Check your readiness
Cloud platform · Microsoft

Microsoft Azure settings for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Azure portal (paths checked against Microsoft Learn).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

Azure virtual machines and their network boundary are in scope for Cyber Essentials as IaaS. You must evidence network security groups that block unauthenticated inbound traffic, MFA on every Azure account, supported operating systems on each VM, critical updates within 14 days, anti-malware on Windows VMs and application allow listing on Linux VMs.

Key facts
Platform
Microsoft Azure (IaaS) (Microsoft)
Applies to
Azure portal (paths checked against Microsoft Learn)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
11 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Microsoft Azure (IaaS) for firewalls?

Apply 3 settings in Microsoft Azure (IaaS): keep inbound deny by default on every NSG, close public RDP and SSH and review NSG rules at least annually. Together they provide evidence for A4.7, A4.8, A5.4, A4.5 and A4.6.

For IaaS you are responsible for the boundary. Network security groups and Azure Firewall are the boundary firewall; the requirements describe this as data flow policies for cloud services. See the firewalls requirements for what the control asks.

  1. Keep inbound deny by default on every NSG

    A4.7A4.8
    Azure portal > Network security groups > select NSG > Inbound security rules > remove Any-to-Any allow rules; keep the default DenyAllInbound rule; put the business need and approver in each Allow rule's Description

  2. Close public RDP and SSH

    A4.8A5.4
    Microsoft Defender for Cloud > Recommendations > Management ports should be closed on your virtual machines; connect through Azure Bastion, or Just-in-time VM access (Defender for Servers Plan 2)

  3. Review NSG rules at least annually

    A4.5A4.6
    Azure portal > Network security groups > select NSG > Inbound security rules: export them (Export template, az network nsg rule list or an Azure Resource Graph query) and record the review date

A5: how do you configure Microsoft Azure (IaaS) for secure configuration?

Apply 2 settings in Microsoft Azure (IaaS): apply the security baseline and use unique local admin credentials per VM. Together they provide evidence for A5.1, A5.2, A5.3 and A7.2.

Default accounts, unnecessary roles and services on each VM. See the secure configuration requirements for what the control asks.

  1. Apply the security baseline

    A5.1A5.2A5.3
    Microsoft Defender for Cloud > Recommendations: filter to your virtual machines and remediate the security configuration (baseline) recommendations

  2. Use unique local admin credentials per VM

    A5.3A7.2
    Azure portal > Virtual machines > Create > Basics > Administrator account: a unique username and password per VM (Azure already rejects common names such as admin and administrator); prefer SSH keys for Linux and Microsoft Entra ID login for Windows

A6: how do you configure Microsoft Azure (IaaS) for security update management?

Apply 2 settings in Microsoft Azure (IaaS): enable periodic assessment and a patch schedule and retire unsupported OS images. Together they provide evidence for A6.4, A6.4.2, A6.1 and A2.7.

Azure Update Manager schedules and reports patching for Windows and Linux VMs. It is the evidence for A6.4 and A6.4.2. See the security update management requirements for what the control asks.

  1. Enable periodic assessment and a patch schedule

    A6.4AUTO-FAILA6.4.2
    Azure Update Manager > Machines > select machines > Update settings: Periodic assessment Enable, Patch orchestration Customer Managed Schedules; Schedule updates > create a maintenance configuration that includes the Critical and Security classifications, recurring weekly

  2. Retire unsupported OS images

    A6.1A2.7
    Azure portal > Virtual machines > add the Operating system column; replace Windows Server 2012 and 2012 R2 (Extended Security Updates ended 13 October 2026) and Ubuntu releases past standard support without Ubuntu Pro

A7: how do you configure Microsoft Azure (IaaS) for user access control?

Apply 2 settings in Microsoft Azure (IaaS): require MFA for Azure management and use least-privilege RBAC and PIM. Together they provide evidence for A7.16, A7.17, A7.5, A7.8 and A7.9.

Azure uses Entra ID, so the Microsoft 365 guide's MFA policies apply. Add role-based access control and privileged role reviews. See the user access control requirements for what the control asks.

