Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft security products and earn a digital badge by January 10!
Register nowThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
This security baseline applies guidance from the Microsoft cloud security benchmark version 1.0 to VPN Gateway. The Microsoft cloud security benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Microsoft cloud security benchmark and the related guidance applicable to VPN Gateway.
You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions will be listed in the Regulatory Compliance section of the Microsoft Defender for Cloud portal page.
When a feature has relevant Azure Policy Definitions, they are listed in this baseline to help you measure compliance with the Microsoft cloud security benchmark controls and recommendations. Some recommendations may require a paid Microsoft Defender plan to enable certain security scenarios.
Note
Features not applicable to VPN Gateway have been excluded. To see how VPN Gateway completely maps to the Microsoft cloud security benchmark, see the full VPN Gateway security baseline mapping file.
The security profile summarizes high-impact behaviors of VPN Gateway, which may result in increased security considerations.
Service Behavior Attribute | Value |
---|---|
Product Category | Networking |
Customer can access HOST / OS | No Access |
Service can be deployed into customer's virtual network | True |
Stores customer content at rest | False |
For more information, see the Microsoft cloud security benchmark: Network security.
Description: Service supports deployment into customer's private Virtual Network (VNet). Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
True | True | Microsoft |
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Reference: Tutorial: Create and manage a VPN gateway using the Azure portal
Description: Service network traffic respects Network Security Groups rule assignment on its subnets. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
True | True | Microsoft |
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Azure Policy built-in definitions - Microsoft.Network:
Name (Azure portal) |
Description | Effect(s) | Version (GitHub) |
---|---|---|---|
Subnets should be associated with a Network Security Group | Protect your subnet from potential threats by restricting access to it with a Network Security Group (NSG). NSGs contain a list of Access Control List (ACL) rules that allow or deny network traffic to your subnet. | AuditIfNotExists, Disabled | 3.0.0 |
Description: Service native IP filtering capability for filtering network traffic (not to be confused with NSG or Azure Firewall). Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Identity management.
Description: Service supports using Azure AD authentication for data plane access. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
True | False | Customer |
Configuration Guidance: Use Azure Active Directory (Azure AD) as the default authentication method to control your data plane access.
Reference: Configure an Azure AD tenant and P2S configuration for VPN Gateway P2S connections
Description: Data plane actions support authentication using managed identities. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: Data plane supports authentication using service principals. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: Data plane access can be controlled using Azure AD Conditional Access Policies. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
True | False | Customer |
Configuration Guidance: Define the applicable conditions and criteria for Azure Active Directory (Azure AD) conditional access in the workload. Consider common use cases such as blocking or granting access from specific locations, blocking risky sign-in behavior, or requiring organization-managed devices for specific applications.
Reference: Enable Azure AD Multi-Factor Authentication (MFA) for VPN users
Description: Data plane supports native use of Azure Key Vault for credential and secrets store. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Privileged access.
Description: Azure Role-Based Access Control (Azure RBAC) can be used to managed access to service's data plane actions. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
True | True | Microsoft |
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Description: Customer Lockbox can be used for Microsoft support access. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Data protection.
Description: Service supports data in-transit encryption for data plane. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
True | True | Microsoft |
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Reference: What is Azure VPN Gateway?
Description: Data at-rest encryption using platform keys is supported, any customer content at rest is encrypted with these Microsoft managed keys. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: The service supports Azure Key Vault integration for any customer keys, secrets, or certificates. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: The service supports Azure Key Vault integration for any customer certificates. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Asset management.
Description: Service configurations can be monitored and enforced via Azure Policy. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
True | False | Customer |
Feature notes: There are two policies defined:
Configuration Guidance: There is no current Microsoft guidance for this feature configuration. Please review and determine if your organization wants to configure this security feature.
Reference: Azure Policy built-in definitions for Azure networking services
For more information, see the Microsoft cloud security benchmark: Logging and threat detection.
Description: Service produces resource logs that can provide enhanced service-specific metrics and logging. The customer can configure these resource logs and send them to their own data sink like a storage account or log analytics workspace. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Backup and recovery.
Description: The service can be backed up by the Azure Backup service. Learn more.
Supported | Enabled By Default | Configuration Responsibility |
---|---|---|
False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft security products and earn a digital badge by January 10!
Register nowTraining
Module
Safeguard public sector data with Azure - Training
Conceptual introduction to data residency and sovereignty and overview of the options provided by Azure for public agencies to protect their data in the cloud.
Certification
Microsoft Certified: Azure Security Engineer Associate - Certifications
Demonstrate the skills needed to implement security controls, maintain an organization’s security posture, and identify and remediate security vulnerabilities.
Documentation
Get answers to frequently asked questions about VPN Gateway connections and configuration settings.
Azure VPN Gateway configuration settings
Learn about VPN Gateway resources and configuration settings.
Learn how to configure, create, and manage an Azure VPN gateway.