulesrulerdpdemobdev11966070631:networking_rdpAccessRestrictedInternet	nsgbdev1196f990c64 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1196f990c64	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev12081572253securityrulesrulerdpdemobdev120261d1257:networking_rdpAccessRestrictedInternet	nsgbdev12081572253 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev12081572253	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev121b0e90d1esecurityrulesrulerdpdemobdev121c2872a48:networking_rdpAccessRestrictedInternet	nsgbdev121b0e90d1e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev121b0e90d1e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1223de263casecurityrulesrulerdpdemobdev1225d28a979:networking_rdpAccessRestrictedInternet	nsgbdev1223de263ca /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1223de263ca	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev123d6c27b2fsecurityrulesrulerdpdemobdev123670c21a3:networking_rdpAccessRestrictedInternet	nsgbdev123d6c27b2f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev123d6c27b2f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev124bdbaf9ebsecurityrulesrulerdpdemobdev1240b6c6b0b:networking_rdpAccessRestrictedInternet	nsgbdev124bdbaf9eb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev124bdbaf9eb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev125583ea943securityrulesrulerdpdemobdev125f58d9e8c:networking_rdpAccessRestrictedInternet	nsgbdev125583ea943 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev125583ea943	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev126dc12b7b4securityrulesrulerdpdemobdev126b765fed9:networking_rdpAccessRestrictedInternet	nsgbdev126dc12b7b4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev126dc12b7b4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev12797c1125esecurityrulesrulerdpdemobdev127a0c04b9a:networking_rdpAccessRestrictedInternet	nsgbdev12797c1125e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev12797c1125e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev12892e64bf1securityrulesrulerdpdemobdev128e401823e:networking_rdpAccessRestrictedInternet	nsgbdev12892e64bf1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev12892e64bf1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev128c76c16bsecurityrulesrulerdpdemobdev12a8ee0d81:networking_rdpAccessRestrictedInternet	nsgbdev128c76c16b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev128c76c16b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev129e64a9856securityrulesrulerdpdemobdev12941bca8a5:networking_rdpAccessRestrictedInternet	nsgbdev129e64a9856 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev129e64a9856	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1308bd4126fsecurityrulesrulerdpdemobdev13030f6f257:networking_rdpAccessRestrictedInternet	nsgbdev1308bd4126f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1308bd4126f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev131f261de2esecurityrulesrulerdpdemobdev131392dca6b:networking_rdpAccessRestrictedInternet	nsgbdev131f261de2e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev131f261de2e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev132b2fa6973securityrulesrulerdpdemobdev1326a0afd13:networking_rdpAccessRestrictedInternet	nsgbdev132b2fa6973 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev132b2fa6973	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev13383560de2securityrulesrulerdpdemobdev13317ed368b:networking_rdpAccessRestrictedInternet	nsgbdev13383560de2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev13383560de2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev134a98d6d37securityrulesrulerdpdemobdev13407897783:networking_rdpAccessRestrictedInternet	nsgbdev134a98d6d37 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev134a98d6d37	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev13560317a93securityrulesrulerdpdemobdev13530a47a9f:networking_rdpAccessRestrictedInternet	nsgbdev13560317a93 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev13560317a93	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1369a8f3ac4securityrulesrulerdpdemobdev136062f2e5c:networking_rdpAccessRestrictedInternet	nsgbdev1369a8f3ac4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1369a8f3ac4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1376d69918dsecurityrulesrulerdpdemobdev137a72ac9d3:networking_rdpAccessRestrictedInternet	nsgbdev1376d69918d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1376d69918d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev13849b853bbsecurityrulesrulerdpdemobdev138c6d2cfe1:networking_rdpAccessRestrictedInternet	nsgbdev13849b853bb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev13849b853bb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev139b65c8758securityrulesrulerdpdemobdev139c877f3dc:networking_rdpAccessRestrictedInternet	nsgbdev139b65c8758 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev139b65c8758	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev13c11ca978securityrulesrulerdpdemobdev13539ce292:networking_rdpAccessRestrictedInternet	nsgbdev13c11ca978 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev13c11ca978	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev140f40b641esecurityrulesrulerdpdemobdev14079163729:networking_rdpAccessRestrictedInternet	nsgbdev140f40b641e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev140f40b641e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev141c9f2d3b2securityrulesrulerdpdemobdev141ce4394ba:networking_rdpAccessRestrictedInternet	nsgbdev141c9f2d3b2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev141c9f2d3b2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev14242a0a55esecurityrulesrulerdpdemobdev142141af2da:networking_rdpAccessRestrictedInternet	nsgbdev14242a0a55e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev14242a0a55e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1437cb69592securityrulesrulerdpdemobdev14360690751:networking_rdpAccessRestrictedInternet	nsgbdev1437cb69592 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1437cb69592	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev14414230e79securityrulesrulerdpdemobdev144d07742b7:networking_rdpAccessRestrictedInternet	nsgbdev14414230e79 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev14414230e79	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev14524176c2securityrulesrulerdpdemobdev14747d08e8:networking_rdpAccessRestrictedInternet	nsgbdev14524176c2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev14524176c2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev145879d4c21securityrulesrulerdpdemobdev145d7967339:networking_rdpAccessRestrictedInternet	nsgbdev145879d4c21 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev145879d4c21	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1462571fae0securityrulesrulerdpdemobdev146b58c7a99:networking_rdpAccessRestrictedInternet	nsgbdev1462571fae0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1462571fae0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1471ceef5bbsecurityrulesrulerdpdemobdev14780265b43:networking_rdpAccessRestrictedInternet	nsgbdev1471ceef5bb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1471ceef5bb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev148aa554a60securityrulesrulerdpdemobdev148e55d7828:networking_rdpAccessRestrictedInternet	nsgbdev148aa554a60 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev148aa554a60	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev14980543f8asecurityrulesrulerdpdemobdev149509ff4a0:networking_rdpAccessRestrictedInternet	nsgbdev14980543f8a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev14980543f8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev14f618681securityrulesrulerdpdemobdev1ea308c6a:networking_rdpAccessRestrictedInternet	nsgbdev14f618681 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev14f618681	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1507edbd8d5securityrulesrulerdpdemobdev150b7940445:networking_rdpAccessRestrictedInternet	nsgbdev1507edbd8d5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1507edbd8d5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev15154280305securityrulesrulerdpdemobdev1512626b779:networking_rdpAccessRestrictedInternet	nsgbdev15154280305 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev15154280305	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev15259c0c776securityrulesrulerdpdemobdev15210824e17:networking_rdpAccessRestrictedInternet	nsgbdev15259c0c776 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev15259c0c776	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1537ce48ae9securityrulesrulerdpdemobdev1538f0c1306:networking_rdpAccessRestrictedInternet	nsgbdev1537ce48ae9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1537ce48ae9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev154a689ace7securityrulesrulerdpdemobdev1541c52253c:networking_rdpAccessRestrictedInternet	nsgbdev154a689ace7 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev154a689ace7	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1557f04f4c5securityrulesrulerdpdemobdev155f63b3b8d:networking_rdpAccessRestrictedInternet	nsgbdev1557f04f4c5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1557f04f4c5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev156b33ee254securityrulesrulerdpdemobdev15633e88274:networking_rdpAccessRestrictedInternet	nsgbdev156b33ee254 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev156b33ee254	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev15714887ab7securityrulesrulerdpdemobdev157892f2020:networking_rdpAccessRestrictedInternet	nsgbdev15714887ab7 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev15714887ab7	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1588a4b7844securityrulesrulerdpdemobdev15816c33c24:networking_rdpAccessRestrictedInternet	nsgbdev1588a4b7844 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1588a4b7844	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev159340dd41bsecurityrulesrulerdpdemobdev15931663884:networking_rdpAccessRestrictedInternet	nsgbdev159340dd41b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev159340dd41b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev15b6d41927securityrulesrulerdpdemobdev154e217424:networking_rdpAccessRestrictedInternet	nsgbdev15b6d41927 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev15b6d41927	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev160df62451securityrulesrulerdpdemobdev1617cb36c9:networking_rdpAccessRestrictedInternet	nsgbdev160df62451 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev160df62451	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev160f8fb3a75securityrulesrulerdpdemobdev160473fdf1f:networking_rdpAccessRestrictedInternet	nsgbdev160f8fb3a75 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev160f8fb3a75	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev161e91b422bsecurityrulesrulerdpdemobdev161d6eb51a3:networking_rdpAccessRestrictedInternet	nsgbdev161e91b422b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev161e91b422b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev162e3632709securityrulesrulerdpdemobdev16294c86a98:networking_rdpAccessRestrictedInternet	nsgbdev162e3632709 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev162e3632709	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev163eb418cb1securityrulesrulerdpdemobdev163ebac8854:networking_rdpAccessRestrictedInternet	nsgbdev163eb418cb1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev163eb418cb1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev16419351351securityrulesrulerdpdemobdev164db902206:networking_rdpAccessRestrictedInternet	nsgbdev16419351351 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev16419351351	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev16542d13e2bsecurityrulesrulerdpdemobdev1658124accf:networking_rdpAccessRestrictedInternet	nsgbdev16542d13e2b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev16542d13e2b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev166256bcdecsecurityrulesrulerdpdemobdev166e9874424:networking_rdpAccessRestrictedInternet	nsgbdev166256bcdec /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev166256bcdec	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev167793120f3securityrulesrulerdpdemobdev1679b72dcf0:networking_rdpAccessRestrictedInternet	nsgbdev167793120f3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev167793120f3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1686fa7baafsecurityrulesrulerdpdemobdev168f7fdfc5d:networking_rdpAccessRestrictedInternet	nsgbdev1686fa7baaf /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1686fa7baaf	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev169fe82af57securityrulesrulerdpdemobdev1692abb83cf:networking_rdpAccessRestrictedInternet	nsgbdev169fe82af57 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev169fe82af57	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev170e9a121fasecurityrulesrulerdpdemobdev170ee814339:networking_rdpAccessRestrictedInternet	nsgbdev170e9a121fa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev170e9a121fa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev17120383179securityrulesrulerdpdemobdev17115ab9656:networking_rdpAccessRestrictedInternet	nsgbdev17120383179 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev17120383179	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev17189bdcddsecurityrulesrulerdpdemobdev17438a3e1f:networking_rdpAccessRestrictedInternet	nsgbdev17189bdcdd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev17189bdcdd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev172b31f2b05securityrulesrulerdpdemobdev172fdfee5d9:networking_rdpAccessRestrictedInternet	nsgbdev172b31f2b05 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev172b31f2b05	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev173247d76b0securityrulesrulerdpdemobdev1734648ca56:networking_rdpAccessRestrictedInternet	nsgbdev173247d76b0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev173247d76b0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev174cfcdd8b9securityrulesrulerdpdemobdev17432ae0b82:networking_rdpAccessRestrictedInternet	nsgbdev174cfcdd8b9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev174cfcdd8b9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev175e2d7c0d3securityrulesrulerdpdemobdev1756efa0a5a:networking_rdpAccessRestrictedInternet	nsgbdev175e2d7c0d3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev175e2d7c0d3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1764d8b9e2asecurityrulesrulerdpdemobdev1769650345a:networking_rdpAccessRestrictedInternet	nsgbdev1764d8b9e2a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1764d8b9e2a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev17770cd184csecurityrulesrulerdpdemobdev177252b27a1:networking_rdpAccessRestrictedInternet	nsgbdev17770cd184c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev17770cd184c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev178bf3b753csecurityrulesrulerdpdemobdev1781be91130:networking_rdpAccessRestrictedInternet	nsgbdev178bf3b753c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev178bf3b753c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1791e76a50asecurityrulesrulerdpdemobdev179354fccab:networking_rdpAccessRestrictedInternet	nsgbdev1791e76a50a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1791e76a50a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev180203789fdsecurityrulesrulerdpdemobdev18034871ab7:networking_rdpAccessRestrictedInternet	nsgbdev180203789fd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev180203789fd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev18132f11b9csecurityrulesrulerdpdemobdev18125439cac:networking_rdpAccessRestrictedInternet	nsgbdev18132f11b9c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev18132f11b9c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1821d3734c5securityrulesrulerdpdemobdev182d27ec8b2:networking_rdpAccessRestrictedInternet	nsgbdev1821d3734c5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1821d3734c5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1838095970csecurityrulesrulerdpdemobdev1831970f901:networking_rdpAccessRestrictedInternet	nsgbdev1838095970c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1838095970c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev184615b3107securityrulesrulerdpdemobdev184c8cacb98:networking_rdpAccessRestrictedInternet	nsgbdev184615b3107 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev184615b3107	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev184eae0a0bsecurityrulesrulerdpdemobdev18f00e1893:networking_rdpAccessRestrictedInternet	nsgbdev184eae0a0b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev184eae0a0b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev185cbbda5b6securityrulesrulerdpdemobdev18558245af7:networking_rdpAccessRestrictedInternet	nsgbdev185cbbda5b6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev185cbbda5b6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev186d540a46csecurityrulesrulerdpdemobdev18623068e2b:networking_rdpAccessRestrictedInternet	nsgbdev186d540a46c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev186d540a46c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev187b22d6f05securityrulesrulerdpdemobdev1875fd27b07:networking_rdpAccessRestrictedInternet	nsgbdev187b22d6f05 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev187b22d6f05	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev188747d954csecurityrulesrulerdpdemobdev1881c9daca8:networking_rdpAccessRestrictedInternet	nsgbdev188747d954c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev188747d954c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1899c13d062securityrulesrulerdpdemobdev189aa66c41b:networking_rdpAccessRestrictedInternet	nsgbdev1899c13d062 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1899c13d062	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev190ba75f46asecurityrulesrulerdpdemobdev190f67a29ef:networking_rdpAccessRestrictedInternet	nsgbdev190ba75f46a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev190ba75f46a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1915e7ac5c4securityrulesrulerdpdemobdev191d462caca:networking_rdpAccessRestrictedInternet	nsgbdev1915e7ac5c4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1915e7ac5c4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev19262edc978securityrulesrulerdpdemobdev1927a6a248d:networking_rdpAccessRestrictedInternet	nsgbdev19262edc978 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev19262edc978	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1937499221securityrulesrulerdpdemobdev19c10b8a3d:networking_rdpAccessRestrictedInternet	nsgbdev1937499221 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1937499221	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1937a0fbd94securityrulesrulerdpdemobdev193cabbae40:networking_rdpAccessRestrictedInternet	nsgbdev1937a0fbd94 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1937a0fbd94	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1948626d2e1securityrulesrulerdpdemobdev194cc793fac:networking_rdpAccessRestrictedInternet	nsgbdev1948626d2e1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1948626d2e1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev195262ce36fsecurityrulesrulerdpdemobdev195b74412c9:networking_rdpAccessRestrictedInternet	nsgbdev195262ce36f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev195262ce36f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1961a900512securityrulesrulerdpdemobdev19615615dc6:networking_rdpAccessRestrictedInternet	nsgbdev1961a900512 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1961a900512	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1973c84c640securityrulesrulerdpdemobdev197d75a5c5d:networking_rdpAccessRestrictedInternet	nsgbdev1973c84c640 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1973c84c640	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev1983f1654desecurityrulesrulerdpdemobdev198a5ac1ef0:networking_rdpAccessRestrictedInternet	nsgbdev1983f1654de /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev1983f1654de	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev199c036499fsecurityrulesrulerdpdemobdev19983f0ae7b:networking_rdpAccessRestrictedInternet	nsgbdev199c036499f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev199c036499f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev200b781eda9securityrulesrulerdpdemobdev200fada3028:networking_rdpAccessRestrictedInternet	nsgbdev200b781eda9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev200b781eda9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev201bf386a62securityrulesrulerdpdemobdev201ff8ce101:networking_rdpAccessRestrictedInternet	nsgbdev201bf386a62 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev201bf386a62	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev20209a6bee4securityrulesrulerdpdemobdev20210898c01:networking_rdpAccessRestrictedInternet	nsgbdev20209a6bee4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev20209a6bee4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev20343c02753securityrulesrulerdpdemobdev2033f94a9ae:networking_rdpAccessRestrictedInternet	nsgbdev20343c02753 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev20343c02753	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev204e72d18aesecurityrulesrulerdpdemobdev2044fff7d88:networking_rdpAccessRestrictedInternet	nsgbdev204e72d18ae /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev204e72d18ae	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev20500691652securityrulesrulerdpdemobdev20594105485:networking_rdpAccessRestrictedInternet	nsgbdev20500691652 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev20500691652	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2069a393da5securityrulesrulerdpdemobdev2069e6545a0:networking_rdpAccessRestrictedInternet	nsgbdev2069a393da5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2069a393da5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev207603e92bsecurityrulesrulerdpdemobdev208a35ab1a:networking_rdpAccessRestrictedInternet	nsgbdev207603e92b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev207603e92b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2079d2e2193securityrulesrulerdpdemobdev207b6682fd4:networking_rdpAccessRestrictedInternet	nsgbdev2079d2e2193 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2079d2e2193	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev208d7d2148bsecurityrulesrulerdpdemobdev20862ba07e2:networking_rdpAccessRestrictedInternet	nsgbdev208d7d2148b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev208d7d2148b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev209f3ac2523securityrulesrulerdpdemobdev209c816d350:networking_rdpAccessRestrictedInternet	nsgbdev209f3ac2523 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev209f3ac2523	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev210e8dbd4absecurityrulesrulerdpdemobdev210096e2aa4:networking_rdpAccessRestrictedInternet	nsgbdev210e8dbd4ab /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev210e8dbd4ab	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev211e2bce950securityrulesrulerdpdemobdev211c96ff48f:networking_rdpAccessRestrictedInternet	nsgbdev211e2bce950 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev211e2bce950	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev212fcb37571securityrulesrulerdpdemobdev212d7589527:networking_rdpAccessRestrictedInternet	nsgbdev212fcb37571 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev212fcb37571	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev213231a8540securityrulesrulerdpdemobdev213157744cd:networking_rdpAccessRestrictedInternet	nsgbdev213231a8540 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev213231a8540	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev214a92b3e23securityrulesrulerdpdemobdev214808bad73:networking_rdpAccessRestrictedInternet	nsgbdev214a92b3e23 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev214a92b3e23	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev215d2b5e2b1securityrulesrulerdpdemobdev215186810dd:networking_rdpAccessRestrictedInternet	nsgbdev215d2b5e2b1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev215d2b5e2b1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev21680dca6d0securityrulesrulerdpdemobdev2169a6d76c5:networking_rdpAccessRestrictedInternet	nsgbdev21680dca6d0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev21680dca6d0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2173b4dfef8securityrulesrulerdpdemobdev2177eb369c5:networking_rdpAccessRestrictedInternet	nsgbdev2173b4dfef8 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2173b4dfef8	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev218474ce515securityrulesrulerdpdemobdev21876ba1f73:networking_rdpAccessRestrictedInternet	nsgbdev218474ce515 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev218474ce515	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev219d074da50securityrulesrulerdpdemobdev2191bb90afb:networking_rdpAccessRestrictedInternet	nsgbdev219d074da50 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev219d074da50	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev219ea5e694securityrulesrulerdpdemobdev218ad55bb6:networking_rdpAccessRestrictedInternet	nsgbdev219ea5e694 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev219ea5e694	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev22004f1afbsecurityrulesrulerdpdemobdev2286e60c78:networking_rdpAccessRestrictedInternet	nsgbdev22004f1afb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev22004f1afb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2201ff3fe27securityrulesrulerdpdemobdev220acfb084c:networking_rdpAccessRestrictedInternet	nsgbdev2201ff3fe27 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2201ff3fe27	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev221fd52bcd3securityrulesrulerdpdemobdev2218d680aba:networking_rdpAccessRestrictedInternet	nsgbdev221fd52bcd3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev221fd52bcd3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev22215a9336bsecurityrulesrulerdpdemobdev22270f29f75:networking_rdpAccessRestrictedInternet	nsgbdev22215a9336b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev22215a9336b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2232699a814securityrulesrulerdpdemobdev223f10107c3:networking_rdpAccessRestrictedInternet	nsgbdev2232699a814 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2232699a814	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2242025da93securityrulesrulerdpdemobdev2248c56c89a:networking_rdpAccessRestrictedInternet	nsgbdev2242025da93 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2242025da93	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev22545dfa0d6securityrulesrulerdpdemobdev2255efce860:networking_rdpAccessRestrictedInternet	nsgbdev22545dfa0d6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev22545dfa0d6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev226247b666dsecurityrulesrulerdpdemobdev2262e39be0e:networking_rdpAccessRestrictedInternet	nsgbdev226247b666d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev226247b666d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev22796264685securityrulesrulerdpdemobdev227b2374196:networking_rdpAccessRestrictedInternet	nsgbdev22796264685 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev22796264685	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev22896354010securityrulesrulerdpdemobdev228c898f872:networking_rdpAccessRestrictedInternet	nsgbdev22896354010 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev22896354010	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2297ada487bsecurityrulesrulerdpdemobdev22988185ffc:networking_rdpAccessRestrictedInternet	nsgbdev2297ada487b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2297ada487b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev230dc8b9100securityrulesrulerdpdemobdev23001d0ed21:networking_rdpAccessRestrictedInternet	nsgbdev230dc8b9100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev230dc8b9100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev231367be97esecurityrulesrulerdpdemobdev2319398fe9a:networking_rdpAccessRestrictedInternet	nsgbdev231367be97e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev231367be97e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev232d6f85d96securityrulesrulerdpdemobdev23236fe6411:networking_rdpAccessRestrictedInternet	nsgbdev232d6f85d96 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev232d6f85d96	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev233c8f739aasecurityrulesrulerdpdemobdev2335df511ce:networking_rdpAccessRestrictedInternet	nsgbdev233c8f739aa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev233c8f739aa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev23416d389c3securityrulesrulerdpdemobdev234b8aec8b1:networking_rdpAccessRestrictedInternet	nsgbdev23416d389c3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev23416d389c3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2352e123017securityrulesrulerdpdemobdev235e22298c7:networking_rdpAccessRestrictedInternet	nsgbdev2352e123017 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2352e123017	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2364d7f4a12securityrulesrulerdpdemobdev2369f35a2c5:networking_rdpAccessRestrictedInternet	nsgbdev2364d7f4a12 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2364d7f4a12	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev237330c5188securityrulesrulerdpdemobdev23788d680ba:networking_rdpAccessRestrictedInternet	nsgbdev237330c5188 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev237330c5188	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev23819a0a01csecurityrulesrulerdpdemobdev2384653df9d:networking_rdpAccessRestrictedInternet	nsgbdev23819a0a01c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev23819a0a01c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev239d1d8307csecurityrulesrulerdpdemobdev239f76d40b0:networking_rdpAccessRestrictedInternet	nsgbdev239d1d8307c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev239d1d8307c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev23ac6a6dc5securityrulesrulerdpdemobdev23e6f77fdf:networking_rdpAccessRestrictedInternet	nsgbdev23ac6a6dc5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev23ac6a6dc5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev24032525d9asecurityrulesrulerdpdemobdev2400e91914d:networking_rdpAccessRestrictedInternet	