Detections
Analytics

7.9 Ensure 'Authentication type' is Set to 'Azure Active Directory' only for Azure VPN Gateway Point-to-Site Configuration

Information

Enable only 'Azure Active Directory' (Microsoft Entra ID) authentication for Azure VPN Gateway point-to-site connections.

Microsoft Entra ID authentication provides strong security and centralized identity management, and reduces risks associated with static credentials and certificate management.

Solution

Remediate from Azure Portal

 - Go to Virtual network gateways.
 - Under VPN gateway, click VPN gateways.
 - Click the name of a VPN gateway.
 - Under Settings, click Point-to-site configuration.
 - Ensure Authentication type click to expand the drop-down menu.
 - Check the box next to Azure Active Directory, and uncheck the boxes next to Azure certificate and RADIUS authentication.
 - Provide a Tenant, Audience, and Issuer for the Azure Active Directory configuration.
 - Click Save.
 - Repeat steps 1-8 for each VPN gateway requiring remediation.

Impact:

Azure VPN Gateways incur hourly charges, with additional costs for point-to-site connections and data transfer. Pricing varies by SKU and usage. Refer to https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/ for details.

See Also

https://workbench.cisecurity.org/benchmarks/24282

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1), CSCv7|16.2

Plugin: microsoft_azure

Control ID: 647d7a79de5eb1cd35ad29106c72e59c24ef3d004c2eaaf5252d47f70c2051cc