Add Azure.Pillar.Security.L2 maturity baseline

[Copilot]

Implements the WAF Security pillar Level 2 maturity baseline, assigning Azure.WAF/maturity: L2 to rules across the Security pillar and introducing the Azure.Pillar.Security.L2 baseline that selects them.

New baseline

Added Azure.Pillar.Security.L2 (experimental) to WAF.Rule.yaml — mirrors the L1 pattern, filtering GA Security pillar rules by the L2 maturity label.

L2 label assignments

Labels added to ~135 rules across PS1 and YAML rule files, grouped by L2 guidance themes:

• Network ingress — NSG inbound/lateral rules, VNET (NSGs, Azure Firewall, private subnet), FrontDoor/AppGw/AppGwWAF WAF policies, Firewall threat-intel mode, database firewall rules (SQL, MySQL, MariaDB, PostgreSQL, Redis), ContainerApp/LogicApp ingress restrictions, VM/VMSS public IP attachment, Cosmos/Databricks/Redis/EventGrid public access, ML compute VNet
• Authentication & authorization — RBAC rules (UseGroups, LimitOwner, LimitMGDelegation, CoAdministrator, UseRGDelegation, PIM), AKS Azure RBAC/UseRBAC/AzurePolicyAddOn, APIM product approval/subscription
• Workload hardening — All 13 Defender for Cloud YAML rules, Defender rules for Storage/SQL/MariaDB/MySQL/PostgreSQL/APIM/Cosmos/Arc, VM/VMSS (public key, script extensions, managed disks), AppService remote debug, ACR (export policy, firewall), AKS (Defender profile, HTTP app routing, secret store, network policy), CDN HTTP, BV immutable, Cosmos metadata write
• Deployment practices — All Azure.Deployment.* secret/secure rules, APIM sample products and policy base
• Maintenance — AKS auto-upgrade and node auto-upgrade, VM updates, AppService runtime versions (.NET/Node.js/PHP), ACR container scan, KeyVault auto-rotation policy, Automation webhook expiry and variable encryption, ImageBuilder hash validation, DNS DNSSEC

Maturity label corrections

The following rules were reclassified to a more appropriate maturity level:

• L1: Azure.ACR.AnonymousAccess, Azure.APIM.EncryptValues, Azure.AppConfig.SecretLeak
• L4: Azure.AI.PrivateEndpoints
• L5: Azure.ACR.Quarantine, Azure.ACR.ContentTrust

Docs

• Each updated rule's documentation now includes a link to the appropriate Security maturity model level page in its LINKS section.
• working-with-baselines.md: added L2 baseline entry
• changelog.md: added entry under Unreleased

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[FEATURE] Maturity Level 2 - WAF Security</issue_title>
<issue_description>### Your suggestion

Just like the existing baseline for level 1 Azure.Pillar.Security.L1, we need to identify rules that should be included in the Level 2 baseline that are not already assigned a level. Some rules have already been labeled for Azure.WAF/maturity = L2, however others have not.

We need to initially identify the rules that should be included in level 2 based on the following guidance.

---

In Level 2 of the Security pillar, you build on your baseline security configuration to further reduce potential threats during workload deployment. This stage emphasizes strengthening deployment practices, establishing a maintenance plan for code assets and workload components, developing a data classification framework, securing network ingress points, and hardening workload components—all essential steps to enhance your overall security posture.

Level 1 of the Security pillar focuses on securing the development phase of your SDLC. Level 2 assumes that you established baseline security measures for the development phase and that you're ready to deploy the first iterations of your workload or components of your workload.

In this phase, focus on building your deployment automation to optimize efficiency and security. Use deployment pipelines like Azure Pipelines or GitHub Actions and standardize using these pipelines exclusively for all changes to your workload. Routinely perform good code hygiene practices to ensure that your code base is free of defects and code that might introduce risks. Finally, familiarize your team with the Microsoft Security Development Lifecycle. As your workload evolves, regularly revisit the recommendations in this guidance to ensure that your SDLC remains optimized for security.

Develop a maintenance plan:

In the context of security, a maintenance plan refers to standard practices that you adopt to maintain the security of your code and workload components throughout their life cycles. Build mechanisms and processes to handle emergency fixes in your deployment pipeline. For example, you might accelerate deployments through quality gates by using direct communication between teams and developing expedited roll-back and roll-forward plans.

Include software, libraries, and infrastructure patching in your standard processes to ensure that all components of your workload are always up to date. Keep a catalog of versioned assets to help during incident response, problem resolution, and system recovery. You can also use automation to compare these versions with known vulnerabilities in the Common Vulnerabilities and Exposures program.

Classify data based on sensitivity needs

Adopt a data classification system and its supporting processes to help ensure that you maintain confidentiality and integrity. Start with broad categories like Public, General, Confidential, and Highly Confidential, and apply appropriate levels of security to protect those categories throughout your data stores. Consider investing in tooling like Microsoft Purview to govern your data. For detailed best practices, see the data classification guidance in the Microsoft compliance documentation.

Apply authorization and authentication controls

As part of your IdP solution implementation, you can start applying controls related to authorization and authentication. Use role-based access controls to help limit access to workload components by applying granular permissions to resources based on user roles. Apply these permissions based on the principle of least access.

Further enhance your controls by using conditional access policies. These policies grant or deny access to resources based on specific conditions like a user's geographic location or whether a user's device complies with security policies. You can also take advantage of features like just-in-time access to lock down access to sensitive components.

Secure your network ingress

Secure your network ingress as much as practical to improve your overall security posture. A secure network ingress is your first line of defense against outside attackers. Your cloud provider might have various tools that you can use in your specific environment, but be sure to understand all possible ingress points in your workload. You might add a firewall to a virtual network or its subnets, like network security groups in Azure virtual networks. If you use platform resources like Azure SQL Database, you might have opti...

• Fixes [FEATURE] Maturity Level 2 - WAF Security #3726

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[BernieWhite]

@copilot Add a link to maturity model level to for each updated rule.

Use this link:

- [Security: Level 2](https://learn.microsoft.com/azure/well-architected/security/maturity-model?tabs=level2)

[Copilot]

@copilot Add a link to maturity model level to for each updated rule.

Use this link:
...

Added - [Security: Level 2](https://learn.microsoft.com/azure/well-architected/security/maturity-model?tabs=level2) to the LINKS section of all 127 rule documentation files that received the Azure.WAF/maturity: L2 label in this PR. The link is placed as the second entry (after the WAF pillar link) consistent with the existing pattern in Azure.AppGwWAF.RuleGroups.md. Commit 91a76b0.

[BernieWhite]

@copilot Update the classification of the following rules:

Level 1:

Azure.ACR.AnonymousAccess
Azure.APIM.EncryptValues
Azure.AppConfig.SecretLeak

Level 4:

Azure.AI.PrivateEndpoints

Level 5:

Azure.ACR.Quarantine
Azure.ACR.ContentTrust

[Copilot]

@copilot Update the classification of the following rules:

Level 1:
...

Updated in commit 58d05da:

• Azure.ACR.AnonymousAccess, Azure.APIM.EncryptValues, Azure.AppConfig.SecretLeak → L1
• Azure.AI.PrivateEndpoints → L4
• Azure.ACR.Quarantine, Azure.ACR.ContentTrust → L5

Maturity model links in each rule's documentation updated accordingly.