nsgbdev24032525d9a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev24032525d9a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev241e9ee88basecurityrulesrulerdpdemobdev2410896adf5:networking_rdpAccessRestrictedInternet	nsgbdev241e9ee88ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev241e9ee88ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2423142f3a2securityrulesrulerdpdemobdev2425dd50efc:networking_rdpAccessRestrictedInternet	nsgbdev2423142f3a2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2423142f3a2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev243f8858945securityrulesrulerdpdemobdev243c035b1eb:networking_rdpAccessRestrictedInternet	nsgbdev243f8858945 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev243f8858945	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2441996ae28securityrulesrulerdpdemobdev2448ffeafa0:networking_rdpAccessRestrictedInternet	nsgbdev2441996ae28 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2441996ae28	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev245e7989fb9securityrulesrulerdpdemobdev24535a1e437:networking_rdpAccessRestrictedInternet	nsgbdev245e7989fb9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev245e7989fb9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2461b4c5e64securityrulesrulerdpdemobdev2468cb69482:networking_rdpAccessRestrictedInternet	nsgbdev2461b4c5e64 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2461b4c5e64	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev24757cb2d73securityrulesrulerdpdemobdev247b232178c:networking_rdpAccessRestrictedInternet	nsgbdev24757cb2d73 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev24757cb2d73	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2481f376e63securityrulesrulerdpdemobdev24842f431a0:networking_rdpAccessRestrictedInternet	nsgbdev2481f376e63 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2481f376e63	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev24915cf0de6securityrulesrulerdpdemobdev2498e1d9415:networking_rdpAccessRestrictedInternet	nsgbdev24915cf0de6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev24915cf0de6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev24e4dc0cc5securityrulesrulerdpdemobdev24f12e8ab3:networking_rdpAccessRestrictedInternet	nsgbdev24e4dc0cc5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev24e4dc0cc5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev250d2d35a7bsecurityrulesrulerdpdemobdev25065fe49c2:networking_rdpAccessRestrictedInternet	nsgbdev250d2d35a7b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev250d2d35a7b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev251fd8c1e0csecurityrulesrulerdpdemobdev251f1db35e3:networking_rdpAccessRestrictedInternet	nsgbdev251fd8c1e0c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev251fd8c1e0c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2520e15e06securityrulesrulerdpdemobdev2514c76eb8:networking_rdpAccessRestrictedInternet	nsgbdev2520e15e06 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2520e15e06	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2522fd25bd1securityrulesrulerdpdemobdev2521bbd6f27:networking_rdpAccessRestrictedInternet	nsgbdev2522fd25bd1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2522fd25bd1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev253222e6736securityrulesrulerdpdemobdev25380e57a64:networking_rdpAccessRestrictedInternet	nsgbdev253222e6736 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev253222e6736	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev254559c584csecurityrulesrulerdpdemobdev2549826b558:networking_rdpAccessRestrictedInternet	nsgbdev254559c584c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev254559c584c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2554d68100asecurityrulesrulerdpdemobdev255e53475e8:networking_rdpAccessRestrictedInternet	nsgbdev2554d68100a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2554d68100a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev256f0418d4fsecurityrulesrulerdpdemobdev256869e9549:networking_rdpAccessRestrictedInternet	nsgbdev256f0418d4f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev256f0418d4f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2571a95ffc5securityrulesrulerdpdemobdev2574be05df9:networking_rdpAccessRestrictedInternet	nsgbdev2571a95ffc5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2571a95ffc5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev258e39f2971securityrulesrulerdpdemobdev2584cee9073:networking_rdpAccessRestrictedInternet	nsgbdev258e39f2971 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev258e39f2971	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev259f1ec86fdsecurityrulesrulerdpdemobdev259f6cdf7d9:networking_rdpAccessRestrictedInternet	nsgbdev259f1ec86fd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev259f1ec86fd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2601c030326securityrulesrulerdpdemobdev2603c044ee5:networking_rdpAccessRestrictedInternet	nsgbdev2601c030326 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2601c030326	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev261affec571securityrulesrulerdpdemobdev2612b90eadc:networking_rdpAccessRestrictedInternet	nsgbdev261affec571 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev261affec571	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2623a66e2d1securityrulesrulerdpdemobdev2625f79ebbc:networking_rdpAccessRestrictedInternet	nsgbdev2623a66e2d1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2623a66e2d1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2625ff0461securityrulesrulerdpdemobdev26c7ae41e9:networking_rdpAccessRestrictedInternet	nsgbdev2625ff0461 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2625ff0461	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev263f98f211fsecurityrulesrulerdpdemobdev263878f5d32:networking_rdpAccessRestrictedInternet	nsgbdev263f98f211f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev263f98f211f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev264bbda5d9esecurityrulesrulerdpdemobdev264022486b7:networking_rdpAccessRestrictedInternet	nsgbdev264bbda5d9e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev264bbda5d9e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev265b6a9a719securityrulesrulerdpdemobdev26598c09a0c:networking_rdpAccessRestrictedInternet	nsgbdev265b6a9a719 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev265b6a9a719	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev26689d559b0securityrulesrulerdpdemobdev2665f6c76d9:networking_rdpAccessRestrictedInternet	nsgbdev26689d559b0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev26689d559b0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev267d4f64b9bsecurityrulesrulerdpdemobdev26763a9bd86:networking_rdpAccessRestrictedInternet	nsgbdev267d4f64b9b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev267d4f64b9b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev268823f3207securityrulesrulerdpdemobdev268b1f6dac4:networking_rdpAccessRestrictedInternet	nsgbdev268823f3207 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev268823f3207	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev26944055a2fsecurityrulesrulerdpdemobdev26934d732f9:networking_rdpAccessRestrictedInternet	nsgbdev26944055a2f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev26944055a2f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2708efd0e37securityrulesrulerdpdemobdev2706057175e:networking_rdpAccessRestrictedInternet	nsgbdev2708efd0e37 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2708efd0e37	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev271c581fa0bsecurityrulesrulerdpdemobdev271252bb8c7:networking_rdpAccessRestrictedInternet	nsgbdev271c581fa0b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev271c581fa0b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev27270c97bfsecurityrulesrulerdpdemobdev2791abc383:networking_rdpAccessRestrictedInternet	nsgbdev27270c97bf /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev27270c97bf	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2728ed07665securityrulesrulerdpdemobdev27209944187:networking_rdpAccessRestrictedInternet	nsgbdev2728ed07665 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2728ed07665	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev273fabbdfefsecurityrulesrulerdpdemobdev2730f0534f3:networking_rdpAccessRestrictedInternet	nsgbdev273fabbdfef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev273fabbdfef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev27430f475bfsecurityrulesrulerdpdemobdev274b50e5bb0:networking_rdpAccessRestrictedInternet	nsgbdev27430f475bf /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev27430f475bf	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev27581989b91securityrulesrulerdpdemobdev275db09b605:networking_rdpAccessRestrictedInternet	nsgbdev27581989b91 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev27581989b91	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2762202919esecurityrulesrulerdpdemobdev276fe3fb807:networking_rdpAccessRestrictedInternet	nsgbdev2762202919e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2762202919e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2778e74019dsecurityrulesrulerdpdemobdev27798a8bac6:networking_rdpAccessRestrictedInternet	nsgbdev2778e74019d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2778e74019d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev278cd0c2f5fsecurityrulesrulerdpdemobdev278f0c6fd43:networking_rdpAccessRestrictedInternet	nsgbdev278cd0c2f5f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev278cd0c2f5f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev279ba2aae1csecurityrulesrulerdpdemobdev27960c5844e:networking_rdpAccessRestrictedInternet	nsgbdev279ba2aae1c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev279ba2aae1c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev280e8f4377esecurityrulesrulerdpdemobdev28047381d4e:networking_rdpAccessRestrictedInternet	nsgbdev280e8f4377e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev280e8f4377e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2810efb0c93securityrulesrulerdpdemobdev281a097d2cd:networking_rdpAccessRestrictedInternet	nsgbdev2810efb0c93 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2810efb0c93	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev28243571e32securityrulesrulerdpdemobdev2825ccb7847:networking_rdpAccessRestrictedInternet	nsgbdev28243571e32 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev28243571e32	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2831b899bd0securityrulesrulerdpdemobdev2831d616b1d:networking_rdpAccessRestrictedInternet	nsgbdev2831b899bd0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2831b899bd0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev284061f43dbsecurityrulesrulerdpdemobdev2849db21a5a:networking_rdpAccessRestrictedInternet	nsgbdev284061f43db /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev284061f43db	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev285595acfbesecurityrulesrulerdpdemobdev285896ef931:networking_rdpAccessRestrictedInternet	nsgbdev285595acfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev285595acfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev28631fe849securityrulesrulerdpdemobdev28fb6ed76c:networking_rdpAccessRestrictedInternet	nsgbdev28631fe849 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev28631fe849	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev286f609bc93securityrulesrulerdpdemobdev286e054b63d:networking_rdpAccessRestrictedInternet	nsgbdev286f609bc93 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev286f609bc93	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2878c7e4d55securityrulesrulerdpdemobdev28754d4def7:networking_rdpAccessRestrictedInternet	nsgbdev2878c7e4d55 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2878c7e4d55	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev28875e85782securityrulesrulerdpdemobdev28899b9a7c1:networking_rdpAccessRestrictedInternet	nsgbdev28875e85782 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev28875e85782	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev289453b7e52securityrulesrulerdpdemobdev28958b74a2c:networking_rdpAccessRestrictedInternet	nsgbdev289453b7e52 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev289453b7e52	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2903e745998securityrulesrulerdpdemobdev2901be854bf:networking_rdpAccessRestrictedInternet	nsgbdev2903e745998 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2903e745998	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2917449f92bsecurityrulesrulerdpdemobdev291ed8bbb8f:networking_rdpAccessRestrictedInternet	nsgbdev2917449f92b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2917449f92b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev292f99c17e1securityrulesrulerdpdemobdev292c148a391:networking_rdpAccessRestrictedInternet	nsgbdev292f99c17e1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev292f99c17e1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev293cf9b75b4securityrulesrulerdpdemobdev2930680bd26:networking_rdpAccessRestrictedInternet	nsgbdev293cf9b75b4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev293cf9b75b4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev294b9f25a83securityrulesrulerdpdemobdev294419b4c35:networking_rdpAccessRestrictedInternet	nsgbdev294b9f25a83 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev294b9f25a83	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev295444ce37esecurityrulesrulerdpdemobdev295cc12a13a:networking_rdpAccessRestrictedInternet	nsgbdev295444ce37e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev295444ce37e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev296e3070a6asecurityrulesrulerdpdemobdev296d2690db2:networking_rdpAccessRestrictedInternet	nsgbdev296e3070a6a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev296e3070a6a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2974c46fd6securityrulesrulerdpdemobdev293f6657b7:networking_rdpAccessRestrictedInternet	nsgbdev2974c46fd6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2974c46fd6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev297fb4defc4securityrulesrulerdpdemobdev29722ce4351:networking_rdpAccessRestrictedInternet	nsgbdev297fb4defc4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev297fb4defc4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2986842d150securityrulesrulerdpdemobdev29879bd0619:networking_rdpAccessRestrictedInternet	nsgbdev2986842d150 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2986842d150	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev299fe58cf2bsecurityrulesrulerdpdemobdev299bb24c564:networking_rdpAccessRestrictedInternet	nsgbdev299fe58cf2b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev299fe58cf2b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev2dbb29e01securityrulesrulerdpdemobdev2d969d3f5:networking_rdpAccessRestrictedInternet	nsgbdev2dbb29e01 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev2dbb29e01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev30a20fabf2securityrulesrulerdpdemobdev30cd74795f:networking_rdpAccessRestrictedInternet	nsgbdev30a20fabf2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev30a20fabf2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev31cb966c55securityrulesrulerdpdemobdev31a7062065:networking_rdpAccessRestrictedInternet	nsgbdev31cb966c55 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev31cb966c55	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev32818c0e1csecurityrulesrulerdpdemobdev3201d5cbb2:networking_rdpAccessRestrictedInternet	nsgbdev32818c0e1c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev32818c0e1c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev333f6d1972securityrulesrulerdpdemobdev337ff02cb4:networking_rdpAccessRestrictedInternet	nsgbdev333f6d1972 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev333f6d1972	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev34475e4097securityrulesrulerdpdemobdev34a5871869:networking_rdpAccessRestrictedInternet	nsgbdev34475e4097 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev34475e4097	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev35870dbcf6securityrulesrulerdpdemobdev3517d8e839:networking_rdpAccessRestrictedInternet	nsgbdev35870dbcf6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev35870dbcf6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev36cce87c22securityrulesrulerdpdemobdev36e8a17289:networking_rdpAccessRestrictedInternet	nsgbdev36cce87c22 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev36cce87c22	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev378bb08fe6securityrulesrulerdpdemobdev37ef416864:networking_rdpAccessRestrictedInternet	nsgbdev378bb08fe6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev378bb08fe6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev38aaab12d2securityrulesrulerdpdemobdev38287a1f2f:networking_rdpAccessRestrictedInternet	nsgbdev38aaab12d2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev38aaab12d2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev39b7bdfc2csecurityrulesrulerdpdemobdev39c795f03a:networking_rdpAccessRestrictedInternet	nsgbdev39b7bdfc2c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev39b7bdfc2c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev3a5549547securityrulesrulerdpdemobdev3545212ae:networking_rdpAccessRestrictedInternet	nsgbdev3a5549547 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev3a5549547	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev406057c200securityrulesrulerdpdemobdev4071ccfc74:networking_rdpAccessRestrictedInternet	nsgbdev406057c200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev406057c200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev4168e92c5dsecurityrulesrulerdpdemobdev41db15d9c7:networking_rdpAccessRestrictedInternet	nsgbdev4168e92c5d /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev4168e92c5d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev423a9fe154securityrulesrulerdpdemobdev42fe456272:networking_rdpAccessRestrictedInternet	nsgbdev423a9fe154 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev423a9fe154	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev43de9328fesecurityrulesrulerdpdemobdev4377759c2d:networking_rdpAccessRestrictedInternet	nsgbdev43de9328fe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev43de9328fe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev44d67dea93securityrulesrulerdpdemobdev44318fbf52:networking_rdpAccessRestrictedInternet	nsgbdev44d67dea93 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev44d67dea93	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev4516f44c60securityrulesrulerdpdemobdev45db04bfe2:networking_rdpAccessRestrictedInternet	nsgbdev4516f44c60 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev4516f44c60	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev46463540bbsecurityrulesrulerdpdemobdev46acdac266:networking_rdpAccessRestrictedInternet	nsgbdev46463540bb /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev46463540bb	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev472b72d4c3securityrulesrulerdpdemobdev477f973ea1:networking_rdpAccessRestrictedInternet	nsgbdev472b72d4c3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev472b72d4c3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev482eb78073securityrulesrulerdpdemobdev48cf7409bc:networking_rdpAccessRestrictedInternet	nsgbdev482eb78073 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev482eb78073	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev49e4eb550csecurityrulesrulerdpdemobdev4990c8c74a:networking_rdpAccessRestrictedInternet	nsgbdev49e4eb550c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev49e4eb550c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev4b063c53asecurityrulesrulerdpdemobdev4db5f8c33:networking_rdpAccessRestrictedInternet	nsgbdev4b063c53a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev4b063c53a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev5066ad46f9securityrulesrulerdpdemobdev5047d75ab9:networking_rdpAccessRestrictedInternet	nsgbdev5066ad46f9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev5066ad46f9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev51176dae3esecurityrulesrulerdpdemobdev519209dcab:networking_rdpAccessRestrictedInternet	nsgbdev51176dae3e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev51176dae3e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev5289dc5bf9securityrulesrulerdpdemobdev52c4881208:networking_rdpAccessRestrictedInternet	nsgbdev5289dc5bf9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev5289dc5bf9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev53311a69f2securityrulesrulerdpdemobdev539bdc52e8:networking_rdpAccessRestrictedInternet	nsgbdev53311a69f2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev53311a69f2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev5478a95bcsecurityrulesrulerdpdemobdev5bcf18715:networking_rdpAccessRestrictedInternet	nsgbdev5478a95bc /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev5478a95bc	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev54afcb76casecurityrulesrulerdpdemobdev54d22992c5:networking_rdpAccessRestrictedInternet	nsgbdev54afcb76ca /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev54afcb76ca	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev55811111b0securityrulesrulerdpdemobdev556e6b049a:networking_rdpAccessRestrictedInternet	nsgbdev55811111b0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev55811111b0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev56071debe7securityrulesrulerdpdemobdev56f74f51e1:networking_rdpAccessRestrictedInternet	nsgbdev56071debe7 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev56071debe7	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev571d0facd6securityrulesrulerdpdemobdev57bfad4bb4:networking_rdpAccessRestrictedInternet	nsgbdev571d0facd6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev571d0facd6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev58aa2981dasecurityrulesrulerdpdemobdev58ef89c36d:networking_rdpAccessRestrictedInternet	nsgbdev58aa2981da /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev58aa2981da	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev599953a7f2securityrulesrulerdpdemobdev59d7e8694c:networking_rdpAccessRestrictedInternet	nsgbdev599953a7f2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev599953a7f2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev6021198440securityrulesrulerdpdemobdev6083b898f8:networking_rdpAccessRestrictedInternet	nsgbdev6021198440 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev6021198440	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev60636791bsecurityrulesrulerdpdemobdev6cbe29a07:networking_rdpAccessRestrictedInternet	nsgbdev60636791b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev60636791b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev6190c00bb8securityrulesrulerdpdemobdev61d4f45a8a:networking_rdpAccessRestrictedInternet	nsgbdev6190c00bb8 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev6190c00bb8	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev62e3c74ee9securityrulesrulerdpdemobdev6282a7ee32:networking_rdpAccessRestrictedInternet	nsgbdev62e3c74ee9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev62e3c74ee9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev6396e1b496securityrulesrulerdpdemobdev633d1cd2ec:networking_rdpAccessRestrictedInternet	nsgbdev6396e1b496 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev6396e1b496	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev64a0746fb8securityrulesrulerdpdemobdev645ff68593:networking_rdpAccessRestrictedInternet	nsgbdev64a0746fb8 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev64a0746fb8	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev6502f5e4bfsecurityrulesrulerdpdemobdev6591e8a949:networking_rdpAccessRestrictedInternet	nsgbdev6502f5e4bf /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev6502f5e4bf	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev661088c946securityrulesrulerdpdemobdev663473d5af:networking_rdpAccessRestrictedInternet	nsgbdev661088c946 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev661088c946	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev67514f99c6securityrulesrulerdpdemobdev67cb504bb8:networking_rdpAccessRestrictedInternet	nsgbdev67514f99c6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev67514f99c6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev6853f356b4securityrulesrulerdpdemobdev6822f481a1:networking_rdpAccessRestrictedInternet	nsgbdev6853f356b4 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev6853f356b4	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev69eba20799securityrulesrulerdpdemobdev69f56de607:networking_rdpAccessRestrictedInternet	nsgbdev69eba20799 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev69eba20799	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev70e5e88dc9securityrulesrulerdpdemobdev7046cec146:networking_rdpAccessRestrictedInternet	nsgbdev70e5e88dc9 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev70e5e88dc9	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev713c709360securityrulesrulerdpdemobdev714ff2e07b:networking_rdpAccessRestrictedInternet	nsgbdev713c709360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev713c709360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev72460874c6securityrulesrulerdpdemobdev725ca67dc4:networking_rdpAccessRestrictedInternet	nsgbdev72460874c6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev72460874c6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev738317e2a0securityrulesrulerdpdemobdev735f66dd06:networking_rdpAccessRestrictedInternet	nsgbdev738317e2a0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev738317e2a0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev74bab08030securityrulesrulerdpdemobdev74bb37a948:networking_rdpAccessRestrictedInternet	nsgbdev74bab08030 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev74bab08030	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev7519cab8e0securityrulesrulerdpdemobdev75fd8e5c2b:networking_rdpAccessRestrictedInternet	nsgbdev7519cab8e0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev7519cab8e0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev762c2eb56securityrulesrulerdpdemobdev7f18d571f:networking_rdpAccessRestrictedInternet	nsgbdev762c2eb56 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev762c2eb56	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev765042cf1bsecurityrulesrulerdpdemobdev76f66d1db2:networking_rdpAccessRestrictedInternet	nsgbdev765042cf1b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev765042cf1b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev77e2c13dbesecurityrulesrulerdpdemobdev7731af4517:networking_rdpAccessRestrictedInternet	nsgbdev77e2c13dbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev77e2c13dbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev78b7afbb7bsecurityrulesrulerdpdemobdev7801ccc4e9:networking_rdpAccessRestrictedInternet	nsgbdev78b7afbb7b /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev78b7afbb7b	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev79ce42d2bfsecurityrulesrulerdpdemobdev792905e5e7:networking_rdpAccessRestrictedInternet	nsgbdev79ce42d2bf /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev79ce42d2bf	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev802dd9396csecurityrulesrulerdpdemobdev80f01e89e2:networking_rdpAccessRestrictedInternet	nsgbdev802dd9396c /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev802dd9396c	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev8152f51987securityrulesrulerdpdemobdev810e957803:networking_rdpAccessRestrictedInternet	nsgbdev8152f51987 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev8152f51987	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev82e339ab9asecurityrulesrulerdpdemobdev82a36622f4:networking_rdpAccessRestrictedInternet	nsgbdev82e339ab9a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev82e339ab9a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev83cea55ee6securityrulesrulerdpdemobdev83f3191dac:networking_rdpAccessRestrictedInternet	nsgbdev83cea55ee6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev83cea55ee6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev84e3f509c8securityrulesrulerdpdemobdev849865ddfc:networking_rdpAccessRestrictedInternet	nsgbdev84e3f509c8 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev84e3f509c8	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev855cf97868securityrulesrulerdpdemobdev85f9869960:networking_rdpAccessRestrictedInternet	nsgbdev855cf97868 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev855cf97868	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev86db9f8855securityrulesrulerdpdemobdev862dd1dc26:networking_rdpAccessRestrictedInternet	nsgbdev86db9f8855 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev86db9f8855	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev878bdd8032securityrulesrulerdpdemobdev8723d5b372:networking_rdpAccessRestrictedInternet	nsgbdev878bdd8032 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev878bdd8032	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev8894415b54securityrulesrulerdpdemobdev882d154c52:networking_rdpAccessRestrictedInternet	nsgbdev8894415b54 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev8894415b54	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev89c32e84a2securityrulesrulerdpdemobdev89fae22b47:networking_rdpAccessRestrictedInternet	nsgbdev89c32e84a2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev89c32e84a2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev8d0d983easecurityrulesrulerdpdemobdev85b57edbc:networking_rdpAccessRestrictedInternet	nsgbdev8d0d983ea /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev8d0d983ea	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev90526b1e69securityrulesrulerdpdemobdev90b076c0b5:networking_rdpAccessRestrictedInternet	nsgbdev90526b1e69 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev90526b1e69	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev91f5fcc8f0securityrulesrulerdpdemobdev91c3f109bf:networking_rdpAccessRestrictedInternet	nsgbdev91f5fcc8f0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev91f5fcc8f0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev92e0fb2d76securityrulesrulerdpdemobdev925bc35878:networking_rdpAccessRestrictedInternet	nsgbdev92e0fb2d76 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev92e0fb2d76	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev93f24f6fe2securityrulesrulerdpdemobdev932c2b1f99:networking_rdpAccessRestrictedInternet	