  1. Require MFA for Azure management

    A7.16AUTO-FAILA7.17AUTO-FAIL
    Entra admin center > Entra ID > Conditional Access > Policies > New policy > Target resources > Resources > Select resources: Windows Azure Service Management API > Grant: Require multifactor authentication

    Microsoft's mandatory MFA covers sign-in to the Azure portal and, from its second phase (starting 1 October 2025), create, update and delete operations through Azure CLI, Azure PowerShell and the Resource Manager API. Your own policy is the evidence the assessor can see.

  2. Use least-privilege RBAC and PIM

    A7.5A7.8A7.9
    Azure portal > Subscriptions > Access control (IAM) > Role assignments: review Owner and Contributor; Privileged Identity Management > Azure resources: make Owner assignments eligible rather than active

A8: how do you configure Microsoft Azure (IaaS) for malware protection?

Apply 2 settings in Microsoft Azure (IaaS): enable Defender for Servers on Windows VMs and apply allow listing on Linux VMs. Together they provide evidence for A8.1, A8.2, A8.3, A8.4 and A8.5.

Requirements v3.3 allow anti-malware software only for Windows and macOS devices. Windows VMs use Defender for Servers; Linux VMs must use application allow listing. See the malware protection requirements for what the control asks.

  1. Enable Defender for Servers on Windows VMs

    A8.1A8.2A8.3
    Microsoft Defender for Cloud > Environment settings > subscription > Defender plans > Servers: On (Plan 1 or 2, which includes Defender for Endpoint)

  2. Apply allow listing on Linux VMs

    A8.1A8.4A8.5
    Install software only from signed, approved package repositories (apt or dnf with signed repos); remove sudo from everyday accounts so users cannot add other software; keep a list of approved packages

Which questions does this guide cover?

The 23 questions below are the ones Microsoft Azure (IaaS) can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A2.7Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers.A6: Retire unsupported OS images
A4.5Do you have a process to manage your firewall?A4: Review NSG rules at least annually
A4.6Have you reviewed your firewall rules in the last 12 months?A4: Review NSG rules at least annually
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Keep inbound deny by default on every NSG
A4.8Please describe how you approve and document your allowed inbound connections.A4: Keep inbound deny by default on every NSG; A4: Close public RDP and SSH
A5.1Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?A5: Apply the security baseline
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Apply the security baseline
A5.3Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials?A5: Apply the security baseline; A5: Use unique local admin credentials per VM
A5.4Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?A4: Close public RDP and SSH
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Retire unsupported OS images
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Enable periodic assessment and a patch schedule
A6.4.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?A6: Enable periodic assessment and a patch schedule
A7.16AUTO-FAILHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?A7: Require MFA for Azure management
A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?A7: Require MFA for Azure management
A7.2Are all your user and administrative accounts accessed by entering unique credentials?A5: Use unique local admin credentials per VM
A7.5Do you have a formal process for giving someone access to systems at an “administrator” level and can you describe this process?A7: Use least-privilege RBAC and PIM
A7.8Do you formally track which users have administrator accounts in your organisation?A7: Use least-privilege RBAC and PIM
A7.9Do you review who should have administrative access on a regular basis?A7: Use least-privilege RBAC and PIM
A8.1Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:A8: Enable Defender for Servers on Windows VMs; A8: Apply allow listing on Linux VMs
A8.2If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?A8: Enable Defender for Servers on Windows VMs
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Enable Defender for Servers on Windows VMs
A8.4If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?A8: Apply allow listing on Linux VMs
A8.5If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?A8: Apply allow listing on Linux VMs

What evidence should you keep for the assessor?

Keep the 4 dated records listed below for Microsoft Azure (IaaS). They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • NSG inbound rule export per VM with descriptions.
  • Azure Update Manager compliance report showing install dates.
  • Defender for Cloud recommendations export and the Defender plans page.
  • Conditional Access policy for Azure management and the RBAC role assignment export.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Cloud services are always in scope and cannot be excluded. For PaaS and SaaS, your responsibility is the user access control and the secure configuration you manage; Microsoft is responsible for patching the platform. For IaaS virtual machines you are responsible for all five controls on the VM.

No. Requirements v3.3 limit the anti-malware software option to Windows and macOS devices. Linux servers meet A8.1 through application allow listing: only approved, code-signed software from trusted repositories can be installed, and users cannot install anything else.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources