Azure.Pillar.OperationalExcellence#
Microsoft Azure Well-Architected Framework - Operational Excellence pillar specific baseline.
Rules#
The following rules are included within the Azure.Pillar.OperationalExcellence baseline.
This baseline includes a total of 100 rules.
| Name | Synopsis | Severity |
|---|---|---|
| Azure.ACR.Name | Container registry names should meet naming requirements. | Awareness |
| Azure.AKS.ContainerInsights | Enable Container insights to monitor AKS cluster workloads. | Important |
| Azure.AKS.DNSPrefix | Azure Kubernetes Service (AKS) cluster DNS prefix should meet naming requirements. | Awareness |
| Azure.AKS.Name | Azure Kubernetes Service (AKS) cluster names should meet naming requirements. | Awareness |
| Azure.AKS.PlatformLogs | AKS clusters should collect platform diagnostic logs to monitor the state of workloads. | Important |
| Azure.APIM.APIDescriptors | APIs should have a display name and description. | Awareness |
| Azure.APIM.MinAPIVersion | API Management instances should limit control plane API calls to API Management with version '2021-08-01' or newer. | Important |
| Azure.APIM.Name | API Management service names should meet naming requirements. | Awareness |
| Azure.APIM.ProductDescriptors | API Management products should have a display name and description. | Awareness |
| Azure.APIM.ProductTerms | Set legal terms for each product registered in API Management. | Important |
| Azure.APIM.SampleProducts | Remove starter and unlimited sample products. | Awareness |
| Azure.AppConfig.Name | App Configuration store names should meet naming requirements. | Awareness |
| Azure.AppGw.MigrateV2 | Use a Application Gateway v2 SKU. | Important |
| Azure.AppGw.MinSku | Application Gateway should use a minimum instance size of Medium. | Important |
| Azure.AppGw.Name | Application Gateways should meet naming requirements. | Awareness |
| Azure.AppInsights.Name | Azure Application Insights resources names should meet naming requirements. | Awareness |
| Azure.AppInsights.Workspace | Configure Application Insights resources to store data in a workspace. | Important |
| Azure.ASE.MigrateV3 | Use ASEv3 as replacement for the classic app service environment versions ASEv1 and ASEv2. | Important |
| Azure.ASG.Name | Application Security Group (ASG) names should meet naming requirements. | Awareness |
| Azure.Automation.PlatformLogs | Ensure automation account platform diagnostic logs are enabled. | Important |
| Azure.Bastion.Name | Bastion hosts should meet naming requirements. | Awareness |
| Azure.CDN.EndpointName | Azure CDN Endpoint names should meet naming requirements. | Awareness |
| Azure.ContainerApp.APIVersion | Migrate from retired API version to a supported version. | Important |
| Azure.ContainerApp.Name | Container Apps should meet naming requirements. | Awareness |
| Azure.Cosmos.AccountName | Cosmos DB account names should meet naming requirements. | Awareness |
| Azure.Deployment.Name | Nested deployments should meet naming requirements of deployments. | Awareness |
| Azure.Firewall.Name | Firewall names should meet naming requirements. | Awareness |
| Azure.Firewall.PolicyName | Firewall policy names should meet naming requirements. | Awareness |
| Azure.FrontDoor.Name | Front Door names should meet naming requirements. | Awareness |
| Azure.FrontDoor.WAF.Name | Front Door WAF policy names should meet naming requirements. | Awareness |
| Azure.Identity.UserAssignedName | Managed Identity names should meet naming requirements. | Awareness |
| Azure.KeyVault.KeyName | Key Vault Key names should meet naming requirements. | Awareness |
| Azure.KeyVault.Name | Key Vault names should meet naming requirements. | Awareness |
| Azure.KeyVault.SecretName | Key Vault Secret names should meet naming requirements. | Awareness |
| Azure.LB.Name | Load Balancer names should meet naming requirements. | Awareness |
| Azure.MariaDB.DatabaseName | Azure Database for MariaDB databases should meet naming requirements. | Awareness |
| Azure.MariaDB.FirewallRuleName | Azure Database for MariaDB firewall rules should meet naming requirements. | Awareness |
| Azure.MariaDB.ServerName | Azure Database for MariaDB servers should meet naming requirements. | Awareness |
| Azure.MariaDB.VNETRuleName | Azure Database for MariaDB VNET rules should meet naming requirements. | Awareness |
| Azure.MySQL.ServerName | Azure MySQL DB server names should meet naming requirements. | Awareness |
| Azure.NIC.Name | Network Interface (NIC) names should meet naming requirements. | Awareness |
| Azure.NIC.UniqueDns | Network interfaces (NICs) should inherit DNS from virtual networks. | Awareness |
| Azure.NSG.AKSRules | AKS Network Security Group (NSG) should not have custom rules. | Awareness |
| Azure.NSG.Name | Network Security Group (NSG) names should meet naming requirements. | Awareness |
| Azure.Policy.AssignmentAssignedBy | Policy assignments should use assignedBy metadata. | Awareness |
| Azure.Policy.AssignmentDescriptors | Policy assignments should use a display name and description. | Awareness |
| Azure.Policy.Descriptors | Policy and initiative definitions should use a display name, description, and category. | Awareness |
| Azure.Policy.ExemptionDescriptors | Policy exemptions should use a display name and description. | Awareness |