nsgbdev93f24f6fe2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev93f24f6fe2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev94f39eedb5securityrulesrulerdpdemobdev946e26e189:networking_rdpAccessRestrictedInternet	nsgbdev94f39eedb5 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev94f39eedb5	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev9518875445securityrulesrulerdpdemobdev9581ae9316:networking_rdpAccessRestrictedInternet	nsgbdev9518875445 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev9518875445	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev9665b52343securityrulesrulerdpdemobdev96682c254d:networking_rdpAccessRestrictedInternet	nsgbdev9665b52343 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev9665b52343	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev97d5c6d2besecurityrulesrulerdpdemobdev972d72167c:networking_rdpAccessRestrictedInternet	nsgbdev97d5c6d2be /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev97d5c6d2be	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev98ae28d86asecurityrulesrulerdpdemobdev98dda956d8:networking_rdpAccessRestrictedInternet	nsgbdev98ae28d86a /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev98ae28d86a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev99c5419800securityrulesrulerdpdemobdev991039d11b:networking_rdpAccessRestrictedInternet	nsgbdev99c5419800 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev99c5419800	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-devb-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgbdev9f04dd7casecurityrulesrulerdpdemobdev95f53a3f6:networking_rdpAccessRestrictedInternet	nsgbdev9f04dd7ca /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-devb-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgbdev9f04dd7ca	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that RDP access is restricted from the internet networking_rdpAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsvwan-demoprovidersmicrosoft.networknetworksecuritygroupswebsite-nsgsecurityrulesrdp:networking_rdpAccessRestrictedInternet	website-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/vwan-demo/providers/microsoft.network/networksecuritygroups/website-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that remote management access is restricted from the internet networking_remoteManagementAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsdomaincontroller01-nsgsecurityrulesport_all:networking_remoteManagementAccessRestrictedInternet	domaincontroller01-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/domaincontroller01-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that remote management access is restricted from the internet networking_remoteManagementAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsomigod-nsgsecurityrulesomigod:networking_remoteManagementAccessRestrictedInternet	omigod-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/omigod-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that remote management access is restricted from the internet networking_remoteManagementAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsomigodahhhhhhhhhh-nsgsecurityrulesomigod:networking_remoteManagementAccessRestrictedInternet	omigodahhhhhhhhhh-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/omigodahhhhhhhhhh-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsteam-dev-rgprovidersmicrosoft.networknetworksecuritygroupsteam-dev-vm-nsgsecurityrulesdefault-allow-ssh:networking_sshAccessRestrictedInternet	team-dev-vm-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.network/networksecuritygroups/team-dev-vm-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulesshdev06e116f66:networking_sshAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulesshdev1e264a5ca:networking_sshAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsnsgdevc8548d20securityrulesrulesshdev2a831c124:networking_sshAccessRestrictedInternet	nsgdevc8548d20 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/nsgdevc8548d20	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-insecure-rgprovidersmicrosoft.networknetworksecuritygroupsthisisatestsecurityrulesport_22:networking_sshAccessRestrictedInternet	thisisatest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.network/networksecuritygroups/thisisatest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsavailabilityset-vm-nsgsecurityrulesssh:networking_sshAccessRestrictedInternet	availabilityset-vm-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/availabilityset-vm-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsbasicnsgomigodahhhhnic2securityrulesssh:networking_sshAccessRestrictedInternet	basicNsgomigodahhhhnic2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/basicnsgomigodahhhhnic2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsdomaincontroller01-nsgsecurityrulesport_all:networking_sshAccessRestrictedInternet	domaincontroller01-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/domaincontroller01-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsdomaincontroller01-nsgsecurityrulesssh:networking_sshAccessRestrictedInternet	domaincontroller01-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/domaincontroller01-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsomigod-nsgsecurityrulesssh:networking_sshAccessRestrictedInternet	omigod-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/omigod-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsomigodahhhhhhhhhh-nsgsecurityrulesssh:networking_sshAccessRestrictedInternet	omigodahhhhhhhhhh-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/omigodahhhhhhhhhh-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsssh-open-no-pip-nsgsecurityrulesallowanysshinbound:networking_sshAccessRestrictedInternet	ssh-open-no-pip-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/ssh-open-no-pip-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that SSH access is restricted from the internet networking_sshAccessRestrictedInternet / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.networknetworksecuritygroupsssh-open-no-pip-nsgsecurityrulesssh:networking_sshAccessRestrictedInternet	ssh-open-no-pip-nsg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.network/networksecuritygroups/ssh-open-no-pip-nsg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / contosodevbaddev1sa:storageAccounts_blobVersioningEnabled	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure blob versioning is enabled on Azure Blob Storage storage accounts storageAccounts_blobVersioningEnabled / auth0test:storageAccounts_blobVersioningEnabled	auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/network-test/providers/microsoft.storage/storageaccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosocontosodb00081013560:storageAccounts_minimumTls	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosocontosodb00081014340:storageAccounts_minimumTls	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosocontosodb00081015100:storageAccounts_minimumTls	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosocontosofile081015510:storageAccounts_minimumTls	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosocontosojump081015360:storageAccounts_minimumTls	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosocontosoweb0081015270:storageAccounts_minimumTls	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosodevbaddev0sa:storageAccounts_minimumTls	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosodevbaddev2sa:storageAccounts_minimumTls	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosodevbaddev3sa:storageAccounts_minimumTls	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosodevbaddev4sa:storageAccounts_minimumTls	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct001:storageAccounts_minimumTls	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct002:storageAccounts_minimumTls	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct003:storageAccounts_minimumTls	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct004:storageAccounts_minimumTls	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct005:storageAccounts_minimumTls	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct006:storageAccounts_minimumTls	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct007:storageAccounts_minimumTls	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct008:storageAccounts_minimumTls	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct196:storageAccounts_minimumTls	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct197:storageAccounts_minimumTls	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct198:storageAccounts_minimumTls	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct199:storageAccounts_minimumTls	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / argstacct200:storageAccounts_minimumTls	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / dsfsdfsdfgff:storageAccounts_minimumTls	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / dummysacontoso:storageAccounts_minimumTls	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / fhjfhdjfhadsjfhd:storageAccounts_minimumTls	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / newcontosobadsa:storageAccounts_minimumTls	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / rewrfaeraewrfaesrfasef:storageAccounts_minimumTls	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / sflogscontosodevcluste2038:storageAccounts_minimumTls	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / vdxfvsdfsdfv:storageAccounts_minimumTls	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / yetanotherbad2:storageAccounts_minimumTls	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / yetanotherbadstorage:storageAccounts_minimumTls	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / contosodevbaddev0sa:storageAccounts_secureTransferRequired	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / contosodevbaddev2sa:storageAccounts_secureTransferRequired	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / contosodevbaddev3sa:storageAccounts_secureTransferRequired	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / contosodevbaddev4sa:storageAccounts_secureTransferRequired	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / dsfsdfsdfgff:storageAccounts_secureTransferRequired	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / dummysacontoso:storageAccounts_secureTransferRequired	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / fhjfhdjfhadsjfhd:storageAccounts_secureTransferRequired	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/team-dev-rg/providers/microsoft.storage/storageaccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / newcontosobadsa:storageAccounts_secureTransferRequired	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / rewrfaeraewrfaesrfasef:storageAccounts_secureTransferRequired	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / vdxfvsdfsdfv:storageAccounts_secureTransferRequired	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / yetanotherbad2:storageAccounts_secureTransferRequired	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / yetanotherbadstorage:storageAccounts_secureTransferRequired	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.storage/storageaccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (6)	Ensure every virtual machine network interface is filtered by a network security group that restricts inbound traffic virtualMachines_vmWithoutEffectiveNsg / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesweb002:virtualMachines_vmWithoutEffectiveNsg	web002 has a network interface with no network security group on the interface or its subnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure AppServices Function App is using Application Insights. appServices_appServicesFunctionsShouldUseApplicationInsights / gfgsrfdgdsfgfsdg:appServices_appServicesFunctionsShouldUseApplicationInsights	gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure AppServices Function App is using Application Insights. appServices_appServicesFunctionsShouldUseApplicationInsights / orderproducts1:appServices_appServicesFunctionsShouldUseApplicationInsights	orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service. appServices_appServicesHttpsEnforced / webappcontosotest:appServices_appServicesHttpsEnforced	webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure that 'HTTP Version' is the latest, if used to run the web app appServices_appServicesLatestHttpVersion / gfgsrfdgdsfgfsdg:appServices_appServicesLatestHttpVersion	gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure that 'HTTP Version' is the latest, if used to run the web app appServices_appServicesLatestHttpVersion / orderproducts1:appServices_appServicesLatestHttpVersion	orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure that 'HTTP Version' is the latest, if used to run the web app appServices_appServicesLatestHttpVersion / webappcontosotest:appServices_appServicesLatestHttpVersion	webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure that the Python version is still security-supported, if used to run the web app appServices_appServicesLatestPythonVersion / webappcontosotest:appServices_appServicesLatestPythonVersion	webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure that Function Apps, API Apps, Web Apps use Managed identity. appServices_appServicesUseManagedIdentity / gfgsrfdgdsfgfsdg:appServices_appServicesUseManagedIdentity	gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosocontosodb00081013560:storageAccounts_blobLoggingEnabled	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosocontosodb00081014340:storageAccounts_blobLoggingEnabled	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosocontosodb00081015100:storageAccounts_blobLoggingEnabled	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosocontosofile081015510:storageAccounts_blobLoggingEnabled	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosocontosojump081015360:storageAccounts_blobLoggingEnabled	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosocontosoweb0081015270:storageAccounts_blobLoggingEnabled	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevbaddev0sa:storageAccounts_blobLoggingEnabled	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevbaddev2sa:storageAccounts_blobLoggingEnabled	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevbaddev3sa:storageAccounts_blobLoggingEnabled	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevbaddev4sa:storageAccounts_blobLoggingEnabled	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevinsecurergba9f:storageAccounts_blobLoggingEnabled	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevrg8ae3:storageAccounts_blobLoggingEnabled	contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevrgb75f:storageAccounts_blobLoggingEnabled	contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevrgb910:storageAccounts_blobLoggingEnabled	contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct001:storageAccounts_blobLoggingEnabled	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct002:storageAccounts_blobLoggingEnabled	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct003:storageAccounts_blobLoggingEnabled	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct004:storageAccounts_blobLoggingEnabled	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct005:storageAccounts_blobLoggingEnabled	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct006:storageAccounts_blobLoggingEnabled	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct007:storageAccounts_blobLoggingEnabled	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct008:storageAccounts_blobLoggingEnabled	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct196:storageAccounts_blobLoggingEnabled	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct197:storageAccounts_blobLoggingEnabled	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct198:storageAccounts_blobLoggingEnabled	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct199:storageAccounts_blobLoggingEnabled	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / argstacct200:storageAccounts_blobLoggingEnabled	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / azureiamparking:storageAccounts_blobLoggingEnabled	azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/azure-iam/providers/Microsoft.Storage/storageAccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / cs110032000f71044ed:storageAccounts_blobLoggingEnabled	cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/cloud-shell-storage-southeastasia/providers/Microsoft.Storage/storageAccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / cs1100320034a5146ba:storageAccounts_blobLoggingEnabled	cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/cloud-shell-storage-southeastasia/providers/Microsoft.Storage/storageAccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / dsfsdfsdfgff:storageAccounts_blobLoggingEnabled	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / dummysacontoso:storageAccounts_blobLoggingEnabled	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / fhjfhdjfhadsjfhd:storageAccounts_blobLoggingEnabled	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/team-dev-rg/providers/Microsoft.Storage/storageAccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / functionsconsumptio9fc6:storageAccounts_blobLoggingEnabled	functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/functions-consumption-flex/providers/Microsoft.Storage/storageAccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / newcontosobadsa:storageAccounts_blobLoggingEnabled	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / rewrfaeraewrfaesrfasef:storageAccounts_blobLoggingEnabled	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / sflogscontosodevcluste2038:storageAccounts_blobLoggingEnabled	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / storageaccountcontoso8298:storageAccounts_blobLoggingEnabled	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / storageaccountcontosobfbe:storageAccounts_blobLoggingEnabled	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / storageaccountfunct936f:storageAccounts_blobLoggingEnabled	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/functions-vnet-test/providers/Microsoft.Storage/storageAccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / vdxfvsdfsdfv:storageAccounts_blobLoggingEnabled	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / yetanotherbad2:storageAccounts_blobLoggingEnabled	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / yetanotherbadstorage:storageAccounts_blobLoggingEnabled	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure TLS 1.2 is used on Storage Account storageAccounts_minimumTls / contosodevbaddev1sa:storageAccounts_minimumTls	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosocontosodb00081013560:storageAccounts_queueLoggingEnabled	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosocontosodb00081014340:storageAccounts_queueLoggingEnabled	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosocontosodb00081015100:storageAccounts_queueLoggingEnabled	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosocontosofile081015510:storageAccounts_queueLoggingEnabled	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosocontosojump081015360:storageAccounts_queueLoggingEnabled	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosocontosoweb0081015270:storageAccounts_queueLoggingEnabled	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevbaddev0sa:storageAccounts_queueLoggingEnabled	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevbaddev2sa:storageAccounts_queueLoggingEnabled	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevbaddev3sa:storageAccounts_queueLoggingEnabled	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevbaddev4sa:storageAccounts_queueLoggingEnabled	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevinsecurergba9f:storageAccounts_queueLoggingEnabled	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevrg8ae3:storageAccounts_queueLoggingEnabled	contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevrgb75f:storageAccounts_queueLoggingEnabled	contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevrgb910:storageAccounts_queueLoggingEnabled	contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct001:storageAccounts_queueLoggingEnabled	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct002:storageAccounts_queueLoggingEnabled	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct003:storageAccounts_queueLoggingEnabled	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct004:storageAccounts_queueLoggingEnabled	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct005:storageAccounts_queueLoggingEnabled	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct006:storageAccounts_queueLoggingEnabled	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct007:storageAccounts_queueLoggingEnabled	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct008:storageAccounts_queueLoggingEnabled	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct196:storageAccounts_queueLoggingEnabled	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct197:storageAccounts_queueLoggingEnabled	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct198:storageAccounts_queueLoggingEnabled	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct199:storageAccounts_queueLoggingEnabled	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / argstacct200:storageAccounts_queueLoggingEnabled	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / azureiamparking:storageAccounts_queueLoggingEnabled	azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/azure-iam/providers/Microsoft.Storage/storageAccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / cs110032000f71044ed:storageAccounts_queueLoggingEnabled	cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/cloud-shell-storage-southeastasia/providers/Microsoft.Storage/storageAccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / cs1100320034a5146ba:storageAccounts_queueLoggingEnabled	cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/cloud-shell-storage-southeastasia/providers/Microsoft.Storage/storageAccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / dsfsdfsdfgff:storageAccounts_queueLoggingEnabled	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / dummysacontoso:storageAccounts_queueLoggingEnabled	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / fhjfhdjfhadsjfhd:storageAccounts_queueLoggingEnabled	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/team-dev-rg/providers/Microsoft.Storage/storageAccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / functionsconsumptio9fc6:storageAccounts_queueLoggingEnabled	functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/functions-consumption-flex/providers/Microsoft.Storage/storageAccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / newcontosobadsa:storageAccounts_queueLoggingEnabled	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / rewrfaeraewrfaesrfasef:storageAccounts_queueLoggingEnabled	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / sflogscontosodevcluste2038:storageAccounts_queueLoggingEnabled	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / storageaccountcontoso8298:storageAccounts_queueLoggingEnabled	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / storageaccountcontosobfbe:storageAccounts_queueLoggingEnabled	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / storageaccountfunct936f:storageAccounts_queueLoggingEnabled	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/functions-vnet-test/providers/Microsoft.Storage/storageAccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / vdxfvsdfsdfv:storageAccounts_queueLoggingEnabled	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / yetanotherbad2:storageAccounts_queueLoggingEnabled	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / yetanotherbadstorage:storageAccounts_queueLoggingEnabled	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure that 'Secure transfer required' is set to 'Enabled' storageAccounts_secureTransferRequired / contosodevbaddev1sa:storageAccounts_secureTransferRequired	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-insecure-rg/providers/microsoft.storage/storageaccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosocontosodb00081013560:storageAccounts_tableLoggingEnabled	contosocontosodb00081013560 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081013560	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosocontosodb00081014340:storageAccounts_tableLoggingEnabled	contosocontosodb00081014340 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081014340	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosocontosodb00081015100:storageAccounts_tableLoggingEnabled	contosocontosodb00081015100 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosodb00081015100	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosocontosofile081015510:storageAccounts_tableLoggingEnabled	contosocontosofile081015510 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosofile081015510	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosocontosojump081015360:storageAccounts_tableLoggingEnabled	contosocontosojump081015360 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosojump081015360	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosocontosoweb0081015270:storageAccounts_tableLoggingEnabled	contosocontosoweb0081015270 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosocontosoweb0081015270	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevbaddev0sa:storageAccounts_tableLoggingEnabled	contosodevbaddev0sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev0sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevbaddev2sa:storageAccounts_tableLoggingEnabled	contosodevbaddev2sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev2sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevbaddev3sa:storageAccounts_tableLoggingEnabled	contosodevbaddev3sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev3sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevbaddev4sa:storageAccounts_tableLoggingEnabled	contosodevbaddev4sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev4sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevinsecurergba9f:storageAccounts_tableLoggingEnabled	contosodevinsecurergba9f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevinsecurergba9f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevrg8ae3:storageAccounts_tableLoggingEnabled	contosodevrg8ae3 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrg8ae3	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevrgb75f:storageAccounts_tableLoggingEnabled	contosodevrgb75f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrgb75f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevrgb910:storageAccounts_tableLoggingEnabled	contosodevrgb910 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/contosodevrgb910	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct001:storageAccounts_tableLoggingEnabled	argstacct001 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct002:storageAccounts_tableLoggingEnabled	argstacct002 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct003:storageAccounts_tableLoggingEnabled	argstacct003 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct003	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct004:storageAccounts_tableLoggingEnabled	argstacct004 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct004	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct005:storageAccounts_tableLoggingEnabled	argstacct005 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct005	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct006:storageAccounts_tableLoggingEnabled	argstacct006 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct006	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct007:storageAccounts_tableLoggingEnabled	argstacct007 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct007	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct008:storageAccounts_tableLoggingEnabled	argstacct008 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct008	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct196:storageAccounts_tableLoggingEnabled	argstacct196 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct196	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct197:storageAccounts_tableLoggingEnabled	argstacct197 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct197	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct198:storageAccounts_tableLoggingEnabled	argstacct198 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct198	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct199:storageAccounts_tableLoggingEnabled	argstacct199 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct199	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / argstacct200:storageAccounts_tableLoggingEnabled	argstacct200 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/argstacct200	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / azureiamparking:storageAccounts_tableLoggingEnabled	azureiamparking /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/azure-iam/providers/Microsoft.Storage/storageAccounts/azureiamparking	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / cs110032000f71044ed:storageAccounts_tableLoggingEnabled	cs110032000f71044ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/cloud-shell-storage-southeastasia/providers/Microsoft.Storage/storageAccounts/cs110032000f71044ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / cs1100320034a5146ba:storageAccounts_tableLoggingEnabled	cs1100320034a5146ba /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/cloud-shell-storage-southeastasia/providers/Microsoft.Storage/storageAccounts/cs1100320034a5146ba	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / dsfsdfsdfgff:storageAccounts_tableLoggingEnabled	dsfsdfsdfgff /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/dsfsdfsdfgff	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / dummysacontoso:storageAccounts_tableLoggingEnabled	dummysacontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/dummysacontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / fhjfhdjfhadsjfhd:storageAccounts_tableLoggingEnabled	fhjfhdjfhadsjfhd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/team-dev-rg/providers/Microsoft.Storage/storageAccounts/fhjfhdjfhadsjfhd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / functionsconsumptio9fc6:storageAccounts_tableLoggingEnabled	functionsconsumptio9fc6 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/functions-consumption-flex/providers/Microsoft.Storage/storageAccounts/functionsconsumptio9fc6	