I have a few Azure boxes that I'm considering some PCI ramifications for. The boxes themselves are in good shape but I'm concerned about the portal. It can be used to reset passwords, manage firewalls, etc.

From my reading the Azure management console qualifies as 'non console admin access' and therefore should be restricted via multi-factor authentication.

Is my reading correct?

2 Answers 2


While I'm an not a PCI auditor, that seems reasonable to me. I'm not sure that it matters though, because good sense dictates that if Azure resources are part of your production environment, and particularly if they're storing sensitive data such as card data or PII, portal access should be protected with MFA. I would say this is a decision you make based on the fact that it's clearly the correct thing to do, and if it turns out to be important for your PCI certification, then you're already set.

Additionally, if it's helpful, Microsoft publishes an Azure PCI DSS Reponsiblity Matrix that can help you better understand what Azure resources provide in terms of PCI compliance, and which responsibilities are still yours.

  • Thanks Xander. I've looked at several of the documents out there before but not that particular one. Looking at 8.3 helps, but it still leaves some ambiguity as to whether or not the azure console is part of the CDE. Jun 7, 2017 at 18:04

Azure (at least some of DC's - you have to check which ones) are PCI DSS compliant (are PCI DSS certified). But what does it really mean? That it complies some requirements and some of them you must comply.

Multi factor authentication is just one of requirements you have to comply when you are logging to PCI DSS environment (as an admin of course). This would include access to the Azure portal or all VPN's you create and any other access you allow to the environment (such as SSH/RDP/whatever).

If you access your virtual machines using console (like SSH or RDP) it is also possible to set it up for multi factor authentication.

If you access these machines directly from the internet be prepared you will be asked to redesign it (i.e. using hop server, VPN, whatever else than direct access to management interfaces from the internet).

Believe me, I am pretty sure your boxes are not in "good shape" from PCI DSS perpective ;) Better said, the environment. Do you monitor, log, scan, analyze... and another x thousands things? :)

If you plan to pass the PCI DSS certification I would recommend you to study Azure security documents, PCI compliance, responsibility matrices... then ask Azure Support. You will need to study a lot of documents what is MS responsibility, what is yours and what you will need to comply with. Also I would recommend you to get in touch with some consultancy company taking care of PCI DSS to get help with it. Believe or not, its really hard to get everything in shape.

  • 2
    While this answer addresses various topics related to PCI compliance, none of them seem to be related to the question.
    – Xander
    Jun 6, 2017 at 16:00
  • Rly? This would include access to the Azure portal or all VPN's you create and any other access you allow to the environment (such as SSH/RDP/whatever).
    – Fis
    Jun 6, 2017 at 21:44
  • MOreover, here was one comment and it seems to be deleted now
    – Fis
    Jun 6, 2017 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .