Demo data. Read-only, fixture Azure tenant. Nothing here can be changed.
Fixture Subscription
Last run 2026-09-09T03:27:45Z
Pass14
Fail45
Warn41
N/A45
Observed posture
24%
Collection completeness
100%
Accepted risk
0 check(s)
Effective posture
26%
(2 mitigated)
Freshness
2026-09-09T03:27:45Z
Audit readiness
Ready for the audit binder: automated checks plus manually tracked status and evidence. Mapped to, not certified against.
Identity
3 pass
9 fail
9 warn
Network
2 pass
6 fail
4 warn
Storage
2 pass
2 fail
5 warn
Data
2 pass
7 fail
1 warn
Logging
1 pass
3 fail
5 warn
Governance
0 pass
1 fail
2 warn
Compute
0 pass
3 fail
5 warn
Defender
0 pass
1 fail
1 warn
Microsoft Secure Score: 68.2% (Azure says).
ProofKit observed posture: 24%.
ProofKit effective posture with 2 compensating controls: 26%.
Secure Score only sees controls inside the tenant.
Microsoft 365: Entra baseline
4 pass
10 fail
9 warn
Microsoft 365: SharePoint and OneDrive
0 pass
3 fail
Microsoft 365: collected by script
0 pass
0 fail
45 n/a
Checks
From the run on 2026-09-09T03:27:45Z. Full run history › · Access reviews › · Policies › · Microsoft 365 › · Trust center ›
All checks
CIS Azure Foundations
SOC 2
HIPAA
HITRUST CSF
ISO/IEC 27001
NIST SP 800-171 r2 (CMMC Level 2)
NIST CSF 2.0
PCI DSS
CISA SCuBA M365
40 of 145 checks map to CIS Azure Foundations: 7 pass, 21 fail, 12 warn.
No audit target set for CIS Azure Foundations yet. · Scope
| Check | Family | Severity | Status | CIS Azure Foundations control | Affected |
|---|---|---|---|---|---|
| Users without MFA registered | identity | high | fail | CIS 1.1.3 | 3 |
| Conditional Access requires MFA | identity | high | pass | CIS 1.2.4 | |
| Security defaults or Conditional Access | identity | medium | warn | CIS 1.1.1 | 2 |
| Global Administrators without MFA | identity | high | fail | CIS 1.1.2 | 1 |
| Stale guest accounts | identity | low | warn | CIS 1.5 | 2 |
| Privileged role members without MFA registered | identity | high | fail | CIS 1.1.2 | 5 |
| Guests stale for 90 days or never signed in | identity | low | warn | CIS 1.5 | 2 |
| Security defaults or an effective Conditional Access MFA policy | identity | medium | pass | CIS 1.1.1 | |
| Banned password protection and lockout | identity | medium | fail | CIS 1.7 | 2 |
| NSGs open to the internet on management ports | network | high | fail | CIS 6.1 / 6.2 | 1 |
| VMs with a public IP | network | medium | warn | CIS 6.7 | 2 |
| Storage accounts open to the public network | network | high | fail | CIS 3.8 | 1 |
| SQL server firewall allows every IP | network | high | pass | CIS 4.1.2 | |
| Key vaults open to the public network | network | high | fail | CIS 8.7 | 1 |
| No Azure Bastion for VMs with a public IP | network | medium | warn | CIS 7.1 | 1 |
| App Service sites not HTTPS-only | network | high | fail | CIS 9.2 | 1 |
| App Service minimum TLS version below 1.2 | network | medium | fail | CIS 9.3 | 1 |
| App Service allows plain FTP | network | low | warn | CIS 9.10 | 1 |
| Anonymous blob access allowed | storage | high | fail | CIS 3.7 | 1 |
| Minimum TLS version below 1.2 | storage | medium | fail | CIS 3.15 | 1 |
| HTTPS not enforced | storage | high | pass | CIS 3.1 | |
| Blob soft delete disabled | storage | medium | pass | CIS 3.11 | |
| Public storage with no private endpoint | storage | low | warn | CIS 3.10 | 1 |
| SQL server auditing disabled | data | medium | fail | CIS 4.1.1 | 1 |
| Transparent data encryption disabled | data | high | pass | CIS 4.1.5 | |
| Defender for SQL disabled | data | medium | fail | CIS 4.2.1 | 1 |
| Key vault soft delete or purge protection off | data | high | fail | CIS 8.5 | 1 |
| Key vault has no diagnostic logging | data | medium | pass | CIS 5.1.5 | |
| SQL Vulnerability Assessment disabled | data | medium | fail | CIS 4.2.2 | 1 |
| PostgreSQL/MySQL do not require a secure connection | data | high | fail | CIS 4.3.1 / 4.4.1 | 1 |
| Activity log not exported | logging | medium | fail | CIS 5.1.1 | 1 |
| Azure says: Defender for Cloud plans on Free tier | logging | medium | warn | CIS 2.1.1 / 2.1.4 / 2.1.7 / 2.1.10 | 3 |
| No security contact configured | logging | low | fail | CIS 2.1.19 | 1 |
| NSGs without a flow log | logging | medium | warn | CIS 5.1.6 | 2 |
| Missing activity log alerts for key changes | logging | medium | fail | CIS 5.2.1-5.2.10 | 7 |
| Azure says: additional Defender for Cloud plans on Free tier | logging | medium | warn | CIS 2.1.2 / 2.1.8 / 2.1.11 / 2.1.12 | 2 |
| Custom roles granting unrestricted actions | governance | high | fail | CIS 1.23 | 1 |
| Sensitive resource groups without a lock | governance | low | warn | CIS 10.1 | 3 |
| VMs with unmanaged OS disks | compute | medium | fail | CIS 7.2 | 1 |
| Disks without customer-managed key encryption | compute | low | warn | CIS 7.3 | 1 |