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / newcontosobadsa:storageAccounts_tableLoggingEnabled	newcontosobadsa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/newcontosobadsa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / rewrfaeraewrfaesrfasef:storageAccounts_tableLoggingEnabled	rewrfaeraewrfaesrfasef /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/rewrfaeraewrfaesrfasef	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / sflogscontosodevcluste2038:storageAccounts_tableLoggingEnabled	sflogscontosodevcluste2038 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/sflogscontosodevcluste2038	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / storageaccountcontoso8298:storageAccounts_tableLoggingEnabled	storageaccountcontoso8298 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/storageaccountcontoso8298	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / storageaccountcontosobfbe:storageAccounts_tableLoggingEnabled	storageaccountcontosobfbe /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/storageaccountcontosobfbe	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / storageaccountfunct936f:storageAccounts_tableLoggingEnabled	storageaccountfunct936f /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/functions-vnet-test/providers/Microsoft.Storage/storageAccounts/storageaccountfunct936f	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / vdxfvsdfsdfv:storageAccounts_tableLoggingEnabled	vdxfvsdfsdfv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/vdxfvsdfsdfv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / yetanotherbad2:storageAccounts_tableLoggingEnabled	yetanotherbad2 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/yetanotherbad2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / yetanotherbadstorage:storageAccounts_tableLoggingEnabled	yetanotherbadstorage /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Storage/storageAccounts/yetanotherbadstorage	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure every virtual machine network interface is filtered by a network security group that restricts inbound traffic virtualMachines_vmWithoutEffectiveNsg / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdb002:virtualMachines_vmWithoutEffectiveNsg	db002 has a network interface with no network security group on the interface or its subnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Ensure every virtual machine network interface is filtered by a network security group that restricts inbound traffic virtualMachines_vmWithoutEffectiveNsg / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupscontoso-dev-rgprovidersmicrosoft.computevirtualmachinesdomaincontroller01:virtualMachines_vmWithoutEffectiveNsg	domaincontroller01 has network security groups that allow all inbound traffic from the internet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.compute/virtualmachines/domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (5)	Windows Defender Exploit Guard should be enabled on machines virtualMachines_windowsDefenderExploitGuard / subscriptions56914835-2c07-4bdf-a088-72e94ee7eb82resourcegroupsarcprovidersmicrosoft.hybridcomputemachineswin-6uefkaijsjv:virtualMachines_windowsDefenderExploitGuard	win-6uefkaijsjv /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/arc/providers/microsoft.hybridcompute/machines/win-6uefkaijsjv	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / contosodevbaddev1sa:storageAccounts_blobLoggingEnabled	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure Storage logging is enabled for Blob service for read, write, and delete requests storageAccounts_blobLoggingEnabled / auth0test:storageAccounts_blobLoggingEnabled	auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Storage/storageAccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / contosodevbaddev1sa:storageAccounts_queueLoggingEnabled	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure Storage logging is enabled for Queue service for read, write, and delete requests storageAccounts_queueLoggingEnabled / auth0test:storageAccounts_queueLoggingEnabled	auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Storage/storageAccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / contosodevbaddev1sa:storageAccounts_tableLoggingEnabled	contosodevbaddev1sa /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Storage/storageAccounts/contosodevbaddev1sa	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure Storage logging is enabled for Table service for read, write, and delete requests storageAccounts_tableLoggingEnabled / auth0test:storageAccounts_tableLoggingEnabled	auth0test /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Storage/storageAccounts/auth0test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / db002:virtualMachines_endpointProtectionInstalled	db002 :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:db002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / dc001:virtualMachines_endpointProtectionInstalled	dc001 :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:vwan-demo:providers:microsoft.compute:virtualmachines:dc001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / domaincontroller01:virtualMachines_endpointProtectionInstalled	domaincontroller01 :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:domaincontroller01	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / fileserver001:virtualMachines_endpointProtectionInstalled	fileserver001 :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:fileserver001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / jumpbox:virtualMachines_endpointProtectionInstalled	jumpbox :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:jumpbox	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / sql002:virtualMachines_endpointProtectionInstalled	sql002 :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:vwan-demo:providers:microsoft.compute:virtualmachines:sql002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / vmss-test_44a61f7d:virtualMachines_endpointProtectionInstalled	vmss-test_44a61f7d :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:vmss-test_44a61f7d	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / vmss-test_50ea3b8a:virtualMachines_endpointProtectionInstalled	vmss-test_50ea3b8a :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:vmss-test_50ea3b8a	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / web002:virtualMachines_endpointProtectionInstalled	web002 :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:web002	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Medium (4)	Ensure that the endpoint protection for all Virtual Machines is installed virtualMachines_endpointProtectionInstalled / webserver001:virtualMachines_endpointProtectionInstalled	webserver001 :subscriptions:56914835-2c07-4bdf-a088-72e94ee7eb82:resourcegroups:contoso-dev-rg:providers:microsoft.compute:virtualmachines:webserver001	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure that App Services Function Apps have TLS/SSL certificates associated appServices_appServicesFunctionsWithoutCert / orderproducts1:appServices_appServicesFunctionsWithoutCert	orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure that App Services Web Apps have TLS/SSL certificates associated appServices_webAppWithoutCert / webappcontosotest:appServices_webAppWithoutCert	webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure that 'Data encryption' is set to 'On' on a SQL Database databaseServices_sqlTdeEnabled / master:databaseServices_sqlTdeEnabled	master /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql/databases/master	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / team-dev-rg-vnetdefault:networking_subnetWithoutNsg	team-dev-rg-vnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/team-dev-rg/providers/Microsoft.Network/virtualNetworks/team-dev-rg-vnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / contoso-dev-insecure-rg-vnetdefault:networking_subnetWithoutNsg	contoso-dev-insecure-rg-vnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Network/virtualNetworks/contoso-dev-insecure-rg-vnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / contosodevrgvnet194appgateway:networking_subnetWithoutNsg	contosodevrgvnet194/appgateway /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/contosodevrgvnet194/subnets/appgateway	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / contosodevrgvnet194default:networking_subnetWithoutNsg	contosodevrgvnet194/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/contosodevrgvnet194/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / badvnetappgw:networking_subnetWithoutNsg	badVnet/appgw /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Network/virtualNetworks/badVnet/subnets/appgw	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / domaincontroller-vnetappgateway:networking_subnetWithoutNsg	domaincontroller-vnet/appgateway /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/domaincontroller-vnet/subnets/appgateway	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / domaincontroller-vnetdefault:networking_subnetWithoutNsg	domaincontroller-vnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/domaincontroller-vnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / fsafasdfsda-vnetdefault:networking_subnetWithoutNsg	fsafasdfsda-vnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/demo-rg/providers/Microsoft.Network/virtualNetworks/fsafasdfsda-vnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / functions-vnet-testdefault:networking_subnetWithoutNsg	functions-vnet-test/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/functions-vnet-test/providers/Microsoft.Network/virtualNetworks/functions-vnet-test/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / privatesubnetvnetdefault:networking_subnetWithoutNsg	privatesubnetvnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/privatesubnetvnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / privatesubnetvnetprivatesubnet:networking_subnetWithoutNsg	privatesubnetvnet/privatesubnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/privatesubnetvnet/subnets/privatesubnet	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / thisisanokayvnetdefault:networking_subnetWithoutNsg	thisisanokayvnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-insecure-rg/providers/Microsoft.Network/virtualNetworks/thisisanokayvnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / ustest-vnetdefault:networking_subnetWithoutNsg	ustest-vnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/ustest-vnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnet-contosodevclustersubnet-0:networking_subnetWithoutNsg	VNet-contosodevcluster/Subnet-0 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Network/virtualNetworks/VNet-contosodevcluster/subnets/Subnet-0	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnet-test-scandefault:networking_subnetWithoutNsg	vnet-test-scan/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/team-dev-rg/providers/Microsoft.Network/virtualNetworks/vnet-test-scan/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnet-test-scantestsubnet:networking_subnetWithoutNsg	vnet-test-scan/testsubnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/team-dev-rg/providers/Microsoft.Network/virtualNetworks/vnet-test-scan/subnets/testsubnet	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnet1subnet1:networking_subnetWithoutNsg	VNET1/subnet1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/vwan-demo/providers/Microsoft.Network/virtualNetworks/VNET1/subnets/subnet1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnet2subnet1:networking_subnetWithoutNsg	VNET2/subnet1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/vwan-demo/providers/Microsoft.Network/virtualNetworks/VNET2/subnets/subnet1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnet3subnet1:networking_subnetWithoutNsg	VNET3/subnet1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/vwan-demo/providers/Microsoft.Network/virtualNetworks/VNET3/subnets/subnet1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnet4subnet1:networking_subnetWithoutNsg	VNET4/subnet1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/vwan-demo/providers/Microsoft.Network/virtualNetworks/VNET4/subnets/subnet1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnetappsubnet:networking_subnetWithoutNsg	vnet/appsubnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Network/virtualNetworks/vnet/subnets/appsubnet	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnetazurebastionsubnet:networking_subnetWithoutNsg	vnet/AzureBastionSubnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Network/virtualNetworks/vnet/subnets/AzureBastionSubnet	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnetdatasubnet:networking_subnetWithoutNsg	vnet/datasubnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Network/virtualNetworks/vnet/subnets/datasubnet	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnetdefault:networking_subnetWithoutNsg	vnet/default /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Network/virtualNetworks/vnet/subnets/default	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (3)	Ensure the Subnet has an NSG associated networking_subnetWithoutNsg / vnetvmsubnet:networking_subnetWithoutNsg	vnet/vmsubnet /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/network-test/providers/Microsoft.Network/virtualNetworks/vnet/subnets/vmsubnet	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On' appServices_appServicesClientCertsOn / gfgsrfdgdsfgfsdg:appServices_appServicesClientCertsOn	gfgsrfdgdsfgfsdg /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/gfgsrfdgdsfgfsdg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On' appServices_appServicesClientCertsOn / orderproducts1:appServices_appServicesClientCertsOn	orderproducts1 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/orderproducts1	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On' appServices_appServicesClientCertsOn / webappcontosotest:appServices_appServicesClientCertsOn	webappcontosotest /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.web/sites/webappcontosotest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure that 'Unattached disks' are encrypted virtualMachines_unattachedDisksEncrypted / availabilityset-vm_osdisk_1_5b12673de3ef4048806a635e0ecae28e:virtualMachines_unattachedDisksEncrypted	availabilityset-vm_OsDisk_1_5b12673de3ef4048806a635e0ecae28e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/availabilityset-vm_OsDisk_1_5b12673de3ef4048806a635e0ecae28e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure that 'Unattached disks' are encrypted virtualMachines_unattachedDisksEncrypted / dummyvmcontoso_osdisk_1_20271aaec66241be9a37f87e21a5a26e:virtualMachines_unattachedDisksEncrypted	dummyvmcontoso_OsDisk_1_20271aaec66241be9a37f87e21a5a26e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/dummyvmcontoso_OsDisk_1_20271aaec66241be9a37f87e21a5a26e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure that 'Unattached disks' are encrypted virtualMachines_unattachedDisksEncrypted / fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed:virtualMachines_unattachedDisksEncrypted	fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure that 'Unattached disks' are encrypted virtualMachines_unattachedDisksEncrypted / ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24:virtualMachines_unattachedDisksEncrypted	ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (2)	Ensure that 'Unattached disks' are encrypted virtualMachines_unattachedDisksEncrypted / thebestestvm_osdisk_1_a5e6d76de06845db8da3f18e90640e72:virtualMachines_unattachedDisksEncrypted	thebestestvm_OsDisk_1_a5e6d76de06845db8da3f18e90640e72 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/thebestestvm_OsDisk_1_a5e6d76de06845db8da3f18e90640e72	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'AuditActionGroups' in 'auditing' policy for a SQL server is set properly databaseServices_sqlAuditActionsAndGroupsSet / badsqlservercontoso:databaseServices_sqlAuditActionsAndGroupsSet	badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'AuditActionGroups' in 'auditing' policy for a SQL server is set properly databaseServices_sqlAuditActionsAndGroupsSet / importantsql:databaseServices_sqlAuditActionsAndGroupsSet	importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that SQL server auditing to a storage account retains audit logs for 0 (unlimited) or at least 90 days databaseServices_sqlAuditRetentionGreaterThan90 / badsqlservercontoso:databaseServices_sqlAuditRetentionGreaterThan90	badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that SQL server auditing to a storage account retains audit logs for 0 (unlimited) or at least 90 days databaseServices_sqlAuditRetentionGreaterThan90 / importantsql:databaseServices_sqlAuditRetentionGreaterThan90	importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourcegroups/contoso-dev-rg/providers/microsoft.sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'Auditing' is set to 'On' on Azure SQL databaseServices_sqlAuditingEnabled / badsqlservercontoso:databaseServices_sqlAuditingEnabled	badsqlservercontoso /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Sql/servers/badsqlservercontoso	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'Auditing' is set to 'On' on Azure SQL databaseServices_sqlAuditingEnabled / importantsql:databaseServices_sqlAuditingEnabled	importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Entra ID Admin is configured on Azure SQL databaseServices_sqlAzureAdAdminConfigured / importantsql:databaseServices_sqlAzureAdAdminConfigured	importantsql /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Sql/servers/importantsql	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / team-dev-rg:iam_spnRbacOnRgGroupExists	team-dev-rg team-dev-rg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / arc:iam_spnRbacOnRgGroupExists	arc arc	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / contoso-apim:iam_spnRbacOnRgGroupExists	contoso-apim contoso-apim	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / contoso-dev-insecure-rg:iam_spnRbacOnRgGroupExists	contoso-dev-insecure-rg contoso-dev-insecure-rg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / contoso-dev-rg:iam_spnRbacOnRgGroupExists	contoso-dev-rg contoso-dev-rg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / contoso-devb-insecure-rg:iam_spnRbacOnRgGroupExists	contoso-devB-insecure-rg contoso-devB-insecure-rg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / contoso-local-dev-support:iam_spnRbacOnRgGroupExists	contoso-local-dev-support contoso-local-dev-support	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / contoso-marketplace-subscription-sam:iam_spnRbacOnRgGroupExists	contoso-marketplace-subscription-sam contoso-marketplace-subscription-sam	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / azure-iam:iam_spnRbacOnRgGroupExists	azure-iam azure-iam	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / azureapp-auto-alerts-54112e-sam_contoso_security_io:iam_spnRbacOnRgGroupExists	azureapp-auto-alerts-54112e-sam_contoso_security_io azureapp-auto-alerts-54112e-sam_contoso_security_io	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / cloud-shell-storage-southeastasia:iam_spnRbacOnRgGroupExists	cloud-shell-storage-southeastasia cloud-shell-storage-southeastasia	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / defaultresourcegroup-dewc:iam_spnRbacOnRgGroupExists	DefaultResourceGroup-DEWC DefaultResourceGroup-DEWC	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / defaultresourcegroup-eau:iam_spnRbacOnRgGroupExists	DefaultResourceGroup-EAU DefaultResourceGroup-EAU	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / defaultresourcegroup-ejp:iam_spnRbacOnRgGroupExists	DefaultResourceGroup-EJP DefaultResourceGroup-EJP	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / defaultresourcegroup-eus:iam_spnRbacOnRgGroupExists	DefaultResourceGroup-EUS DefaultResourceGroup-EUS	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / defaultresourcegroup-weu:iam_spnRbacOnRgGroupExists	DefaultResourceGroup-WEU DefaultResourceGroup-WEU	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / demo-rg:iam_spnRbacOnRgGroupExists	demo-rg demo-rg	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / foundry:iam_spnRbacOnRgGroupExists	foundry foundry	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / functions-consumption-flex:iam_spnRbacOnRgGroupExists	functions-consumption-flex functions-consumption-flex	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / functions-vnet-test:iam_spnRbacOnRgGroupExists	functions-vnet-test functions-vnet-test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / logicapp-programmed-test:iam_spnRbacOnRgGroupExists	logicapp-programmed-test logicapp-programmed-test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / network-test:iam_spnRbacOnRgGroupExists	network-test network-test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / networkwatcherrg:iam_spnRbacOnRgGroupExists	NetworkWatcherRG NetworkWatcherRG	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / securitycopilot:iam_spnRbacOnRgGroupExists	securitycopilot securitycopilot	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / vmss-test:iam_spnRbacOnRgGroupExists	vmss-test vmss-test	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Azure Resource Groups have Entra ID Groups applied. iam_spnRbacOnRgGroupExists / vwan-demo:iam_spnRbacOnRgGroupExists	vwan-demo vwan-demo	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure the key vault is recoverable miscellaneous_isRecoverable / contosolocaldev:miscellaneous_isRecoverable	contosolocaldev /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-local-dev-support/providers/Microsoft.KeyVault/vaults/contosolocaldev	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure the key vault is recoverable miscellaneous_isRecoverable / kvaueprd:miscellaneous_isRecoverable	kvaueprd /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/vwan-demo/providers/Microsoft.KeyVault/vaults/kvaueprd	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Activity Logs are sent to Log Analytics monitoring_activityLogsConnectedToLogAnalytics / 56914835-2c07-4bdf-a088-72e94ee7eb82:monitoring_activityLogsConnectedToLogAnalytics	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-australiasoutheast:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.australiasoutheast 56914835-2c07-4bdf-a088-72e94ee7eb82-australiasoutheast	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-brazilsouth:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.brazilsouth 56914835-2c07-4bdf-a088-72e94ee7eb82-brazilsouth	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-canadacentral:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.canadacentral 56914835-2c07-4bdf-a088-72e94ee7eb82-canadacentral	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-canadaeast:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.canadaeast 56914835-2c07-4bdf-a088-72e94ee7eb82-canadaeast	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-centralindia:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.centralindia 56914835-2c07-4bdf-a088-72e94ee7eb82-centralindia	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-centralus:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.centralus 56914835-2c07-4bdf-a088-72e94ee7eb82-centralus	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-eastasia:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.eastasia 56914835-2c07-4bdf-a088-72e94ee7eb82-eastasia	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-eastus2:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.eastus2 56914835-2c07-4bdf-a088-72e94ee7eb82-eastus2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-francecentral:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.francecentral 56914835-2c07-4bdf-a088-72e94ee7eb82-francecentral	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-francesouth:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.francesouth 56914835-2c07-4bdf-a088-72e94ee7eb82-francesouth	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-germanywestcentral:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.germanywestcentral 56914835-2c07-4bdf-a088-72e94ee7eb82-germanywestcentral	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-japaneast:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.japaneast 56914835-2c07-4bdf-a088-72e94ee7eb82-japaneast	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-japanwest:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.japanwest 56914835-2c07-4bdf-a088-72e94ee7eb82-japanwest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-koreacentral:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.koreacentral 56914835-2c07-4bdf-a088-72e94ee7eb82-koreacentral	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-koreasouth:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.koreasouth 56914835-2c07-4bdf-a088-72e94ee7eb82-koreasouth	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-northcentralus:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.northcentralus 56914835-2c07-4bdf-a088-72e94ee7eb82-northcentralus	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-northeurope:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.northeurope 56914835-2c07-4bdf-a088-72e94ee7eb82-northeurope	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-norwayeast:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.norwayeast 56914835-2c07-4bdf-a088-72e94ee7eb82-norwayeast	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-norwaywest:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.norwaywest 56914835-2c07-4bdf-a088-72e94ee7eb82-norwaywest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-southafricanorth:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.southafricanorth 56914835-2c07-4bdf-a088-72e94ee7eb82-southafricanorth	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-southcentralus:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.southcentralus 56914835-2c07-4bdf-a088-72e94ee7eb82-southcentralus	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-southeastasia:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.southeastasia 56914835-2c07-4bdf-a088-72e94ee7eb82-southeastasia	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-southindia:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.southindia 56914835-2c07-4bdf-a088-72e94ee7eb82-southindia	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-switzerlandnorth:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.switzerlandnorth 56914835-2c07-4bdf-a088-72e94ee7eb82-switzerlandnorth	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-switzerlandwest:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.switzerlandwest 56914835-2c07-4bdf-a088-72e94ee7eb82-switzerlandwest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-uaenorth:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.uaenorth 56914835-2c07-4bdf-a088-72e94ee7eb82-uaenorth	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-uksouth:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.uksouth 56914835-2c07-4bdf-a088-72e94ee7eb82-uksouth	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-ukwest:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.ukwest 56914835-2c07-4bdf-a088-72e94ee7eb82-ukwest	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-westcentralus:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.westcentralus 56914835-2c07-4bdf-a088-72e94ee7eb82-westcentralus	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-westeurope:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.westeurope 56914835-2c07-4bdf-a088-72e94ee7eb82-westeurope	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-westindia:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.westindia 56914835-2c07-4bdf-a088-72e94ee7eb82-westindia	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-westus2:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.westus2 56914835-2c07-4bdf-a088-72e94ee7eb82-westus2	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Network Watcher is 'Enabled' networking_networkWatcherEnabled / 56914835-2c07-4bdf-a088-72e94ee7eb82-westus:networking_networkWatcherEnabled	56914835-2c07-4bdf-a088-72e94ee7eb82.westus 56914835-2c07-4bdf-a088-72e94ee7eb82-westus	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that Diagnostic logs in Service Bus are enabled serviceBus_diagnosticSettings / jdhalfkjadhflaskh:serviceBus_diagnosticSettings	jdhalfkjadhflaskh /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.ServiceBus/namespaces/jdhalfkjadhflaskh	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'Orphaned disks' are removed virtualMachines_unattachedManagedDisks / availabilityset-vm_osdisk_1_5b12673de3ef4048806a635e0ecae28e:virtualMachines_unattachedManagedDisks	availabilityset-vm_OsDisk_1_5b12673de3ef4048806a635e0ecae28e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/availabilityset-vm_OsDisk_1_5b12673de3ef4048806a635e0ecae28e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'Orphaned disks' are removed virtualMachines_unattachedManagedDisks / dummyvmcontoso_osdisk_1_20271aaec66241be9a37f87e21a5a26e:virtualMachines_unattachedManagedDisks	dummyvmcontoso_OsDisk_1_20271aaec66241be9a37f87e21a5a26e /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/dummyvmcontoso_OsDisk_1_20271aaec66241be9a37f87e21a5a26e	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'Orphaned disks' are removed virtualMachines_unattachedManagedDisks / fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed:virtualMachines_unattachedManagedDisks	fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/fdsfsadfdsf_disk1_d0d3e46d5435458c90b4c7463cb4f2ed	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'Orphaned disks' are removed virtualMachines_unattachedManagedDisks / ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24:virtualMachines_unattachedManagedDisks	ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/ssh-open-no-pip_disk1_3bb2a786764c4ee99a5d9c72a5467c24	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open
Low (1)	Ensure that 'Orphaned disks' are removed virtualMachines_unattachedManagedDisks / thebestestvm_osdisk_1_a5e6d76de06845db8da3f18e90640e72:virtualMachines_unattachedManagedDisks	thebestestvm_OsDisk_1_a5e6d76de06845db8da3f18e90640e72 /subscriptions/56914835-2c07-4bdf-a088-72e94ee7eb82/resourceGroups/contoso-dev-rg/providers/Microsoft.Compute/disks/thebestestvm_OsDisk_1_a5e6d76de06845db8da3f18e90640e72	Dev 56914835-2c07-4bdf-a088-72e94ee7eb82	Open

