Integration · Cloud & infrastructure

Microsoft Azure integration for continuous SOC 2, ISO 27001 & PCI DSS compliance

CATAAM connects to Microsoft Azure with read-only access and runs 29 automated checks against your real configuration. The results map to 17 controls across 12 frameworks, including SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

automated checks: 29
controls mapped: 17
frameworks: 12

What happens when you connect Microsoft Azure

Connect with read-only access
Add a read-only role, OAuth scope or API token for Microsoft Azure. The credential is encrypted at rest.
Discover assets
CATAAM pulls the accounts, users, repositories or devices it finds into one asset inventory.
Run 29 automated checks
Every check runs against your real configuration, then keeps running on a schedule.
Map results to 17 controls
Each result lands on the controls it proves — and counts for every framework that shares them.
Store evidence and raise issues
Passing checks become audit evidence. Failures show up for the control owner and can open a Jira issue.

The 29 checks CATAAM runs on Microsoft Azure

Each check runs against your real Microsoft Azure configuration and keeps running on a schedule. Check names are shown as they appear in the CATAAM platform.

ACR critical container vulnerabilities resolved
ACR high container vulnerabilities resolved
ACR low container vulnerabilities resolved
ACR medium container vulnerabilities resolved
Azure AD accounts deprovisioned when personnel leave
Azure AD password policy configured
Azure AD users inactive for 90 days disabled or removed
Azure Log Analytics workspace retention ≥ 365 days
Azure RBAC — no overprivileged subscription-level Owner assignments
Azure Storage diagnostic logs enabled
Azure Storage public network access blocked
Azure VM OS disk encryption enabled
Azure VM clock synchronization (NTP)
Azure activity logs enabled
Azure service principal credentials must not be older than 180 days
Azure storage accounts encrypted at rest
Azure user permissions managed via group membership
Defender for Cloud alert notifications configured
Global admin account not used for daily operations
Load balancer or Application Gateway in use
MFA enabled for all Azure AD users
MFA enforced for Azure Global Administrators
Microsoft Defender for Cloud enabled
NSG default deny — no inbound 0.0.0.0/0 rules
NSG flow logs enabled
Network segregation via multiple subnets
No direct user role assignments at subscription scope
Service principals used for automation tasks
Vulnerability scanning enabled on VMs

Controls these checks support (17)

A passing check becomes evidence for each control below, and counts for every framework that shares the control.

Control	Requirement	Frameworks
CRY-1	Unique production database authentication enforced	SOC 2, ISO 27001
CRY-4	Data encryption utilized	SOC 2, PCI DSS, NIST CSF, SOC 1, Australian Privacy Principles +1
CRY-5	Unique account authentication enforced	SOC 2
IAC-1	Production application access restricted	SOC 2, ISO 27001, SOC 1
IAC-8	Access revoked upon termination	SOC 2, ISO 27001, SOC 1
IAC-11	Password policy enforced	SOC 2, PCI DSS, SOC 1
IAC-12	Remote access MFA enforced	SOC 2, ISO 27001, PCI DSS, NIST CSF, SOC 1 +1
MON-1	Intrusion detection system utilized	SOC 2, PCI DSS, NIST CSF, COBIT 5
MON-2	Log management utilized	SOC 2, PCI DSS, NIST CSF, COBIT 5, ITIL
NET-4	Network firewalls utilized	SOC 2, ISO 27001, PCI DSS, NIST CSF, COBIT 5
OPS-1	Vulnerability and system monitoring procedures established	SOC 2, ISO 27001, NIST CSF, SOC 1, ITIL
VPM-1	Service infrastructure maintained	SOC 2, COBIT 5, ITIL
VPM-2	Vulnerabilities scanned and remediated	SOC 2, ISO 27001, PCI DSS, NIST CSF, Essential Eight +3
IAC-85	Remote access MFA enforced	GDPR, DPDP Act
IAC-89	Unique account authentication enforced	GDPR
THR-2	Intrusion detection system utilized	GDPR
TECH-11	Logging	ISO 27001

Microsoft Azure integration: frequently asked questions

What does CATAAM check in Microsoft Azure?

CATAAM runs 29 automated checks on Microsoft Azure, for example: ACR critical container vulnerabilities resolved; ACR high container vulnerabilities resolved; ACR low container vulnerabilities resolved; ACR medium container vulnerabilities resolved. The full list is on this page.

Which compliance frameworks does the Microsoft Azure integration support?

The Microsoft Azure checks map to 17 controls and count toward SOC 2, ISO 27001, PCI DSS, GDPR, NIST CSF, SOC 1.

Does CATAAM need write access to Microsoft Azure?

No. Connectors use read-only roles, scopes or API tokens, and credentials are encrypted at rest. The only optional write anywhere in CATAAM is opening Jira issues for failed checks.

How do I connect Microsoft Azure to CATAAM?

Add a read-only role, OAuth scope or API token for Microsoft Azure in CATAAM. CATAAM then discovers your assets, runs the checks and keeps running them on a schedule, storing each result as audit evidence.