Azure Sentinel alerts on non-compliant policy changes and applying the Microsoft Cloud Security Benchmark initiative.

Task 1: Create an Azure Sentinel Alert Rule for Policy Non-Compliance

To trigger an incident in Microsoft Sentinel whenever a critical Azure Policy compliance evaluation fails, build a KQL-based scheduled alert rule.

Step 1: KQL Query for Policy Failure Detection

Code snippet

PolicyStates
| where TimeGenerated > ago(1h)
| where ComplianceState == "NonCompliant"
| extend HostName = tostring(split(ResourceId, "/")[-1]),
         ResourceGroup = tostring(split(ResourceId, "/")[4]),
         SubscriptionId = tostring(split(ResourceId, "/")[2])
| project TimeGenerated, SubscriptionId, ResourceGroup, HostName, ResourceId, PolicyAssignmentName, PolicyDefinitionName, ComplianceState

Step 2: Configure Sentinel Scheduled Alert Rule via Azure CLI

Bash

az sentinel alert-rule create \
  --resource-group "rg-security-ops" \
  --workspace-name "law-sentinel-core" \
  --rule-id "policy-noncompliant-alert" \
  --scheduled \
  --display-name "High Severity: Azure Policy Non-Compliance Detected" \
  --description "Triggers a Sentinel incident when an Azure resource fails policy compliance checks." \
  --severity "High" \
  --enabled true \
  --query "$KQL_QUERY" \
  --query-frequency "PT1H" \
  --query-period "PT1H" \
  --trigger-operator "GreaterThan" \
  --trigger-threshold 0

Task 2: Assign the Microsoft Cloud Security Benchmark (MCSB) Initiative

The Microsoft Cloud Security Benchmark (MCSB) is a comprehensive security baseline containing hundreds of built-in policy definitions mapped to frameworks like CIS, NIST, and PCI-DSS.

Step 1: Locate the Built-in MCSB Initiative Definition ID

The canonical definition ID for the MCSB initiative across all standard Azure subscriptions is:

/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da3b374e12

Step 2: Assign MCSB via Azure CLI

Assign the full security benchmark across your subscription:

Bash

az policy assignment create \
  --name "assign-mcsb-baseline" \
  --display-name "Microsoft Cloud Security Benchmark v2" \
  --policy-set-definition "1f3afdf9-d0c9-4c3d-847f-89da3b374e12" \
  --scope "/subscriptions/YOUR_SUBSCRIPTION_ID" \
  --mi-system-assigned \
  --location "eastus"

Note: Standard policy assignments that utilize DeployIfNotExists or Modify effects within the MCSB require a System-Assigned Managed Identity (--mi-system-assigned) to execute automated remediation tasks across the subscription scope.

Step 3: Verify MCSB Compliance via Portal or CLI

Check the aggregated compliance status across all benchmark controls:

Bash

az policy state summarize \
  --filter "policyAssignmentName eq 'assign-mcsb-baseline'" \
  --output json