Finding context by rule

Rule guidance is shared across matching findings. Confirm the appropriate change against each resource and its operational requirements.

Ensure AI Foundry agent system prompts do not contain hard-coded credentials

Rule: aiFoundry_agentSecretInSystemPrompt

This rule detects Azure AI Foundry agents whose system prompt (instructions) contains a hard-coded secret such as an API key, connection string, or password. Embedding credentials in system prompts exposes them to exfiltration via prompt-injection attacks and makes rotation difficult.

AI agent system prompts are stored in the Azure AI Foundry service and are included verbatim in every LLM context window. An attacker who can inject instructions via tool outputs, retrieved documents, or user messages can instruct the agent to repeat its system prompt, leaking any secrets it contains. Additionally, because the system prompt is managed through the agent definition rather than a secrets manager, rotating the credential requires redeploying the agent. Remediation: remove all secrets from the agent's instructions field and instead supply credentials at runtime through environment variables, Azure Key Vault references, or managed-identity authentication.

Impact and guidance: Hard-coded secrets in system prompts can be exfiltrated by prompt-injection attacks. Once leaked, the credential can be used by an attacker to access the downstream service the credential protects, potentially leading to data exfiltration, privilege escalation, or lateral movement.

References

https://learn.microsoft.com/en-us/azure/ai-services/agents/concepts/agents
https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

Ensure AI Foundry projects have managed network isolation configured

Rule: aiFoundry_agentWithoutNetworkIsolation

This rule detects AI Foundry projects and hubs that do not have a managed virtual network configured. Without network isolation, agent compute resources and tool calls are exposed to the public internet.

Azure AI Foundry supports managed virtual networks that restrict outbound traffic from agent compute to approved endpoints only. Without this isolation, agents can potentially connect to arbitrary internet endpoints, which may enable data exfiltration, unexpected tool usage, or server-side request forgery (SSRF) attacks via prompt injection. Network isolation is especially important for agents with access to sensitive internal data.

Impact and guidance: Agents without network isolation can be manipulated to make outbound connections to attacker-controlled infrastructure, potentially exfiltrating sensitive data or enabling lateral movement.

References

https://learn.microsoft.com/en-us/azure/ai-studio/how-to/configure-managed-network

Enable diagnostic settings on Azure AI Services accounts

Rule: aiFoundry_cognitiveServicesDiagnosticsDisabled

This rule detects Azure AI Services / AI Foundry accounts (kind=AIServices) that have no diagnostic settings configured. Without diagnostic settings, LLM request/response logs, audit events, and usage metrics are not exported to any log sink. Restricted to AI Foundry accounts specifically - see cognitiveServices_diagnosticsDisabled for the same check on every other Cognitive Services account kind.

Diagnostic settings on Azure AI Services accounts control whether audit logs, request logs, and metrics are sent to Log Analytics, Event Hub, or Storage. Without this configuration, there is no centralised evidence of which prompts were sent to the model, which responses were returned, or whether unusual usage patterns occurred. For agentic workloads this means agent actions cannot be correlated with audit events. Remediation: add a diagnostic setting that exports AllLogs and AllMetrics to a Log Analytics workspace with a retention period appropriate for your compliance requirements.

Impact and guidance: Without diagnostic settings, security investigations, compliance audits, and incident response cannot rely on LLM audit logs, making prompt-injection attacks, data exfiltration, and excessive usage invisible.

References

https://learn.microsoft.com/en-us/azure/ai-services/diagnostic-logging
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings

Use Entra ID or managed identity authentication for AI Foundry workspace connections

Rule: aiFoundry_openApiToolAllowsAnonymousOrApiKeyAuth

This rule detects Azure AI Foundry workspace connections that use anonymous or static API key authentication. OpenAPI and HTTP tools allow agents to call external APIs on behalf of users. When those connections use weak authentication, tool calls cannot be strongly attributed, constrained per agent identity, or revoked independently of the agent — significantly widening the attack surface for prompt injection and tool misuse.

AI Foundry connections define how agents authenticate to external systems when invoking tools. Anonymous connections have no identity and cannot be audited or revoked. Static API key connections expose a long-lived credential that, if leaked via prompt injection or system-prompt extraction, can be used by an attacker indefinitely without the ability to identify which agent call was legitimate. Microsoft Entra ID authentication with managed identity is the preferred approach because it enables per-call attribution, short-lived tokens, Conditional Access policies, and centralised revocation. Remediation: replace anonymous and API key connections with Entra ID or managed identity authentication. For legacy integrations where API keys are unavoidable, store them in Key Vault with rotation and expiry policies.

Impact and guidance: Weak connection authentication allows attacker-injected tool calls to impersonate the agent without audit trail, enables credential theft via system-prompt extraction, and prevents per-identity revocation if the agent is compromised.

References

https://learn.microsoft.com/en-us/azure/ai-services/agents/how-to/tools/openapi-spec
https://learn.microsoft.com/en-us/azure/ai-studio/how-to/connections-add
https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

Ensure that App Services Functions are not accessible by anybody from the Internet

Rule: appServices_AppServicesPublic

By default, your App Service Function App accepts requests from all IP addresses from the internet, but you can limit that access to a small subset of IP addresses.

Allow the clients that need the Function App, rather than adding a deny-all rule first. Once any access restriction rule exists, App Service denies unmatched traffic, so: (1) identify every client - users or their egress addresses, front doors or gateways (by service tag), health probes and integrations; (2) add an Allow rule for each, at distinct priorities; (3) configure the advanced tools (SCM/Kudu) site's own rules, or set it to use the main site's rules, so deployment pipelines keep working; (4) confirm each client works and check the IPSecurity audit logs for unexpected denials. A Deny 0.0.0.0/0 rule at a lower priority number than the Allow rules would block every client, including the allowed ones. Private endpoints are an alternative for clients inside a virtual network; VNet integration controls the app's OUTBOUND traffic and does not restrict inbound access.

References

https://docs.microsoft.com/en-us/azure/app-service/overview-security#static-ip-restrictions

Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'

Rule: appServices_appServicesClientCertsOn

Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.

The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server. If incoming client certificates are enabled, then only an authenticated client who has valid certificates can access the app.

Impact and guidance: Only clients that have a valid certificate will be able to reach the app. Rollback is available.

References

https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth#enable-client-certificates

Ensure AppServices Function App does not have secrets configured in its App Settings.

Rule: appServices_appServicesFunctionsSecrets

App Services can have secrets stored in multiple locations. While 'App Settings' which are injected into the application as environment variables, is simple and easily done, we believe the recommended and more secure way is to store secrets somewhere else, i.e. in Azure Key Vault. Storing them in App Settings for anyone to read and potentially steal is not a secure pattern.

Move the secret to Azure Key Vault and reference it, in this order: (1) store the secret in Key Vault - through the portal, or from a file or a pipeline secret, never as a value on a command line, where shell history keeps it; (2) give the app a managed identity and grant it read access to that secret (Key Vault Secrets User, or a get access policy); (3) replace the setting's value with a Key Vault reference (@Microsoft.KeyVault(SecretUri=...)) and confirm the reference resolves - the app's environment variables page shows its status; (4) then rotate the secret at its source, because its old value was readable by anyone who could list the app's settings, and update the Key Vault copy. Platform Policy and holistic guidance: manage secrets centrally in Key Vault, with expiry and rotation, and prefer managed identities over secrets where the target service supports them.

References

https://docs.microsoft.com/en-us/azure/app-service/security-recommendations#data-protection

Ensure AppServices Function App is using Application Insights.

Rule: appServices_appServicesFunctionsShouldUseApplicationInsights

Without Application Insights, you may miss critical errors, performance degradation, or abnormal behavior in your Function App, potentially impacting availability and user experience.

A Function App is treated as configured for Application Insights when it has an APPLICATIONINSIGHTS_CONNECTION_STRING setting (the current form) or the legacy APPINSIGHTS_INSTRUMENTATIONKEY setting. This checks configuration, not that telemetry is arriving. When the app settings could not be read, the app is reported as not assessed rather than as missing Application Insights. If the app is monitored through another telemetry design, treat this as an architecture review.

References

https://learn.microsoft.com/en-us/azure/azure-monitor/app/monitor-functions

Ensure that App Services Function Apps have TLS/SSL certificates associated

Rule: appServices_appServicesFunctionsWithoutCert

It is recommended that all Azure App Services use a custom TLS/SSL certificate.

References

https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate
https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code

Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service.

Rule: appServices_appServicesHttpsEnforced

Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.

HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. So it is important to support HTTPS for the security benefits.

Impact and guidance: Enabling HTTPS-only traffic will redirect all non-secure HTTP request to HTTPS ports. Rollback is available.

References

https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-ssl#enforce-https

Ensure that 'HTTP Version' is the latest, if used to run the web app

Rule: appServices_appServicesLatestHttpVersion

Periodically, newer versions are released for HTTP software either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps is recommended in order to take advantage of security fixes, if any, and/or additional functionalities of the newer version.

Newer versions may contain security enhancements and additional functionality. Using the latest software version is recommended in order to take advantage of enhancements and new capabilities. With each software installation, organizations need to determine if a given update meets their requirements and also verify the compatibility and support provided for any additional software against the update revision that is selected.

Impact and guidance: HTTP 2.0 has additional performance improvements on the head-of-line blocking problem of old HTTP version, header compression, and prioritization of requests. HTTP 2.0 no longer supports HTTP 1.1's chunked transfer encoding mechanism, as it provides its own, more efficient, mechanisms for data streaming. Clients that do not support the latest HTTP version might be unable to access this application after remediation. Rollback is available.

References

https://docs.microsoft.com/en-us/azure/app-service/web-sites-configure#general-settings

Ensure that the Python version is still security-supported, if used to run the web app

Rule: appServices_appServicesLatestPythonVersion

A web app running the built-in Python stack should run a Python branch that still receives upstream security fixes. ARGOS reports a site whose Python branch has passed its end of security support; supported branches pass, and custom containers, other stacks and Windows sites are not assessed. A Python runtime ARGOS cannot place on the support lifecycle - an unreadable version, a branch its lifecycle data does not yet list (including a newly released one), or runtime configuration that was not collected - is reported as not assessed, so an earlier end-of-life finding is not closed on missing evidence.

An unsupported Python branch no longer receives security fixes. Upgrade in this order: (1) choose the target from the finding's supported upgrade targets - a supported branch, not necessarily the newest - and check the application, its libraries and frameworks, and any agents or extensions against it; (2) build and test the application on the target, in a deployment slot or a non-production copy of the app; (3) deploy the target to a staging slot and validate the workload there (start-up, health checks, functional and integration tests, logs); (4) swap or switch production to the target and monitor it; (5) only then retire the old runtime and remove the slot or copy that still runs it. Keep the old configuration available until the new one is validated, so the change can be rolled back. A runtime should never be downgraded.

Impact and guidance: Applications that are not compatible with the target Python branch might be unable to run after the upgrade. Test and validate on the target before production is switched.

References

https://docs.microsoft.com/en-us/azure/app-service/web-sites-configure#general-settings

Ensure that Function Apps, API Apps, Web Apps use Managed identity.

Rule: appServices_appServicesUseManagedIdentity

For enhanced authentication security, use a managed identity. On Azure, managed identities eliminate the need for developers to have to manage credentials by providing an identity for the Azure resource in Entra ID and using it to obtain Entra ID tokens.

To create a managed identity for your function app: 1. Go to the App Service for your API app 2. Navigate to Platform features 3. Select Identity 4. Use System assigned or User assigned identity following the steps described in the help link. A system-assigned identity, a user-assigned identity, or both satisfy this control; only an app with neither is reported. A managed identity is only useful where the app authenticates to Azure resources - an app with no Azure dependencies does not need one created merely to satisfy this check.

References

https://aka.ms/managed-identity

Ensure that App Services Web Apps are not accessible by anybody from the Internet

Rule: appServices_webAppPublic

By default, your App Service Web App accepts requests from all IP addresses from the internet, but you can limit that access to a small subset of IP addresses.

Allow the clients that need the web app, rather than adding a deny-all rule first. Once any access restriction rule exists, App Service denies unmatched traffic, so: (1) identify every client - users or their egress addresses, front doors or gateways (by service tag), health probes and integrations; (2) add an Allow rule for each, at distinct priorities; (3) configure the advanced tools (SCM/Kudu) site's own rules, or set it to use the main site's rules, so deployment pipelines keep working; (4) confirm each client works and check the IPSecurity audit logs for unexpected denials. A Deny 0.0.0.0/0 rule at a lower priority number than the Allow rules would block every client, including the allowed ones. Private endpoints are an alternative for clients inside a virtual network; VNet integration controls the app's OUTBOUND traffic and does not restrict inbound access.

References

https://docs.microsoft.com/en-us/azure/app-service/overview-security#static-ip-restrictions

Ensure that App Services Web Apps have TLS/SSL certificates associated

Rule: appServices_webAppWithoutCert

It is recommended that all Azure App Services use a custom TLS/SSL certificate.

References

https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate
https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code

Ensure principals with code/deployment-configuration access to App Services and Function Apps do not have an unreviewed downstream privilege escalation path

Rule: attackPaths_appServiceCodeTakeover

A principal (user, service principal, or managed identity) holds effective permission to modify an App Service/Function App's code or deployment configuration. This lets the principal execute as the application's own managed identity, inheriting every downstream permission that identity holds.

Immediate Action: Enumerate every principal with Microsoft.Web/sites/config/write, publish/Action, or an equivalent wildcard on the application. Platform Policy: Require deployments to go through a reviewed CI/CD pipeline rather than direct portal/API access. Holistic Approach: Apply least-privilege to App Service/Function managed identities so code-level compromise of the application does not automatically compromise its downstream dependencies.

Impact and guidance: Modifying application code/configuration lets a principal execute as the application's managed identity, inheriting every downstream permission it holds - a complete application takeover, independent of any Azure RBAC role the principal holds on the application's actual downstream dependencies.

