Cloud Security Benchmark v2 Assessment

These steps are optional. The assessment runs either way — if you don’t grant the access below, the related controls simply report “Not Assessed”. Grant it and baref00t assesses them too.

• Azure Security Reader role — recommended (read-only)

  Optional

  About a third of the Microsoft Cloud Security Benchmark covers Azure resources — Defender for Cloud, network security, data-service encryption, Key Vault. These live in Azure Resource Manager, NOT Microsoft Graph, so Entra admin consent does not reach them. Because this access is fully READ-ONLY (the Security Reader role cannot change anything), we recommend granting it so the assessment is complete. Grant it and baref00t assesses the Azure controls; skip it and they report "Not Assessed" (never failed or faked) — the Graph-based controls run regardless.

  Assign the built-in read-only "Security Reader" role to the baref00t MCSB application at each subscription you want assessed (Azure portal → Subscription → Access control (IAM) → Add role assignment → Security Reader → select the baref00t MCSB service principal), or run the Azure CLI below per subscription. This is read-only — Security Reader cannot change any resource. You can remove it any time.

  az role assignment create \
    --assignee "<baref00t-mcsb-app-id>" \
    --role "Security Reader" \
    --scope "/subscriptions/<subscription-id>"