Azure Security Best Practices

Introduce software security and clarify what security truly means beyond fake identities, DDoS, and identity theft, guiding learners to understand the essence of security.

Identify what to protect against with software security: data loss, disruption of service, data leak, and data inconsistency, illustrated by real-world hacker incidents.

Learn essential software security terminology, including threat, attack, vulnerability, authentication, and authorization, with examples like SQL injection and DDoS, to align security discussions for software architects.

Learn how security responsibility spans the entire organization, from the CIO and CISO to architects, developers, and QA, with every role contributing to secure software.

Explore how cloud security contrasts with on-premises, identify service-varying risks and challenges, and apply mitigations for virtual machines and databases.

Explore cloud security challenges of internet exposure, large attack surface, and misconfiguration, plus cost-driven security tradeoffs. Learn to secure resources with web application firewall, multifactor authentication, and private endpoints.

Explore securing cloud services by configuring networking and identity, focusing on virtual machines, app services, and databases. Learn why monitoring and policy do not have networking connectivity and are discussed.

Activate the Azure AD premium P2 trial to explore paid features. The 30-day trial includes 100 users and is free, upgrading the license from free to premium.

Explore how multi-factor authentication, using factors like something you know, something you have, or something you are, strengthens Azure AD security by configuring MFA through conditional access grants.

Configure conditional access and multi-factor authentication in azure ad by disabling security defaults, applying an all-users policy to the azure portal, and requiring MFA for access.

Configure and test multi-factor authentication for the Azure portal using the Microsoft Authenticator app, including QR code setup and approval steps to strengthen security.

Learn the differences between Azure AD roles and Azure roles, their predefined permissions, and why least-privilege access and avoiding global administrator boost Azure identity security.

Explore how to view, assign, and manage Azure AD roles—from global administrator to user administrator—through practical steps in the Azure portal, with a note on MFA policies.

Explore how Azure roles define access to resources, with base roles like owner, contributor, and reader, and how scope inheritance overrides permissions across management groups, subscriptions, and resource groups.

Demonstrates assigning a contributor role to a user on a resource group, detailing scope and inheritance, and distinguishing Azure AD roles from Azure roles for secure access.

Understand managed identities in Azure, enabling services to authenticate to resources via Azure AD. Compare system assigned identities tied to a resource with user assigned identities usable across resources.

Demonstrate configuring a system-assigned managed identity on an Azure app service, then locate and review its application and resource identifiers in Azure Active Directory and enterprise applications.

Learn to configure a user assigned managed identity, attach it to an app service, and grant access to resources such as key vault and databases.

Learn Azure network security essentials, focusing on restricting access to only authorized parties and implementing practical controls to reduce attacks from overly permissive networks.

Explore hub-and-spoke design for secure cloud networks by hosting shared services like firewall and gateway in a hub vnet, connecting spoke vnets via peering, with hub as entry point.

Explore how the network security group (NSG) acts as a gatekeeper for subnets and VMs. It uses five tuples—source, source port, destination, destination port, and protocol—to enforce prioritized security rules.

Configure a new virtual machine and its NSG to control inbound connections, illustrating default rules and a custom RDP rule restricted to your IP.

Configure outbound internet access for a virtual machine by adding an NSG outbound rule that denies https traffic with priority 100, overriding the default allow rule.

Create and configure a network security group (NSG), define inbound and outbound rules, and attach the NSG to a subnet to block RDP traffic and validate access.

Privatelink extends managed services into your vnet via a private endpoint, creating a private IP for resources like Azure SQL, enabling private DNS and keeping traffic inside the vnet.

Key Vault securely stores secrets such as connection strings, keys, and API keys with restricted access via Azure Active Directory. It supports hardware security modules and REST API access.

Create a new key vault in a secure resource group, add secrets, and implement a minimum permissions access policy with a managed identity to retrieve secrets.

Explore Azure security best practices by securing virtual machines with network and identity controls, then demonstrate comprehensive measures across cloud services.

Apply least privilege by assigning the virtual machine contributor role, not the full contributor, and limit access to the specific VM resource type, noting owner, contributor, and reader roles.

Enable Azure automatic VM guest patching to keep virtual machines updated with the latest OS and security fixes, with off-peak maintenance and automatic monitoring and restarts if issues arise.

Install an up-to-date anti-malware solution on the virtual machine, such as Microsoft anti-malware, and integrate it with Defender for Cloud to receive alerts and incidents data.

Enable disk encryption for virtual machine disks using Linux encryption and BitLocker; integrate with Key Vault for keys management and note disk encryption type is separate from operating system encryption.

Limit VM access to the minimum by allowing RDP or SSH only from specific IPs via NSGs, and use Azure Bastion for private access without exposing public IPs.

Secure an Azure Windows VM by creating it in a secure resource group, restricting RDP to your IP, enabling Azure orchestrated patching, and configuring BitLocker with a Key Vault.

Securely access a virtual machine via Azure Bastion to connect with RDP or SSH without a public IP, by creating a Bastion subnet in the VM's VNet and provisioning Bastion.

Explore Azure app services security and its shared infrastructure with Azure Functions, and learn security best practices for designing and developing secure app services.

Configure the app service to accept only https requests, ensuring http is blocked and https traffic remains encrypted; by default these settings are enabled, but verify after deployment.

Integrate Azure AD authentication into your app service through the portal to enable features like MFA, conditional access, and branding.

Move database connection strings from code to Azure Key Vault, a secure secret store that requires strong authentication and easily enables app services to access secrets.

Restrict internet access to the app service to the minimum required, route public access through a web application firewall or WAF, and specify allowed IPs for targeted audiences.

Secure an Azure app service by enabling HTTPS only and enforcing minimum TLS 1.2, adding Azure AD authentication, and configuring IP-based access restrictions.

Explore database security in the cloud, focusing on Azure SQL as the commonly used platform, and learn about default security features across Azure flavors like Postgres SQL and MySQL.

Explore how Azure AD identities unify authentication for Azure SQL, replacing SQL authentication with Azure AD authentication, reducing credential storage and enabling centralized user management.

Learn how Azure SQL encrypts data at rest with TDE, and how Always Encrypted adds column-level protection using keys stored in a key vault.

Limit access to the database using private endpoints to block internet access. Have admins connect through a virtual machine in the connected VNet, or apply firewall rules for IP addresses.

Create and secure an Azure SQL database, configure a new server, choose authentication methods, enable TDE, set firewall rules, and connect with Azure Data Studio.

Create a new Azure AD user, assign the db_datareader role in Azure SQL, then verify the user can log in and read data but cannot edit.

Start and connect to a secure azure virtual machine via rdp, then install the dotnet 6 sdk, visual studio code, and the c# extension to prepare for azure sql development.

Demonstrate connecting an Azure VM to Azure SQL using a connection string, configure a firewall rule for the VM IP, and move from the least secure to more secure access.

Learn how to store a database connection string as a key vault secret, configure dotnet code to retrieve it securely, and grant a VM managed identity access to read secrets.

Demonstrates configuring a private endpoint for Azure Key Vault, linking it to the VM's vnet, enabling private DNS, and disabling public access to secure secret retrieval.

Demonstrates configuring an Azure SQL private endpoint, linking the database to a VM virtual network, updating firewall rules, and securing access with a managed identity.

Learn to connect a VM to Azure SQL using a managed identity, map the VM as a database user, grant read access, and enforce private endpoints with Key Vault secrets.

Create and secure an app service, enable a managed identity, set up vnet integration, grant key vault access, and deploy code to securely access Azure SQL via private endpoint.

Discover methods to secure an Azure storage account, prevent storage leaks, and apply security techniques similar to Azure SQL.

Explore Azure AD identities as the fifth technique for storage access, compare public access, storage key, and SAS token, and learn why Azure AD authentication offers strongest security.

Encrypt data by default in storage accounts to protect data at rest; encryption keys can be managed by Microsoft or the customer, though Microsoft-managed keys are more than enough.

Restrict access to storage accounts by enabling private endpoints and firewall rules for specific IP addresses, while allowing public access only for static website files.

Learn secure storage access from a VM by using SAS tokens, ideally in Key Vault or via managed identity, and connect through a private endpoint rather than public networks.

Demonstrates securely accessing an Azure storage account from a VM using a connection string and SAS token, with Azure Key Vault and managed identity.

Configure a storage account with a private endpoint connected to a vnet to disable public network access. Validate access via a secure virtual machine using key vault and managed identity.

Enable secure storage access by using the virtual machine's managed identity via a key vault secret for the container URL and DefaultAzureCredential, replacing the connection string.

Learn how to securely connect an app service to a storage account using VNet integration and a private endpoint, with a middle VNet between them.

Connect to storage using managed identity, not keys or sas tokens, and store container uri in Key Vault. Grant minimum permissions with private endpoints and apply policies against key-based access.