Create an Azure VM baseline
Tags: azure, azuresecurity
Published: 2020-04-03 00:03:45

---
title: Create an Azure VM baseline
published: true
description: Create an Azure VM baseline
tags: #Azure , #AzureSecurity
---
Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements. Azure Policy meets this need by evaluating your resources for non-compliance with assigned policies. For example, you can have a policy to allow only a certain SKU size of virtual machines in your environment. Once this policy is implemented, new and existing resources are evaluated for compliance. With the right type of policy, existing resources can be brought into compliance.

**Azure networking security recommendations**
Here are the security recommendations you should follow to set Virtual Machine (VM) policies on your Azure subscription. Included with each recommendation are the basic steps to follow in the Azure portal. You should perform these steps on your own subscription with your own resources to validate the security for each. Keep in mind that Level 2 options might restrict some features or activity, so carefully consider which security options you decide to enforce.

### Ensure that OS disk are encrypted
Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. It uses the BitLocker feature of Windows and the DM-Crypt feature of Linux to provide volume encryption for the OS and data disks of Azure virtual machines (VMs). It is also integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets, and ensures that all data on the VM disks are encrypted at rest while in Azure storage. Azure Disk Encryption for Windows and Linux VMs is in General Availability in all Azure public regions and Azure Government regions for Standard VMs and VMs with Azure Premium Storage.

If you use Azure Security Center (recommended), you're alerted if you have VMs that aren't encrypted.

1.  In the Azure portal search for **KeyVault**.
2.  Select **Key Vault** and click **Create**.
3.  Enter the following details:
      - **Resource Group**: myResourceGroup
      - **Key vault name**: _Enter something unique_
      - **Region**: EastUS   
    ![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/tuct2topz89m9gkguk4k.png)

4.  Select the **Access policy** tab and select **Azure Disk Encryption** for volume encryption.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/02txkcchrk69j4nayo1g.png)
5.  Click **Review + create** then click **Create**.
6.  Wait for the deployment to complete before continuing.
7.  In the Azure portal select **Virtual machines**.
8.  Select **myVM** virtual machine.
9.  Under the **Settings** section select **Disks**.
10.  Notice the disk is not encrypted.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/tbyn0jxuhsjz7j4frj13.png)
11.  Click **Encryption**.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/pa8i4qwmsu9b7ok01wew.png)
12.  Select **OS & data disks** to be encrypted.
13.  Click **Select a key vault and key for encryption** and select your vault and click **Select**.
14.  Click **Save** and click **Yes** to confirm.

### Ensure only approved extensions are installed
Azure virtual machine (VM) extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs. For example, if a virtual machine requires software installation, anti-virus protection, or to run a script inside of it, a VM extension can be used. Azure VM extensions can be run with the Azure CLI, PowerShell, Azure Resource Manager templates, and the Azure portal. Extensions can be bundled with a new VM deployment, or run against any existing system.

1.  In the Azure portal select **Virtual machines**.
2.  Select **myVM** and then in the **Settings** section click **Extensions**.
3.  Ensure that the listed extensions are approved for use.
![Alt Text](https://thepracticaldev.s3.amazonaws.com/i/wp5f0ot09cjswamvtfju.png)