rules/findings/azure/Networking/azure-vpn-gateway-missing-entra-only-authentication.json
|
{
"provider": "Azure", "serviceType": "Networking Services", "serviceName": "Networking Services", "displayName": "Ensure \u0027Authentication type\u0027 is set to \u0027Azure Active Directory\u0027 only for Azure VPN Gateway point-to-site configuration", "description": "Enable only \u0027Azure Active Directory\u0027 (Microsoft Entra ID) authentication for Azure VPN Gateway point-to-site connections.", "rationale": "Microsoft Entra ID authentication provides strong security and centralized identity management, and reduces risks associated with static credentials and certificate management.", "impact": "Azure VPN Gateways incur hourly charges, with additional costs for point-to-site connections and data transfer. Pricing varies by SKU and usage. Refer to https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/ for details.", "remediation": { "text": "Remediate from Azure Portal 1. Go to Virtual network gateways. 2. Under VPN gateway, click VPN gateways. 3. Click the name of a VPN gateway. 4. Under Settings, click Point-to-site configuration. 5. Ensure Authentication type click to expand the drop-down menu. 6. Check the box next to Azure Active Directory, and uncheck the boxes next to Azure certificate and RADIUS authentication. 7. Provide a Tenant, Audience, and Issuer for the Azure Active Directory configuration. 8. Click Save. 9. Repeat steps 1-8 for each VPN gateway requiring remediation.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways", "https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-gateway", "https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "7.9", "profile": [ "Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [], "message": "", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "", "notes": [], "categories": [], "immutableProperties": [], "id": "azure_networking_005" } |