Azure Compliance mod v2.5.0 - Added ad_user_mfa_enabled, monitor_diagnostic_settings_exists_for_subscription, storage_account_access_keys_periodically_regenerated controls

Feb 03, 2026powerpipe

Dependencies

  • Azure plugin v1.12.0 or higher is now required. (#359)

Enhancements

  • Added new automated query implementations for the following Azure CIS v5.0.0 controls: (#359)
    • cis_v500_5_1_2 - Ensure that multifactor authentication is enabled for all users
    • cis_v500_6_1_1_1 - Ensure that a Diagnostic Setting exists for Subscription Activity Logs
    • cis_v500_9_3_1_2 - Ensure that Storage Account access keys are periodically regenerated
  • Added the following controls to All Azure Compliance Controls benchmark: (#359)
    • ad_user_mfa_enabled
    • monitor_diagnostic_settings_exists_for_subscription
    • storage_account_access_keys_periodically_regenerated

Bug fixes

  • Fixed storage_account_access_keys_periodically_regenerated query to correctly handle storage accounts without access keys. (#362)
  • Fixed storage_account_file_share_soft_delete_enabled query to handle null values correctly. (#360) (Thanks @KingBrewer for the contribution!)