Azure Security Benchmark v2 Missing Controls?

Question

After assigning the Azure Security Benchmark initiative to a brand new subscription, it seems to be missing control "IM-4 Use strong authentication controls for all Azure Active Directory based access", when viewing from Policy > Compliance > Azure Security Benchmark > Groups. This is true on multiple subscriptions. If you view the Azure Security Benchmark from the Regulatory Compliance blade menu in Security Center instead you will see the control listed.

Am I missing something or is this a bug?

Another thing I am noticing on an older subscription is if you've exempted all the policies in a particular control (for instance the Firewall policy in NS-5) the entire control will disappear from the Policy > Compliance menu. This is not ideal, is there any way to show it as "exempt" instead of just hiding it?

Answer 1

Hi @Buch, Tamara ,

I don't see an IM-4 policy with that name. You can see all the IM-4 related policy defs here.