| Azure.PostgreSQL.ServerName | Azure PostgreSQL DB server names should meet naming requirements. | Awareness |
| Azure.PrivateEndpoint.Name | Private Endpoint names should meet naming requirements. | Awareness |
| Azure.PublicIP.DNSLabel | Public IP domain name labels should meet naming requirements. | Awareness |
| Azure.PublicIP.MigrateStandard | Use the Standard SKU for Public IP addresses as the Basic SKU will be retired. | Important |
| Azure.PublicIP.Name | Public IP names should meet naming requirements. | Awareness |
| Azure.ResourceGroup.Name | Resource Group names should meet naming requirements. | Awareness |
| Azure.Route.Name | Route table names should meet naming requirements. | Awareness |
| Azure.RSV.Name | Recovery Services vaults should meet naming requirements. | Awareness |
| Azure.Search.Name | AI Search service names should meet naming requirements. | Awareness |
| Azure.SignalR.Name | SignalR service instance names should meet naming requirements. | Awareness |
| Azure.SQL.DBName | Azure SQL Database names should meet naming requirements. | Awareness |
| Azure.SQL.FGName | Azure SQL failover group names should meet naming requirements. | Awareness |
| Azure.SQL.ServerName | Azure SQL logical server names should meet naming requirements. | Awareness |
| Azure.SQLMI.Name | SQL Managed Instance names should meet naming requirements. | Awareness |
| Azure.Storage.Name | Storage Account names should meet naming requirements. | Awareness |
| Azure.Template.DebugDeployment | Use default deployment detail level for nested deployments. | Awareness |
| Azure.Template.ExpressionLength | Template expressions should not exceed the maximum length. | Awareness |
| Azure.Template.LocationType | Location parameters should use a string value. | Important |
| Azure.Template.MetadataLink | Configure a metadata link for each parameter file. | Important |
| Azure.Template.ParameterDataTypes | Set the parameter default value to a value of the same type. | Important |
| Azure.Template.ParameterFile | Use ARM template parameter files that are valid. | Important |
| Azure.Template.ParameterMetadata | Set metadata descriptions in Azure Resource Manager (ARM) template for each parameter. | Awareness |
| Azure.Template.ParameterMinMaxValue | Template parameters minValue and maxValue constraints must be valid. | Important |
| Azure.Template.ParameterScheme | Use an Azure template parameter file schema with the https scheme. | Awareness |
| Azure.Template.ParameterStrongType | Set the parameter value to a value that matches the specified strong type. | Awareness |
| Azure.Template.ParameterValue | Specify a value for each parameter in template parameter files. | Awareness |
| Azure.Template.ResourceLocation | Resource locations should be an expression or global. | Awareness |
| Azure.Template.Resources | Each Azure Resource Manager (ARM) template file should deploy at least one resource. | Awareness |
| Azure.Template.TemplateFile | Use ARM template files that are valid. | Important |
| Azure.Template.TemplateSchema | Use a more recent version of the Azure template schema. | Awareness |
| Azure.Template.TemplateScheme | Use an Azure template file schema with the https scheme. | Awareness |
| Azure.Template.UseComments | Use comments for each resource in ARM template to communicate purpose. | Awareness |
| Azure.Template.UseDescriptions | Use descriptions for each resource in generated template(bicep, psarm, AzOps) to communicate purpose. | Awareness |
| Azure.Template.UseLocationParameter | Template should reference a location parameter to specify resource location. | Awareness |
| Azure.VM.Agent | Ensure the VM agent is provisioned automatically. | Important |
| Azure.VM.AMA | Use Azure Monitor Agent for collecting monitoring data from VMs. | Important |
| Azure.VM.ASName | Availability Set names should meet naming requirements. | Awareness |
| Azure.VM.ComputerName | Virtual Machine (VM) computer name should meet naming requirements. | Awareness |
| Azure.VM.DiskName | Managed Disk names should meet naming requirements. | Awareness |
| Azure.VM.MigrateAMA | Use Azure Monitor Agent as replacement for Log Analytics Agent. | Important |
| Azure.VM.Name | Virtual Machine (VM) names should meet naming requirements. | Awareness |
| Azure.VM.PPGName | Proximity Placement Group (PPG) names should meet naming requirements. | Awareness |
| Azure.VMSS.AMA | Use Azure Monitor Agent for collecting monitoring data from VM scale sets. | Important |
| Azure.VMSS.ComputerName | Virtual Machine Scale Set (VMSS) computer name should meet naming requirements. | Awareness |
| Azure.VMSS.MigrateAMA | Use Azure Monitor Agent as replacement for Log Analytics Agent. | Important |
| Azure.VMSS.Name | Virtual Machine Scale Set (VMSS) names should meet naming requirements. | Awareness |
| Azure.VNET.Name | Virtual Network (VNET) names should meet naming requirements. | Awareness |
| Azure.VNET.PeerState | VNET peering connections must be connected. | Important |
| Azure.VNET.SubnetName | Subnet names should meet naming requirements. | Awareness |
| Azure.VNG.ConnectionName | Virtual Network Gateway (VNG) connection names should meet naming requirements. | Awareness |
| Azure.VNG.Name | Virtual Network Gateway (VNG) names should meet naming requirements. | Awareness |
| Azure.vWAN.Name | Virtual WAN (vWAN) names should meet naming requirements. | Awareness |