rules/findings/azure/Networking/azure-vpn-gateway-missing-entra-only-authentication.json

{
    "provider": "Azure",
    "serviceType": "Networking Services",
    "serviceName": "Networking Services",
    "displayName": "Ensure 'Authentication type' is set to 'Azure Active Directory' only for Azure VPN Gateway point-to-site configuration",
    "description": "Enable only 'Azure Active Directory' (Microsoft Entra ID) authentication for Azure VPN Gateway point-to-site connections.",
    "rationale": "Microsoft Entra ID authentication provides strong security and centralized identity management, and reduces risks associated with static credentials and certificate management.",
    "impact": "Azure VPN Gateways incur hourly charges, with additional costs for point-to-site connections and data transfer. Pricing varies by SKU and usage. Refer to https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/ for details.",
    "remediation": {
        "text": "Remediate from Azure Portal 1. Go to Virtual network gateways. 2. Under VPN gateway, click VPN gateways. 3. Click the name of a VPN gateway. 4. Under Settings, click Point-to-site configuration. 5. Ensure Authentication type click to expand the drop-down menu. 6. Check the box next to Azure Active Directory, and uncheck the boxes next to Azure certificate and RADIUS authentication. 7. Provide a Tenant, Audience, and Issuer for the Azure Active Directory configuration. 8. Click Save. 9. Repeat steps 1-8 for each VPN gateway requiring remediation.",
        "code": {
            "powerShell": null,
            "iac": null,
            "terraform": null,
            "other": null
        }
    },
    "recommendation": null,
    "references": [
        "https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways",
        "https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway",
        "https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant"
    ],
    "compliance": [
        {
            "name": "CIS Microsoft Azure Foundations",
            "version": "5.0.0",
            "reference": "7.9",
            "profile": [
                "Level 2"
            ]
        }
    ],
    "level": "medium",
    "tags": [],
    "rule": {
        "path": "",
        "subPath": null,
        "selectCondition": {},
        "query": [
        ],
        "shouldExist": null,
        "returnObject": null,
        "removeIfNotExists": null
    },
    "output": {
        "html": {
            "data": {
                "properties": {},
                "expandObject": null
            },
            "table": "default",
            "decorate": [],
            "emphasis": [],
            "actions": {
                "objectData": {
                    "properties": [],
                    "expandObject": null,
                    "limit": null
                },
                "showGoToButton": "True",
                "showModalButton": "True",
                "directLink": null
            }
        },
        "text": {
            "data": {
                "properties": {},
                "expandObject": null
            },
            "status": {
                "keyName": [],
                "message": "",
                "defaultMessage": null
            },
            "properties": {
                "resourceName": null,
                "resourceId": null,
                "resourceType": null
            },
            "onlyStatus": false
        }
    },
    "idSuffix": "",
    "notes": [],
    "categories": [],
    "immutable_properties": [],
    "id": "azure_networking_005"
}