References

https://learn.microsoft.com/en-us/azure/app-service/deploy-configure-credentials
https://learn.microsoft.com/en-us/azure/app-service/security-recommendations

Ensure principals cannot obtain App Service and Function App secrets, publishing credentials or keys they do not need

Rule: attackPaths_appServiceCredentialExtraction

A principal (user, group, service principal or managed identity) holds effective Azure RBAC permission - from a built-in or custom role, assigned directly or inherited from a resource group, subscription or management group - to obtain a credential from an App Service or Function App. Each mechanism is assessed on its own: application settings and connection strings (Microsoft.Web/sites/config/list/Action) are reported as exposing a reusable secret only where ARGOS observed one, and as configuration access otherwise - Key Vault references, empty values and ordinary settings are not secrets; publishing credentials (config/list/Action or publishxml/Action) authenticate only while SCM or FTP basic authentication is enabled; function keys (functions/listkeys, functions/listsecrets) reach individual functions, while host keys (host/listkeys) reach every function and include the master key, which administers the Functions runtime; key writes (functions/keys/write, host/functionkeys/write, host/systemkeys/write) let the principal set a key of its own. Where the configuration or the basic-authentication setting was not collected, the step is reported as conditional and names what is missing. Deploying code through ARM is assessed separately.

Change access in an order that does not break the application. 1. Establish the replacement first: a Microsoft Entra identity (managed identity or OpenID Connect) for each deployment pipeline, Key Vault references or managed-identity authentication for each secret the app holds, Entra authentication or per-caller function keys for callers, and a least-privileged role for whoever administers the app. 2. Move every client, pipeline and caller to its replacement and confirm it works. 3. Only then remove or narrow the role assignment, disable SCM and FTP basic authentication, and rotate or renew every secret, publishing credential and key the principal could read - removing access does not un-expose a value already read, and revoking first stops whatever has not moved.

Impact and guidance: Depends on the mechanism: a reusable secret in the settings or connection strings gives access to the dependency it belongs to; usable publishing credentials let the principal deploy code and browse the file system; host keys call any function and the master key administers the Functions runtime; a function key calls only its function. Using a key also needs network access to the app, which this finding does not assess.

References

https://learn.microsoft.com/en-us/azure/app-service/deploy-configure-credentials
https://learn.microsoft.com/en-us/azure/app-service/configure-basic-auth-disable
https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references
https://learn.microsoft.com/en-us/azure/azure-functions/function-keys-how-to

Azure App Service managed identity has been found to have access to a Database

Rule: attackPaths_appServiceWithIdentityAccessToDatabase

An App Service has a managed identity assigned to it which has been found to have permissions to a database.

This rule focuses on identifying situations where an Azure App Service's managed identity has been granted permissions to access a database. Azure App Services, which are used to build and host web applications, often require access to databases for data storage and retrieval. While managed identities provide a secure and streamlined way to authenticate to databases without hardcoding credentials, it's crucial to manage these permissions judiciously. This rule detects instances where App Services might have direct access to databases, which is essential for operational functionality but could be risky if the access levels are not appropriately controlled or monitored. The goal is to ensure that App Services have only the permissions they need and no more, to minimize potential security risks.

Impact and guidance: The risk associated with this configuration is primarily around data security and integrity. If an Azure App Service or its identity is compromised, it could lead to unauthorized access to the database. Such access can result in various security incidents, such as data theft, unauthorized data modification, or even complete data destruction. In some cases, access to the database might also enable attackers to perform actions that could lead to privilege escalation within the Azure environment. Therefore, tight control and regular monitoring of database access permissions for App Services are critical to prevent potential exploitation and safeguard the database's confidentiality, integrity, and availability.

Azure App Service managed identity has been found to have access to a Key Vault

Rule: attackPaths_appServiceWithIdentityAccessToKeyVault

An App Service has a managed identity assigned to it which has been found to have permissions to a key vault.

This rule identifies scenarios where an Azure App Service is assigned a managed identity that has permissions to a Key Vault. Azure App Services often require access to secure resources like Key Vaults for storing and retrieving application secrets, certificates, and other sensitive data. Managed identities simplify this process by eliminating the need for credentials in the code. However, this convenience comes with the responsibility of ensuring that these identities are granted only the necessary level of access. The rule monitors for any such configurations where an App Service's identity has been given permissions to interact with Key Vaults, which, if misconfigured or overly permissive, can pose security risks.

Impact and guidance: The primary concern here is unauthorized access to sensitive data within the Key Vault. If the App Service or its identity is compromised, it could lead to potential data breaches. Attackers may gain access to critical secrets, keys, or certificates, which can be further used to escalate privileges or access other secured resources within the Azure environment. In worst-case scenarios, this could lead to data manipulation, data destruction, or broader system compromises. Ensuring that App Services have the minimum necessary permissions to Key Vaults, along with regular audits and monitoring, is vital to mitigate these risks and protect sensitive data.

Ensure that your Azure App Services are not configured with an identity with admin privileges

Rule: attackPaths_appServiceWithIdentityUsingAdminPrivileges

An App Service has a managed identity assigned to it which has been found to have administrative privileges. (Contributor, Owner, Role Based Access Control Administrator, User Access Administrator)

Immediate Action: Review and remove excessive administrative permissions from the App Service managed identity. Use Azure CLI: az role assignment list --assignee [PRINCIPAL-ID] to audit permissions, then az role assignment delete for administrative roles. Apply principle of least privilege with resource-specific permissions. Platform Policy: Implement Azure Policy 'Audit usage of custom RBAC roles' and create governance policies preventing assignment of administrative roles to App Service identities. Use Azure PIM for just-in-time administrative access when needed. Holistic Approach: Establish identity governance framework with regular access reviews for managed identities. Implement workload identity federation for secure service-to-service authentication. Use Azure RBAC conditions to enforce context-based access controls and implement Zero Trust principles for application security architecture.

Impact and guidance: If Azure Application Services are configured with administrative privileges, it increases the risk of unauthorized access, privilege escalation, and data breaches. Attackers can exploit these privileges to gain access to sensitive data and compromise the entire system.

References

https://docs.microsoft.com/en-us/azure/architecture/framework/security/design-identity-authorization#use-the-principle-of-least-privilege

Ensure principals with Run Command or extension-management access to Azure Arc-enabled servers do not have unreviewed privileged execution capability

Rule: attackPaths_arcServerPrivilegedExecution

A principal (user, service principal, or managed identity) holds effective permission to run Run Command or install/modify an extension on an Azure Arc-enabled server (Microsoft.HybridCompute/machines/runCommands/write, Microsoft.HybridCompute/machines/extensions/write, or an equivalent wildcard). Both operations execute arbitrary, privileged code on the server through the ARM control plane alone - no network access, SSH, or agent-level credentials are required. An Arc server can be managed within an Azure subscription/resource group while the workload itself runs entirely outside Azure, so this access effectively grants administration of infrastructure ARGOS cannot otherwise reach.

Immediate Action: Enumerate every principal with Microsoft.HybridCompute/machines/runCommands/write, .../extensions/write, or an equivalent wildcard on the Arc server. Platform Policy: Restrict Run Command and extension deployment on Arc-enabled servers to a small, audited set of operators, and prefer just-in-time access over standing role assignments. Holistic Approach: Treat Contributor-level (or broader) access to an Arc server as indirect server administration, consistent with Microsoft's own guidance.

Impact and guidance: Run Command and extensions both execute arbitrary code on the target server with the privileges of the Arc connected machine agent (typically SYSTEM/root) - a principal with this access can fully administer the server, independent of the server's own local authentication, and independent of whether the server is reachable from Azure at all.

References

https://learn.microsoft.com/en-us/azure/azure-arc/servers/security-overview
https://learn.microsoft.com/en-us/azure/azure-arc/servers/run-command

Ensure principals cannot delete role assignments or role definitions outside of a controlled process

Rule: attackPaths_azureIamRecordDestruction

A principal (user, service principal, or managed identity) holds an Azure role (built-in or custom) that grants the ability to delete role assignments or role definitions, or an equivalent wildcard permission, at a scope. This is destructive tampering with the IAM control plane's own integrity and audit trail - removing evidence of who was ever granted what - distinct from self-escalation (granting new privilege via write/create), since deletion alone cannot grant the principal anything new.

Immediate Action: Enumerate every role assignment whose role definition grants Microsoft.Authorization/roleAssignments/delete, Microsoft.Authorization/roleDefinitions/delete, Microsoft.Authorization/*, or '*' at the reported scope, including custom roles. Platform Policy: Restrict role-assignment/role-definition delete access to a small, audited set of identity-governance operators, separate from general RBAC administration. Enable Azure Activity Log alerting on role-assignment/role-definition deletion events. Holistic Approach: Treat IAM record deletion as equivalent to tampering with an audit trail - require a change-control process and retain activity-log exports independently of the resource being deleted.

Impact and guidance: Any principal that can delete role assignments or role definitions can erase the record of who was granted access and when, undermining incident investigation and compliance evidence, and can remove other principals' legitimate access as a denial-of-service or cover-up action.

References

https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

Ensure principals cannot write role assignments or role definitions outside of a controlled process

Rule: attackPaths_azureRbacSelfEscalation

A principal (user, service principal, or managed identity) holds an Azure role (built-in or custom) that grants the ability to write (create) role assignments - Microsoft.Authorization/roleAssignments/write, or an equivalent wildcard permission - at a scope. This lets the principal grant itself (or any other principal) additional privilege, including Owner or Contributor, without any additional exploitation step. A principal that can only DELETE a role assignment or role definition (no write/create ability) is a separate, destructive-integrity finding - see attackPaths_azureIamRecordDestruction. A principal that can only write ROLE DEFINITIONS (not role assignments) is a distinct, conditionally-provable escalation path - see attackPaths_azureRoleDefinitionSelfEscalation (confirmed) and attackPaths_azureRoleDefinitionGovernanceAccess (unconfirmed governance risk).

Immediate Action: Enumerate every role assignment whose role definition grants Microsoft.Authorization/roleAssignments/write, Microsoft.Authorization/*, or '*' at the reported scope, including custom roles - not just the built-in User Access Administrator/Owner/RBAC Administrator roles. Platform Policy: Use Azure PIM for just-in-time role-assignment write access with approval workflows. Restrict custom-role authoring so only a small, audited set of roles can grant this action. Holistic Approach: Separate the ability to assign privilege from the ability to use it (least-privilege identity governance). Alert on every new role-assignment write grant. Periodically re-run this rule's underlying permission evaluation, since a custom role's Actions/NotActions can change independently of its name.

Impact and guidance: Any principal that can write role assignments, or write role definitions, can grant itself (or a principal it controls) arbitrary additional privilege at the same scope - including a scope's Owner role - with no further exploitation required. This is a direct, self-contained privilege-escalation path independent of any specific built-in role name.

References

https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

Review broad Microsoft.Authorization/roleDefinitions/write access even without a confirmed exploitation target

Rule: attackPaths_azureRoleDefinitionGovernanceAccess

A principal (user, service principal, or managed identity) holds Microsoft.Authorization/roleDefinitions/write (or an equivalent wildcard) at a scope, but ARGOS could not identify a specific, currently-held custom role this principal could self-expand - either no covered custom-role holding exists today, or the only candidate(s) found are already Owner-equivalent (already covered by the Owner-equivalence rules). This is still a governance risk: a role could be created or assigned later that this access would then let the principal escalate through. Always reported at Indeterminate confidence, and never labeled as a confirmed self-escalation path - see attackPaths_azureRoleDefinitionSelfEscalation for the confirmed, provable case.

Immediate Action: Review why this principal holds broad role-definition write access and whether it is still required. Platform Policy: Restrict role-definition authoring to a small, audited set of identity-governance operators. Holistic Approach: Re-run this rule's underlying permission evaluation whenever custom roles are created or reassigned, since a newly-assigned custom role could turn this governance risk into a confirmed escalation path.

Impact and guidance: A principal with broad ability to redefine custom roles can escalate its own or others' privilege the moment it (or a principal it controls) is assigned any custom role within scope, even though no such assignment exists in today's inventory.

References

https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

Ensure principals with Contributor role are properly monitored

Rule: attackPaths_contributorRole

A principal (user, service principal, or managed identity) has been assigned the Contributor role, which can run commands on compute resources within reach that are assigned Managed Identities with permissions to other scopes, enabling privilege escalation.

Immediate Action: Review all principals with Contributor role assignments. Use Azure CLI: az role assignment list --role 'b24988ac-6180-42a0-ab88-20f7382dd24c' to audit assignments. Remove unnecessary role assignments and apply principle of least privilege. Platform Policy: Implement Azure Policy to monitor Contributor role assignments. Use Azure PIM for just-in-time elevated access. Holistic Approach: Replace broad Contributor assignments with specific resource-level permissions. Audit managed identities assigned to compute resources. Implement workload identity federation. Monitor for unusual compute resource activity and managed identity usage patterns.

Impact and guidance: Principals with Contributor role can leverage compute resources (Logic Apps, Automation Accounts, VMs, etc.) with Managed Identities to escalate privileges. For example, they can use Automation Accounts with MIs that have Contributor on other subscriptions, or Logic Apps with MIs that have MS Graph permissions, to impersonate these identities and gain access to resources beyond their direct permissions. Many privilege escalation paths are possible with different compute resource types.

References

https://aztier.com/#azure-tier-0
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#contributor

Ensure principals with control-plane write access to a legacy-access-policy Key Vault cannot self-grant secret access

Rule: attackPaths_keyVaultAccessPolicySelfGrant

A Key Vault is in legacy access-policy mode (RBAC authorization not enabled) and a principal holds control-plane write access to the vault (Microsoft.KeyVault/vaults/write or .../accessPolicies/write). Because access policies are a property of the vault resource itself in this mode, anyone who can write the vault can directly add themselves an access policy entry granting secret/key/certificate access - with no data-plane role assignment required at all.

Immediate Action: Migrate the vault to Azure RBAC authorization (EnableRbacAuthorization) so secret access is governed by role assignments instead of a vault-property array anyone with control-plane write can edit. Immediate Action (interim): Restrict Microsoft.KeyVault/vaults/write and accessPolicies/write to a small, audited set of vault owners. Platform Policy: Use Azure Policy to require RBAC authorization on all new vaults. Holistic Approach: Treat control-plane write access to any legacy-mode vault as equivalent to full secret access on that vault.

Impact and guidance: In legacy access-policy mode, Key Vault access control is just a property (accessPolicies) of the vault ARM resource. A principal with control-plane write access to the vault can add an access policy entry for themselves (or any other principal) with full get/list/set/delete permissions on secrets, keys, and certificates - achieving complete data-plane compromise through a control-plane permission that looks, at a glance, like ordinary resource management access.

References

https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide
https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy

Ensure principals cannot generate a downloadable SAS URL for a managed disk or snapshot outside of a controlled process

Rule: attackPaths_managedDiskSnapshotExport

A principal (user, service principal, or managed identity) holds effective permission to generate a time-limited download SAS URL for a managed disk or snapshot (Microsoft.Compute/disks/beginGetAccess/action or .../snapshots/beginGetAccess/action). This lets the principal download the full disk image - including any secrets, credentials, or sensitive data at rest on the volume - entirely outside of the running VM's own access controls.

Immediate Action: Enumerate every principal with beginGetAccess access to managed disks/snapshots, especially those attached to VMs holding sensitive data. Platform Policy: Restrict beginGetAccess to a small, audited set of backup/forensics operators; require disk exports to go through a reviewed, logged process. Holistic Approach: Enable disk encryption with customer-managed keys and network-restricted disk access (NetworkAccessPolicy/DiskAccessId) so an exported disk image is not usable without also compromising the encryption key/network boundary.

Impact and guidance: Exporting a managed disk or snapshot yields a complete, offline copy of everything on that volume - OS secrets, application configuration, cached credentials, and any data at rest - obtained entirely outside the VM's running-time access controls (no code execution on the VM required). This is a direct data-exfiltration path independent of any RBAC role the principal holds on the VM itself.

References

https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-private-links-for-import-export-portal
https://learn.microsoft.com/en-us/azure/virtual-machines/scripts/create-vm-generalized-managed-disk

Ensure no principal holds every permission needed to make a private VM reachable from the internet

Rule: attackPaths_networkExposureMutation

A principal (user, service principal, or managed identity) holds every permission one complete exposure sequence needs for a Virtual Machine that currently has no public IP address on any of its network interfaces: obtaining an address (publicIPAddresses/join/action on an existing unassociated address, or publicIPAddresses/write together with publicIPAddresses/join/action to create and attach a new one), rewriting the interface to carry it (networkInterfaces/write, which Azure also checks against virtualNetworks/subnets/join/action on the interface's subnet), and clearing every network security group in the way. Each sequence is reported as its own path; a network interface write on its own does not make a VM reachable and is not reported.

Immediate Action: Enumerate every principal with network-interface/NSG write access to VMs that are currently private. Restrict this access to a small, audited set of network operators, separate from general VM/resource-group Contributor access. Platform Policy: Use Azure Policy to deny public IP association on network interfaces attached to VMs that should remain private. Holistic Approach: Segment network-management permissions from compute-management permissions so that compromising a VM operator identity does not also grant the ability to re-expose network boundaries.

Impact and guidance: A principal holding a complete exposure sequence can give a private VM a public IP address and clear the network security groups in the way, turning a private VM into an internet-facing one - and, by extension, exposing every service running on it (including any downstream access reachable via the VM's own managed identity) to remote attackers.

References

https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/associate-public-ip-address-vm
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

Ensure principals with Owner role are properly monitored

Rule: attackPaths_ownerRole

A principal (user, service principal, or managed identity) has been assigned the Owner role, which includes all Contributor permissions and can additionally manage role assignments, enabling the same attack paths as Contributor plus the ability to grant themselves or others additional permissions.

Immediate Action: Review all principals with Owner role assignments. Use Azure CLI: az role assignment list --role '8e3af657-a8ff-443c-a75c-2fe8c4bcb635' to audit assignments. Remove unnecessary role assignments and apply strict governance. Platform Policy: Implement Azure Policy to monitor Owner role assignments. Use Azure PIM for just-in-time Owner access with approval workflows. Holistic Approach: Minimize Owner role assignments to absolute minimum required principals. Implement separation of duties between resource management and access management. Use custom roles with specific permissions instead of Owner where possible. Monitor all role assignment changes and managed identity activities.

Impact and guidance: Principals with Owner role have the combined risks of Contributor (privilege escalation via compute resources with managed identities) plus the ability to assign roles. This allows them to grant themselves Contributor or other roles to escalate privileges, or to modify role assignments to maintain persistence. This represents one of the highest privilege levels in Azure and should be strictly controlled.

References

https://aztier.com/#azure-tier-0
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#owner

Ensure principals cannot extract standing Service Bus shared access keys outside of a controlled process

Rule: attackPaths_serviceBusKeyExtraction

A principal (user, service principal, or managed identity) holds effective permission to list a Service Bus namespace's (or disaster-recovery alias's) authorization rule keys (Microsoft.ServiceBus/namespaces/AuthorizationRules/listKeys/action or the disasterRecoveryConfigs equivalent). This grants send/listen/manage access to every queue/topic in the namespace as configured by that authorization rule, bypassing Azure AD data-plane role assignments entirely.

Immediate Action: Enumerate every principal with AuthorizationRules/listKeys access to Service Bus namespaces. Disable local/SAS authentication (DisableLocalAuth=true) where the namespace's workloads support Azure AD data-plane auth instead. Platform Policy: Restrict listKeys to a small, audited set of operators; rotate shared access keys regularly and on any suspected exposure. Holistic Approach: Migrate to Azure AD data-plane authentication and Service Bus data-plane RBAC roles.

Impact and guidance: A Service Bus shared access key grants send/listen/manage access (per the authorization rule's configured rights) to every queue and topic in the namespace, independent of any Azure AD data-plane role assignment. A principal that can extract one can read, inject, or delete messages across the namespace.

References

https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-authentication-and-authorization
https://learn.microsoft.com/en-us/azure/service-bus-messaging/authenticate-application

Ensure principals cannot replace an Azure SQL logical server's Entra ID administrator outside of a controlled process

Rule: attackPaths_sqlEntraAdministratorReplacement

A principal (user, service principal, or managed identity) holds effective permission to write an Azure SQL logical server's administrator configuration (Microsoft.Sql/servers/administrators/write or the broader Microsoft.Sql/servers/write). This lets the principal designate themselves (or any other principal they control) as the server's Entra ID administrator, which grants full authentication and access to every database on the server.

Immediate Action: Enumerate every principal with servers/administrators/write or servers/write access to Azure SQL logical servers. Platform Policy: Restrict this action to a small, audited set of database platform owners, separate from general subscription/resource-group Contributor access. Alert on administrator changes. Holistic Approach: Use Azure AD-only authentication and PIM-gated, time-bound administrator assignment rather than a standing administrator principal.

Impact and guidance: The Entra ID administrator on an Azure SQL logical server can authenticate to and has full control over every database on that server. A principal that can replace this administrator grants themselves (or a principal they control) complete access to all data on the server, independent of any database-level permissions otherwise configured.

References

https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-configure
https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication

Ensure principals cannot extract standing Storage Account access keys or account-level SAS tokens outside of a controlled process

Rule: attackPaths_storageAccountKeyExtraction

A principal (user, service principal, or managed identity) holds effective permission to list a Storage Account's access keys (Microsoft.Storage/storageAccounts/listKeys/action) or generate an account-level SAS (.../listAccountSas/action). Either grants full data-plane access to every container/blob/queue/table in the account, bypassing any RBAC data-plane role assignments entirely.

Immediate Action: Enumerate every principal with listKeys/listAccountSas access to storage accounts. Disable shared-key authentication (AllowSharedKeyAccess=false) where the account's workloads support Azure AD data-plane auth instead. Platform Policy: Restrict listKeys/listAccountSas to a small, audited set of operators; rotate keys regularly and on any suspected exposure. Holistic Approach: Migrate to Azure AD (Entra ID) data-plane authentication and RBAC data roles so key extraction stops being a full-account-access shortcut.

Impact and guidance: A Storage Account access key or account-level SAS grants full read/write/delete access to every container, blob, queue, and table in the account - it is not scoped by any data-plane RBAC role assignment. A principal that can extract one has complete access to all data in the account regardless of what RBAC roles are otherwise configured.

References

https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage
https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent

Ensure principals with User Access Administrator role are properly monitored

Rule: attackPaths_userAccessAdministratorRole

A principal (user, service principal, or managed identity) has been assigned the User Access Administrator role, which can assign roles to principals. This enables them to assign themselves the Contributor role and follow the same attack path as Contributor.

Immediate Action: Review all principals with User Access Administrator role assignments. Use Azure CLI: az role assignment list --role '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9' to audit assignments. Remove unnecessary role assignments. Platform Policy: Implement Azure Policy to monitor User Access Administrator role assignments. Use Azure PIM for just-in-time access with approval workflows. Holistic Approach: Separate access management duties from resource management. Monitor all role assignment operations. Implement approval workflows for privilege escalation. Use custom roles with specific permissions where possible instead of User Access Administrator. Audit trail all role modifications.

Impact and guidance: Principals with User Access Administrator can assign themselves the Contributor role (or other roles with resource management permissions), enabling them to leverage compute resources with managed identities for privilege escalation. This effectively gives them an indirect path to all Contributor attack scenarios, plus the ability to grant access to other malicious actors or maintain persistence through role assignments.

References

https://aztier.com/#azure-tier-0
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator

Ensure principals with VM Run Command / extension-write access do not have a downstream privilege escalation path via the VM's managed identity

Rule: attackPaths_virtualMachineRunCommandExecution

A principal (user, service principal, or managed identity) holds effective permission to run arbitrary commands on a Virtual Machine (Microsoft.Compute/virtualMachines/runCommand/action, VM extension write, or an equivalent wildcard permission). Code executed this way runs as the VM's operating system user and can retrieve the VM managed identity's Azure AD token, inheriting every privilege that identity holds.

Immediate Action: Enumerate every principal with runCommand/extension-write access to VMs that have an exploitable managed identity (a system-assigned or user-assigned identity with meaningful downstream privilege). Restrict Microsoft.Compute/virtualMachines/runCommand/action and extension-write actions to a small, audited set of operators. Platform Policy: Use Azure PIM for just-in-time VM Contributor/Virtual Machine Contributor-equivalent access. Prefer Just-In-Time VM access and disable Run Command where not operationally required. Holistic Approach: Apply least-privilege to VM managed identities so that compromising VM code execution does not itself yield high-value downstream access. Monitor Run Command invocations and VM extension changes as high-signal security events.

Impact and guidance: Run Command (or an equivalent VM extension write) lets a principal execute arbitrary code as the VM's OS user, from which the VM's managed identity token is directly retrievable via the Azure Instance Metadata Service. Every downstream Azure permission that managed identity holds is therefore reachable by anyone who can run code on the VM, regardless of whether they hold any Azure RBAC role on the downstream resource itself.

References

https://learn.microsoft.com/en-us/azure/virtual-machines/run-command-overview
https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token

Azure VM managed identity has been found to have access to a Key Vault

Rule: attackPaths_vmWithIdentityAccessToKeyVault

A virtual machine has a managed identity assigned to it which has been found to have permissions to a key vault.

This rule identifies instances where an Azure Virtual Machine (VM) is assigned a managed identity that possesses access rights to a Key Vault. Managed identities for Azure resources provide an identity for applications to use when connecting to resources that support Entra ID authentication. When a VM with such an identity has permissions to access a Key Vault, it implies that the VM can potentially retrieve, update, or delete secrets, keys, and certificates stored in the vault. This scenario can be a part of regular operations but can also pose a security risk if not properly monitored and controlled, especially when the VM's managed identity has elevated privileges or the Key Vault contains sensitive or critical information.

Impact and guidance: The primary security concern arises from potential unauthorized access to sensitive data stored in the Key Vault. If the VM is compromised, attackers can leverage the VM's identity to gain access to the Key Vault. This could lead to data breaches, including the exposure of sensitive keys, secrets, or certificates. Additionally, if the VM's identity is overly privileged, it may enable attackers to manipulate vault contents, impacting data integrity. Proper oversight and restriction of these permissions are crucial to ensure that only authorized and necessary access is granted, reducing the risk of malicious activity and data exposure.

Ensure Azure Automation Account is not publicly accessible

Rule: automation_accountPubliclyAccessible

Disabling public network access improves security by ensuring that the resource isn't exposed on the public internet. You can limit exposure of your Automation account resources by creating private endpoints instead.

Restrict public access only after every caller has another path. In order: (1) identify what reaches the account publicly - webhook callers, Hybrid Runbook Workers, DSC nodes and administrators; (2) create private endpoints for the sub-resources they use (Webhook, DSCAndHybridWorker) and link the matching privatelink DNS zone to their networks; (3) confirm each caller resolves the account to the private address and works; (4) only then set publicNetworkAccess to false. Microsoft documents two limitations to check first: with public access disabled, Azure Monitor alerts cannot trigger an Automation webhook, and cloud jobs cannot reach resources secured by private endpoints - run those jobs on a Hybrid Runbook Worker instead. Platform Policy: 'Configure Automation accounts to disable public network access' can enforce the setting once the design is in place.

Impact and guidance: If public network access is enabled, your Azure Automation Account may be exposed to the public internet, increasing the risk of unauthorized access, data breaches, and potential security threats.

References

https://learn.microsoft.com/en-us/azure/automation/how-to/private-link-security

Ensure Azure Policy is configured to prevent public access to disks and snapshots

Rule: azurePolicy_diskSnapshotPublicAccessPolicy

Azure Policy should be in place to prevent public network access to managed disks and snapshots across the organization.

Deploy Azure Policy definitions that prevent users from enabling public access on disks and snapshots. This provides organization-wide protection against accidental public exposure.

Impact and guidance: May require updating existing workflows that rely on public disk/snapshot access.

References

https://docs.microsoft.com/en-us/azure/governance/policy/overview

Ensure local authentication methods are disabled for Azure AI Services

Rule: cognitiveServices_noLocalAuth

This rule checks if local authentication methods are disabled for Azure AI Services accounts. Disabling local authentication methods helps to enforce the use of Entra ID for authentication.

By disabling local authentication methods, you can ensure that access to Azure AI Services is restricted to more secure authentication mechanisms such as Entra ID tokens. This helps to protect your services from unauthorized access and potential security threats.

Impact and guidance: If local authentication methods are enabled, your Azure AI Services accounts may be exposed to less secure authentication methods, increasing the risk of unauthorized access and potential security breaches.

References

https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-openai-security-baseline#local-authentication-methods-for-data-plane-access
https://learn.microsoft.com/en-us/azure/ai-services/disable-local-auth
https://learn.microsoft.com/en-us/azure/ai-services/authentication?tabs=powershell#authenticate-with-an-access-token

Ensure that public network access to Azure AI Services is restricted.

Rule: cognitiveServices_publicAccess

Public accessibility exposes the Azure AI Services account to potential attacks, unauthorized usage, and data breaches. Restricting access minimizes the surface area for attacks and ensures that only authorized networks can access the service.

Ensure that the necessary virtual network configurations or IP rules are in place to allow access from required services once public access is restricted. Review the network access settings regularly to maintain a secure environment.

References

https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-virtual-networks?tabs=portal
https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-openai-security-baseline#ns-2-secure-cloud-services-with-network-controls

Ensure that the server's firewall is correctly configured.

Rule: databaseServices_postgresAllowAllServices

PostgreSQL server's firewall allows access to all Azure services (by default, this configuration is disabled). This option configures the firewall to allow all connections from Azure, including connections from the subscriptions of other customers. In order to reduce the potential attacks of a SQL server, firewall rules should be defined with more restricted IP addresses by referencing the range of addresses available for a specific SQL Server.

References

https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-firewall-rules

Ensure that 'AuditActionGroups' in 'auditing' policy for a SQL server is set properly

Rule: databaseServices_sqlAuditActionsAndGroupsSet

Configure the 'AuditActionGroups' property to appropriate groups to capture all the critical activities on the SQL Server and all the SQL databases hosted on the SQL server.

To capture all critical activities done on SQL Servers and databases within sql servers, auditing should be configured to capture appropriate 'AuditActionGroups'. Property AuditActionGroup should contain at least SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, BATCH_COMPLETED_GROUP to ensure comprehensive audit logging for SQL servers and SQL databases hosted on SQL Server.

References

https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-2017#database-level-audit-action-groups

Ensure that SQL server auditing to a storage account retains audit logs for 0 (unlimited) or at least 90 days

Rule: databaseServices_sqlAuditRetentionGreaterThan90

Auditing writes to a storage account whose retention deletes audit logs after fewer than 90 days. The retention setting governs the storage destination only: a retention of 0 means audit logs are kept indefinitely and is not a finding, a server that audits only to Log Analytics or Event Hubs has no storage retention to assess, and a server with auditing off is assessed by the auditing-enabled rule, not this one. 90 days is the threshold of CIS Microsoft Azure Foundations Benchmark v2.0.0 control 4.1.6 as Microsoft's policy for that control implements it (0, or 90 days or more); it is not a universal requirement, and a longer period may be required where regulations or investigation needs demand it. The facts are read from the server's auditingSettings, the resource the control's Microsoft policy reads; a stored record read from extendedAuditingSettings before that is not treated as evidence until the next inventory scan. A server whose auditing policy, destination or retention was not observed is reported as an incomplete assessment, not as a finding or a pass.

Audit logs support investigation of suspected breaches or misuse, which often begins weeks after the activity. Set the retention on the EXISTING storage destination to 90 days or more, or to the period your own requirements set if longer. Do not lower a retention of 0 (unlimited) to a fixed number of days, and do not replace or remove a working Log Analytics or Event Hubs destination to change this setting. If the storage account applies a time-based immutability policy, keep its retention interval shorter than the auditing retention; Microsoft does not support immutable storage with an auditing retention of 0.

Impact and guidance: Increasing retention keeps more audit blobs in the storage account, which increases storage cost. Changing retention applies only to logs written after the change.

References

https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-setup
https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview

Ensure that 'Auditing' is set to 'On' on Azure SQL

Rule: databaseServices_sqlAuditingEnabled

Server-level auditing is observed as Disabled on the SQL server. This is the predicate of Microsoft's 'Auditing on SQL server should be enabled' policy, which CIS Microsoft Azure Foundations Benchmark v2.0.0 control 4.1.1 uses: servers of kind analytics (Azure Synapse) are out of scope, and any destination - Storage, Log Analytics or Event Hubs - satisfies it. ARGOS reads the server's auditingSettings policy collected in inventory - the resource the Microsoft policy reads; a stored record read from extendedAuditingSettings before that is not treated as evidence until the next inventory scan. A server whose policy was not collected, could not be read, or reports a missing or unrecognised state is reported as not assessed, never as a finding or a pass, so an existing finding stays open until auditing is observed. Where the logs go and how long they are kept are assessed by separate rules.

Audit logs support investigation of suspected breaches or misuse. Enable server-level auditing without replacing a destination that already works. In order: (1) check whether the server - or its databases - already send audit logs somewhere, and keep any working destination; (2) choose the destination your requirements call for - a storage account (for long retention and immutability), a Log Analytics workspace (for querying and alerting) or Event Hubs (for streaming to a SIEM) - and confirm the server's identity or network path can write to it; (3) enable auditing on the server with that destination, adding it beside any existing one rather than replacing it (Azure Portal > SQL server > Auditing); (4) validate delivery: generate a test event and confirm it arrives at each destination; (5) set retention on a storage destination as the retention rule describes. ARGOS publishes no command, because the destination is a choice only you can make.

Impact and guidance: Auditing writes logs to the chosen destination, which incurs storage, ingestion or streaming costs there. ARGOS does not enable auditing automatically.

References

https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-auditing-on-sql-servers

Ensure that Entra ID Admin is configured on Azure SQL

Rule: databaseServices_sqlAzureAdAdminConfigured

Use Entra ID Authentication for authentication with SQL Database.

Entra ID authentication is a mechanism to connect to Microsoft Azure SQL Database and SQL Data Warehouse using identities in Entra ID. With EntraID authentication, identities of database users and other Microsoft services can be managed in one central location. Central ID management provides a single place to manage database users and simplifies permission management.

Impact and guidance: No negative impact.

References

https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure

Ensure that 'Data encryption' is set to 'On' on a SQL Database

Rule: databaseServices_sqlTdeEnabled

Enable Transparent Data Encryption on every SQL server.

Azure SQL Database transparent data encryption helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.

Impact and guidance: Free feature. No known impact to applications. Rollback available.

References

https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption-with-azure-sql-database

FTPS should be required in web apps

Rule: dfc_ftpsshouldberequiredinwebapps

Enable FTPS enforcement for enhanced security

To ensure enforcement of FTPS only for your web app: 1. Go to the App Service for your API app 2. Select Configuration, and go to the General Settings tab 3. In FTP state, select FTPS only.

References

https://aka.ms/deploy-ftp

Ensure public network access is disabled for Azure managed disks

Rule: disks_diskPublicAccessDisabled

Public network access to the managed disk is enabled, so it can be imported or exported through a SAS URI over its public endpoint. Disabling it restricts import and export to private endpoints; it does not affect a running VM's access to its own disk.

Public network access on a managed disk governs import and export - uploading or downloading it through a SAS URI - over the public endpoint; it does not affect a running VM's disk I/O. In order: (1) identify any process that exports or imports managed disks publicly - migrations, backup or forensic tooling, image pipelines; (2) where such a process must continue, give it a private path first - a disk access resource with a private endpoint - and confirm it works over that path, or restrict export with the network access policy (DenyAll) where no export is needed; (3) only then disable public network access (az disk update --name [DISK-NAME] --resource-group [RG] --public-network-access Disabled). Restricting who may generate a SAS (the beginGetAccess action) is a separate, complementary control.

Impact and guidance: Disabling public network access stops public import and export of the disk; processes that download or upload it through a SAS URI need a private endpoint path first.

References

https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-private-links-for-import-export-portal

Ensure at least two distinct active Owners per Azure subscription

Rule: iam_minimum1OwnerPerSubscription

Requires at least two distinct principals with active built-in Owner assignments at the subscription or a verified inherited scope. Multiple assignments held by one principal count once. PIM eligibility does not count as an active Owner. Fewer than two established Owners is a finding only when the assignment listing and inherited applicability evidence are complete; otherwise the result is Not Assessed. The legacy rule ID is retained for customer configuration and detection history.

Review recovery and administration responsibilities, then ensure two distinct approved principals have active Owner assignments that apply to the subscription. Apply least privilege and protect these identities. PIM-eligible assignments alone do not satisfy this specific Azure Policy initiative check. A technical owner count does not prove segregation of incompatible duties.

Impact and guidance: Zero or one active Owner fails the initiative minimum and can leave administrative continuity dependent on one principal.

References

https://docs.microsoft.com/en-us/azure/role-based-access-control/best-practices

Ensure that Azure System Managed Identity is using limited permissions to other Azure resources.

Rule: iam_overprivilegedSystemAssignedIdentity

ARGOS detected that this Azure System Managed Identity has permissions it should not have.

Immediate Action: Review and remove excessive permissions from this system managed identity. Use Azure CLI: az role assignment list --assignee [PRINCIPAL-ID] to audit current assignments, then az role assignment delete for administrative roles like Owner or Contributor. Apply principle of least privilege with resource-specific roles. Platform Policy: Implement Azure Policy 'Audit usage of custom RBAC roles' and create governance policies to prevent assignment of high-privilege roles to managed identities. Use Access Reviews for regular permissions auditing. Holistic Approach: Establish identity governance framework with Azure PIM for just-in-time administrative access, implement managed identity federation for service-to-service authentication, and use Azure RBAC conditions to enforce contextual access controls. Design workload identities with minimal permissions and regular access certification processes.

References

https://docs.microsoft.com/en-us/azure/role-based-access-control/best-practices

Ensure that Azure Resource Groups have Entra ID Groups applied.

Rule: iam_spnRbacOnRgGroupExists

Entra ID groups should be assigned to Azure Resource Groups with Contributor and Reader roles.

This rule checks that Entra ID Groups with Contributor and Reader role exist on an Azure Resource Group. It checks that exactly one group with Contributor and one group with Reader role exists.

Impact and guidance: Without Entra ID Groups assigned, there could be improper access controls leading to unauthorized access, potential data breaches, and non-compliance with security standards.

References

https://docs.microsoft.com/en-us/azure/role-based-access-control/best-practices
https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices

Ensure Role Based Access Control for Azure Key Vault is enabled

Rule: keyVault_rbacEnabled

RBAC should be enabled for Key Vault access control instead of vault access policies, providing more granular access control.

Enable RBAC authorization on Key Vaults and migrate from access policies. Navigate to Azure Portal > Key Vault > Access configuration > Permission model > Azure role-based access control. Use Azure CLI: az keyvault update --name <vault-name> --resource-group <rg> --enable-rbac-authorization true

Impact and guidance: Without RBAC, access policies may not provide sufficient granularity for access control.

References

https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide

Ensure the key vault is recoverable

Rule: miscellaneous_isRecoverable

The key vault contains object keys, secrets and certificates. Accidental unavailability of a key vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the key vault objects.

It is recommended the key vault be made recoverable by enabling the 'Do Not Purge' and 'Soft Delete' functions. This is in order to prevent loss of encrypted data including storage accounts, SQL databases, and/or dependent services provided by key vault objects (Keys, Secrets, Certificates) etc., as may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user.

Impact and guidance: Once purge-protection and soft-delete is enabled for a key vault, the action is irreversible.

References

https://docs.microsoft.com/en-us/azure/key-vault/key-vault-soft-delete-cli
https://blogs.technet.microsoft.com/kv/2017/05/10/azure-key-vault-recovery-options/

Ensure that Activity Logs are sent to Log Analytics

Rule: monitoring_activityLogsConnectedToLogAnalytics

For auditing and compliance reasons Azure Activity Logs should be stored for longer term in an Azure Log Analytics Workspace.

By default, Azure Monitor Activity Logs are only available for a limited time. For longer storage and the ability to search logs programmatically it is recommended to send these logs to an Azure Log Analytics workspace.

References

https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/quick-collect-activity-log-portal

Ensure that Network Watcher is 'Enabled'

Rule: networking_networkWatcherEnabled

Enable Network Watcher for Azure subscriptions.

Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.

Impact and guidance: No impact.

References

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

Ensure that RDP access is restricted from the internet

Rule: networking_rdpAccessRestrictedInternet

Disable RDP access on network security groups from the Internet.

The potential security problem with using RDP over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use a virtual machine as a launch point for compromising other machines on an Azure Virtual Network or even attack networked devices outside of Azure. If this rule is flagged as 'Exposed' by ARGOS then this means that this Network Security Group is either associated with an Azure Subnet or an Azure Network Interface Card (NIC) / VM which makes this misconfiguration potentially exploitable from the internet.

Impact and guidance: Remediating this deletes the whole violating rule from the Network Security Group. A rule with a port range or wildcard that covers RDP may also carry application traffic other workloads depend on: identify what uses the rule first, and prefer narrowing its source or ports (or replacing it with just-in-time or Bastion access) over deleting it. Rollback is available. Rollback currently does not support referencing 'Source Application Security Groups' and 'Destination Application Security Groups'. A rule overridden by a higher-priority rule in the same Network Security Group (for example a matching Deny) is not reported.

References

https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices#disable-rdpssh-access-to-azure-virtual-machines

Ensure that remote management access is restricted from the internet

Rule: networking_remoteManagementAccessRestrictedInternet

Disable remote management access on network security groups from the Internet.

The potential security problem with exposing remote management ports (5985/5986) over the Internet is that attackers can use various techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use a virtual machine as a launch point for compromising other machines on an Azure Virtual Network or even attack network devices outside of Azure. If this rule is flagged as 'Exposed' by ARGOS then this means that this Network Security Group is either associated with an Azure Subnet or an Azure Network Interface Card (NIC) / VM which makes this misconfiguration potentially exploitable from the internet.

Impact and guidance: Remediating this will remove the violating rule from the Network Security Group. This can have negative impact to the application. Rollback is available. Rollback currently does not support referencing 'Source Application Security Groups' and 'Destination Application Security Groups'.

References

https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices#disable-rdpssh-access-to-azure-virtual-machines

Ensure no Azure SQL server firewall rule admits every internet address (0.0.0.0 - 255.255.255.255) or every Azure service (0.0.0.0 - 0.0.0.0) while public network access is enabled

Rule: networking_sqlAccessRestrictedInternet

A server-level firewall rule admits a range broad enough to report: 0.0.0.0 - 255.255.255.255 admits every IPv4 address on the internet, and 0.0.0.0 - 0.0.0.0 (AllowAllWindowsAzureIps, 'Allow Azure services and resources to access this server') admits every Azure service, including services in other customers' subscriptions - not the internet. The finding names the rules and which of the two each is. A rule that merely starts at 0.0.0.0 is neither and is not reported. Firewall rules apply only to the server's public endpoint: a server whose publicNetworkAccess is observed as Disabled refuses every connection through it, so its rules are not reported. A server whose network access setting was not collected or has an unrecognised value (including SecuredByPerimeter, where a network security perimeter decides access) is reported as an incomplete assessment, never as a pass.

Add the replacement access before removing the broad rule. In order: (1) identify the clients that connect through it - for AllowAllWindowsAzureIps, the Azure services and resources that rely on it; (2) give each a narrower path - specific IP rules, virtual network rules, or a private endpoint with its privatelink DNS zone; (3) confirm each client connects; (4) only then delete the rule named in the finding (az sql server firewall-rule delete --name <rule-name> --resource-group [RG] --server [SERVER-NAME]). Removing it first disconnects every client that has not moved. Login and database permissions still decide who can authenticate.

Impact and guidance: Removing a broad rule disconnects every client that has no other allowed path. Removing AllowAllWindowsAzureIps also stops Azure services that connect without a virtual network or private endpoint path. ARGOS does not change firewall rules automatically.

References

https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure

Ensure that SSH access is restricted from the internet

Rule: networking_sshAccessRestrictedInternet

Disable SSH access on network security groups from the Internet.

The potential security problem with using SSH over the Internet is that attackers can use various brute force techniques to gain access to Azure Virtual Machines. Once the attackers gain access, they can use a virtual machine as a launch point for compromising other machines on an Azure Virtual Network or even attack networked devices outside of Azure. If this rule is flagged as 'Exposed' by ARGOS then this means that this Network Security Group is either associated with an Azure Subnet or an Azure Network Interface Card (NIC) / VM which makes this misconfiguration potentially exploitable from the internet.

Impact and guidance: Remediating this deletes the whole violating rule from the Network Security Group. A rule with a port range or wildcard that covers SSH may also carry application traffic other workloads depend on: identify what uses the rule first, and prefer narrowing its source or ports (or replacing it with just-in-time or Bastion access) over deleting it. Rollback is available. Rollback currently does not support referencing 'Source Application Security Groups' and 'Destination Application Security Groups'. A rule overridden by a higher-priority rule in the same Network Security Group (for example a matching Deny) is not reported.

References

https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices#disable-rdpssh-access-to-azure-virtual-machines

Ensure the Subnet has an NSG associated

Rule: networking_subnetWithoutNsg

Workload subnets should have a Network Security Group (NSG) associated. Platform subnets on which Azure does not support an NSG (GatewaySubnet, AzureFirewallSubnet, AzureFirewallManagementSubnet and RouteServerSubnet) are not assessed.

A subnet-level NSG is a segmentation baseline for controlling inbound and outbound traffic between workloads. Its absence is a segmentation-standard finding, not by itself proof that the subnet is reachable from the internet: network-interface NSGs, Azure Firewall, routing and public addresses determine actual exposure.

References

https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

Ensure that only secure connections are accepted on Azure Cache for Redis.

Rule: redis_redisOnlySecureConnections

Audit enabling of only connections via SSL to Azure Cache for Redis. Use of secure connections ensures authentication between the server and the service and protects data in transit from network layer attacks such as man-in-the-middle, eavesdropping, and session-hijacking.

References

https://docs.microsoft.com/en-us/azure/role-based-access-control/best-practices

Ensure that Diagnostic logs in Service Bus are enabled

Rule: serviceBus_diagnosticSettings

Enable logs and retain them for up to a year. This enables you to recreate activity trails for investigation purposes when a security incident occurs or your network is compromised.

To enable Service Bus diagnostics: 1. Go to the Service Bus. 2. Click Diagnostic settings and then click Turn on diagnostics. 3. Select one of the options to store the diagnostics logs and follow the instructions. Note : We recommend setting a retention for the logs. If you select the storage account option, make sure to set the retention to 1 year.

References

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=portal

Ensure public network access is restricted for Azure compute snapshots

Rule: snapshots_snapshotPublicAccessRestricted

Compute snapshots should have public network access disabled to prevent unauthorized access to sensitive data. Snapshots may contain complete copies of disk data and require strict access controls.

Public network access on a snapshot governs import and export - uploading or downloading it through a SAS URI - over the public endpoint; it does not affect a running VM's disk I/O. In order: (1) identify any process that exports or imports snapshots publicly - migrations, backup or forensic tooling, image pipelines; (2) where such a process must continue, give it a private path first - a disk access resource with a private endpoint - and confirm it works over that path, or restrict export with the network access policy (DenyAll) where no export is needed; (3) only then disable public network access (az snapshot update --name [SNAPSHOT-NAME] --resource-group [RG] --public-network-access Disabled). Restricting who may generate a SAS (the beginGetAccess action) is a separate, complementary control.

Impact and guidance: Restricting public access stops public export and import of the snapshot through a SAS URI; backup, migration or forensic processes that download snapshots that way need a private endpoint path first.

References

https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-private-links-for-import-export-portal

Ensure Storage logging is enabled for Blob service for read, write, and delete requests

Rule: storageAccounts_blobLoggingEnabled

These logs allow users to see the details of read, write, and delete operations against the blobs. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages.

Storage Analytics logs contain detailed information about successful and failed requests to a storage service. This information can be used to monitor individual requests and to diagnose issues with a storage service. Requests are logged on a best-effort basis. Storage Analytics logging is not enabled by default for your storage account.

Impact and guidance: Remediating this rule violation using below command line will enable logging for the Blob Service and retain logs for seven days.

References

https://docs.microsoft.com/en-us/rest/api/storageservices/enabling-storage-logging-and-accessing-log-data
https://docs.microsoft.com/en-us/rest/api/storageservices/about-storage-analytics-logging

Ensure blob versioning is enabled on Azure Blob Storage storage accounts

Rule: storageAccounts_blobVersioningEnabled

Blob versioning should be enabled to maintain previous versions of blobs for recovery purposes. This automatically maintains previous versions of blobs when they are modified or deleted.

Enable blob versioning on all storage accounts. Navigate to Azure Portal > Storage Account > Data Protection > Enable versioning for blobs. Use Azure CLI: az storage account blob-service-properties update --account-name <account-name> --resource-group <rg> --enable-versioning true

Impact and guidance: Without blob versioning, there is no way to recover previous versions of blobs when they are modified or overwritten.

References

https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview

Ensure soft delete for containers on Azure Blob Storage storage accounts is enabled

Rule: storageAccounts_containerSoftDeleteEnabled

Container soft delete should be enabled on storage accounts to protect against accidental container deletion. This provides the ability to recover deleted containers for a specified retention period.

Enable container soft delete on all storage accounts with a retention period of at least 7 days. Navigate to Azure Portal > Storage Account > Data Protection > Enable soft delete for containers. Use Azure CLI: az storage account blob-service-properties update --account-name <account-name> --resource-group <rg> --enable-container-delete-retention true --container-delete-retention-days 7

Impact and guidance: If container soft delete is not enabled, accidentally deleted containers and their contents cannot be recovered.

References

https://learn.microsoft.com/en-us/azure/storage/blobs/soft-delete-container-overview

Ensure cross-tenant replication is disabled on Azure Storage Accounts

Rule: storageAccounts_crossTenantReplicationDisabled

Cross-tenant replication should be disabled to prevent data from being replicated to external tenants, which could lead to data exposure.

Disable cross-tenant replication on all storage accounts. Navigate to Azure Portal > Storage Account > Configuration > Allow cross-tenant replication = Disabled. Use Azure CLI: az storage account update --name <account-name> --resource-group <rg> --allow-cross-tenant-replication false

Impact and guidance: If cross-tenant replication is enabled, data could be replicated to storage accounts in other Azure AD tenants, potentially exposing sensitive information.

References

https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-overview

Ensure default network access rule for Storage Accounts is set to deny

Rule: storageAccounts_defaultNetworkAccessDenied

Restricting default network access helps to provide a new layer of security, since storage accounts accept connections from clients on any network. To limit access to selected networks, the default action must be changed. ARGOS reports an account only while its public endpoint is open (public network access Enabled) and its firewall default action is Allow; an account with public network access Disabled, or governed by a network security perimeter, is not reported whatever its retained default action.

Deny by default only after every client is allowed another way. In order: (1) identify the clients that reach the account - applications, Azure services, pipelines and administrators (resource logs show them); (2) add a virtual network rule, IP rule or resource instance rule for each, or give it a private endpoint with its privatelink DNS zone; (3) confirm each client still works; (4) only then set the default action to Deny (az storage account update --name [STORAGE-NAME] --resource-group [RG] --default-action Deny). Setting Deny first blocks every client that is not yet allowed. Platform Policy: 'Storage accounts should restrict network access' can enforce the setting once the design is in place.

Impact and guidance: Remediating this rule violation will block access to this Storage Account from networks that are not explicitly allowed and can impact existing applications: identify the clients that need access and add their virtual network, IP or resource instance rules first. Automated remediation changes only the default action and preserves existing allowlist entries and the trusted-service bypass. Rollback restores the captured default action.

References

https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

Ensure storage accounts have immutable storage configurations to protect against ransomware attacks

Rule: storageAccounts_diskSnapshotSettingsProtected

Storage accounts should have immutable storage features enabled to protect against ransomware and other malicious data modifications. ImmutableStorageWithVersioning can only be configured during storage account creation and provides account-level time-based retention policies.

Enable immutable storage features to protect against ransomware attacks. For new storage accounts, create with ImmutableStorageWithVersioning enabled. Configure time-based retention policies and legal holds as appropriate.

Impact and guidance: Implementing restrictive access policies may affect storage flexibility and existing workflows. ImmutableStorageWithVersioning can only be enabled during storage account creation. Plan configuration changes carefully and test in non-production environments first.

References

https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview

Ensure soft delete for Azure File Shares is enabled

Rule: storageAccounts_fileSoftDeleteEnabled

Soft delete should be enabled for Azure File Shares to protect against accidental file share deletion.

Enable soft delete for file shares on storage accounts. Navigate to Azure Portal > Storage Account > File shares > Enable soft delete. Use Azure CLI: az storage account file-service-properties update --account-name <account-name> --resource-group <rg> --enable-delete-retention true --delete-retention-days 7

Impact and guidance: Without soft delete, accidentally deleted file shares cannot be recovered.

References

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-enable-soft-delete

Ensure TLS 1.2 is used on Storage Account

Rule: storageAccounts_minimumTls

Azure Storage sets the minimum TLS version to be version 1.0 by default. TLS 1.0 is a legacy version and has known vulnerabilities. This minimum TLS version can be configured to be later protocols such as TLS 1.2.

Communication between a client application and an Azure Storage account is encrypted using Transport Layer Security (TLS). TLS is a standard cryptographic protocol that ensures privacy and data integrity between clients and services over the Internet.

Impact and guidance: Remediating this detection will configure the Storage Account to enforce TLS Version 1.2

References

https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal

Ensure Storage logging is enabled for Queue service for read, write, and delete requests

Rule: storageAccounts_queueLoggingEnabled

These logs allow users to see the details of read, write, and delete operations against the queues. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages.

Impact and guidance: Remediating this rule violation will enable logging for the Queue Service.

References

https://docs.microsoft.com/en-us/rest/api/storageservices/enabling-storage-logging-and-accessing-log-data
https://docs.microsoft.com/en-us/rest/api/storageservices/about-storage-analytics-logging

Ensure that 'Secure transfer required' is set to 'Enabled'

Rule: storageAccounts_secureTransferRequired

Enable data encryption is transit

The secure transfer option enhances the security of a storage account by only allowing requests to the storage account by a secure connection. For example, when calling REST APIs to access storage accounts, the connection must use HTTPS. Because Azure storage doesn't support HTTPS for custom domain names, this option is not applied when using a custom domain name. If this detection is flagged as 'Exposed' then there are no Azure Storage Account Firewall rules configured restricting access to known networks and there is no Private Endpoint configured on the Account.

Impact and guidance: After remediation of this detection, any requests using HTTP will be rejected when 'secure transfer required' is enabled. When using the Azure files service, connection without encryption will fail, including scenarios using SMB 2.1, SMB 3.0 without encryption, and some flavors of the Linux SMB client. Rollback is available.

References

https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer
https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/azure/storage/#Account-enableHttpsTrafficOnly
https://www.terraform.io/docs/providers/azurerm/r/storage_account.html#enable_https_traffic_only

Ensure Storage logging is enabled for Table service for read, write, and delete requests

Rule: storageAccounts_tableLoggingEnabled

These logs allow users to see the details of read, write, and delete operations against the table. Storage Logging log entries contain the following information about individual requests: Timing information such as start time, end-to-end latency, and server latency, authentication details , concurrency information and the sizes of the request and response messages.

Impact and guidance: Remediating this rule violation using below command line will enable logging for the Table Service and retain logs for seven days.

References

https://docs.microsoft.com/en-us/rest/api/storageservices/enabling-storage-logging-and-accessing-log-data
https://docs.microsoft.com/en-us/rest/api/storageservices/about-storage-analytics-logging

Ensure that the endpoint protection for all Virtual Machines is installed

Rule: virtualMachines_endpointProtectionInstalled

Install endpoint protection for all virtual machines.

Installing endpoint protection systems (like Antimalware for Azure) provides for real-time protection capability that helps identify and remove viruses, spyware, and other malicious software, with configurable alerts when known malicious or unwanted software attempts to install itself or run on Azure systems.

References

https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection

Ensure that Azure VMs restrict RDP access from the internet

Rule: virtualMachines_rdpAccessRestrictedInternet

This VM's network security groups effectively admit RDP (TCP or UDP 3389) traffic from the internet. ARGOS evaluates the security group on each network interface and the one on that interface's own subnet together, in priority order, as Azure does: a packet is admitted only when both layers admit it, and an Allow rule overridden by a higher-priority Deny in the same group, or dropped by the other layer's group, admits nothing and is not reported. Each finding names an Allow rule on an exposed path (nsgName, nsgLayer); a path through both groups is reported once for each group's Allow rule. Only the security-group layer is assessed: whether the VM is actually reachable (a public IP address or a load-balancer rule) is not, so a reported VM without either is one configuration change away from exposure rather than exposed now. An internet-wide source ('*', 'Internet', '0.0.0.0/0', '::/0') is what counts as the internet; a path ARGOS cannot decide - a security group missing from inventory, a rule scoped by application security group - is reported as an incomplete assessment, never as a finding or a pass.

Remote management (RDP (TCP or UDP 3389)) exposed to the internet invites brute-force and credential attacks. Restrict the source to known addresses, or remove the internet path and use Azure Bastion, just-in-time VM access or a VPN. Because both the network interface's and the subnet's security groups must admit the traffic, closing either layer's Allow rule closes the path - but check the rule is not also needed by other workloads sharing that group before changing it.

Impact and guidance: Changing a security group rule changes access for every interface or subnet the group is associated with. ARGOS does not change this automatically: the previous automatic remediation deleted a single rule, which neither targeted the right security group reliably nor closed a path that another rule also opened.

References

https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices#disable-rdpssh-access-to-azure-virtual-machines

Ensure that Azure VMs restrict SSH access from the internet

Rule: virtualMachines_sshAccessRestrictedInternet

This VM's network security groups effectively admit SSH (TCP 22) traffic from the internet. ARGOS evaluates the security group on each network interface and the one on that interface's own subnet together, in priority order, as Azure does: a packet is admitted only when both layers admit it, and an Allow rule overridden by a higher-priority Deny in the same group, or dropped by the other layer's group, admits nothing and is not reported. Each finding names an Allow rule on an exposed path (nsgName, nsgLayer); a path through both groups is reported once for each group's Allow rule. Only the security-group layer is assessed: whether the VM is actually reachable (a public IP address or a load-balancer rule) is not, so a reported VM without either is one configuration change away from exposure rather than exposed now. An internet-wide source ('*', 'Internet', '0.0.0.0/0', '::/0') is what counts as the internet; a path ARGOS cannot decide - a security group missing from inventory, a rule scoped by application security group - is reported as an incomplete assessment, never as a finding or a pass.

Remote management (SSH (TCP 22)) exposed to the internet invites brute-force and credential attacks. Restrict the source to known addresses, or remove the internet path and use Azure Bastion, just-in-time VM access or a VPN. Because both the network interface's and the subnet's security groups must admit the traffic, closing either layer's Allow rule closes the path - but check the rule is not also needed by other workloads sharing that group before changing it.

References

https://docs.microsoft.com/en-us/azure/security/azure-security-network-security-best-practices#disable-rdpssh-access-to-azure-virtual-machines

Ensure that 'Unattached disks' are encrypted

Rule: virtualMachines_unattachedDisksEncrypted

Ensure that unattached disks in a subscription are encrypted.

Encrypting the IaaS VM's disks ensures that its entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads. Even if the disk is not attached to any of the VMs, there is always a risk where a compromised user account with administrative access to VM service can mount/attach these data disks which may lead to sensitive information disclosure and tampering.

References

https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption

Ensure that 'Orphaned disks' are removed

Rule: virtualMachines_unattachedManagedDisks

Ensure that unattached disks in a subscription are removed.

Even if the disk is not attached to any of the VMs, there is always a risk where a compromised user account with administrative access to VM service can mount/attach these data disks which may lead to sensitive information disclosure and tampering.

References

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/find-unattached-disks

Ensure that Azure VMs do not have a public IP associated with them.

Rule: virtualMachines_vmHasPublicIp

Assigning a Public IP to a Virtual Machine can pose a security risk if there is not also a Network Security Group associated with the VM's Network Interface Card (NIC) or the subnet the VM is in. There is no additional control available that would make a VM not accessible from the internet once a Public IP is associated.

By default, if a VM has a Public IP associated to its NIC and no Network Security Group is assigned to the NIC or Subnet then all traffic is allowed inbound to the VM. This exposes the whole Operating System on all ports to the internet. The resource is exposed if in addition to a Public IP the VM also has no NSG protecting the network flow.

References

https://www.microsoft.com/security/blog/2020/10/07/best-practices-for-defending-azure-virtual-machines/
https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/associate-public-ip-address-vm

Ensure every virtual machine network interface is filtered by a network security group that restricts inbound traffic

Rule: virtualMachines_vmWithoutEffectiveNsg

A virtual machine has a network interface that is not effectively protected by a network security group: either neither the interface nor the subnet its IP configuration is in has a network security group, or the security groups on the interface and subnet together allow every TCP and UDP port inbound from any internet source. Evaluated for every virtual machine whether or not ARGOS observed it to be reachable from the internet. Interfaces, subnets or security groups that were not collected, or rules ARGOS cannot evaluate (application security groups), are reported as not assessed rather than as compliant.

Associate a network security group with the virtual machine's subnet or network interface that denies inbound internet traffic by default and allows only the specific ports and source ranges the workload requires; remove 'allow any from Internet/*' inbound rules. This is the control behind Microsoft Cloud Security Benchmark NS-1 and the Azure Policy built-ins 'Internet-facing virtual machines should be protected with network security groups' and 'Non-internet-facing virtual machines should be protected with network security groups'. Azure Firewall or a network virtual appliance behind forced tunnelling, and the absence of a public IP address, reduce exposure but do not replace the network security group: the finding's score is lowered by one when no public IP and no reachability were observed, and raised when ARGOS's exposure probe reached the virtual machine. The attack path 'Unprotected Network Access to Azure VMs' (attackPaths_vmWithoutNsgOnNicOrSubnet) separately reports the subset of these virtual machines the probe actually reached.

Impact and guidance: Without an effective network security group nothing at the subnet or interface layer filters traffic that reaches the virtual machine, so any route from the internet or from a compromised neighbouring workload can reach every listening service on it.

References

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works
https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-1-establish-network-segmentation-boundaries
https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-networking

Windows Defender Exploit Guard should be enabled on machines

Rule: virtualMachines_windowsDefenderExploitGuard

Windows Defender Exploit Guard uses the Azure Policy Guest Configuration agent. Exploit Guard has four components that are designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks while enabling enterprises to balance their security risk and productivity requirements (Windows only).

This rule requires Guest Configuration agent. If this is detected then this can also mean that this VM does not have the Guest Configuration Agent installed.

References

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-controlled-folders
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction

Section 11

Continue in ARGOS

This summary is a point-in-time assessment dated 10 November 2026. Every link below opens ARGOS with this report's environments already selected, showing your current posture - including the detailed findings, remediation steps and attack-path diagrams this summary does not print.

View detailed findings
https://app.argos-security.io/detections?status=open&connectionInfo=56914835-2c07-4bdf-a088-72e94ee7eb82

Explore attack paths
https://app.argos-security.io/detections?status=open&exploitable=true&connectionInfo=56914835-2c07-4bdf-a088-72e94ee7eb82

Browse affected resources
https://app.argos-security.io/inventory?connectionInfo=56914835-2c07-4bdf-a088-72e94ee7eb82

Review compliance
https://app.argos-security.io/compliance?connectionInfo=56914835-2c07-4bdf-a088-72e94ee7eb82

Open Command Center
https://app.argos-security.io/command-center?connectionInfo=56914835-2c07-4bdf-a088-72e94ee7eb82