De4sec
De4sec Technology
de4sec.technology
🇦🇺 Australia

Azure Cloud Security Guide

How to secure your Azure environment — identity, workload protection, posture management, and centralised logging using the Microsoft security stack.

Prepared by
De4sec Technology
Contact
support@de4sec.technology
Edition
2026 · March
CONFIDENTIAL · FOR CLIENT USE ONLY
Contents
  1. Why Azure Security Is a Shared Responsibility
  2. Identity Security: Entra ID
  3. Microsoft Defender for Cloud
  4. Network Security
  5. Logging and Monitoring: Microsoft Sentinel
  6. De4sec Azure Security Service
01

Why Azure Security Is a Shared Responsibility

Microsoft secures the Azure platform — the physical infrastructure, hypervisor, and core services. You are responsible for securing everything you deploy on it: virtual machines, storage, identities, applications, and data.

The most common Azure breaches in 2026 are not exploits of Microsoft infrastructure. They are misconfigurations — public storage blobs, overprivileged identities, unpatched virtual machines, and no network segmentation.

Microsoft SecuresCustomer Secures
Physical datacentresIdentity and access management
Hypervisor and hardwareOperating systems on VMs
Core Azure platformNetwork configuration
Physical networkApplication code and data
Availability SLAMonitoring and detection
02

Identity Security: Entra ID

Privileged Identity Management (PIM)

✓No standing admin roles — admins request access for specific tasks with time limits
✓Approval workflows for sensitive roles
✓MFA required for role activation
✓All PIM activations logged and auditable

Conditional Access

✓MFA enforced for all Azure portal access
✓Admin console access restricted to compliant, managed devices
✓Named location policies — flag access from unexpected geographies
✓Risk-based access — Entra ID Identity Protection blocks risky sign-ins automatically

Service Principal Governance

✓Audit all service principals and app registrations — remove unused ones
✓Rotate service principal credentials on a regular schedule
✓Scope permissions to minimum required — avoid Contributor or Owner where Reader is sufficient
✓Monitor service principal sign-in logs for anomalies
03

Microsoft Defender for Cloud

Defender for Cloud provides continuous security posture assessment across your Azure subscriptions. It identifies misconfigurations, compliance gaps, and active threats.

✓Enable Defender for Cloud on all subscriptions — free tier provides posture assessment
✓Enable Defender plans for resources you deploy: servers, SQL, storage, Key Vault, containers
✓Secure Score — your overall posture metric. Target above 70% for SMB baseline
✓Security recommendations — prioritised list of actions to improve posture, with direct implementation links
✓Regulatory compliance dashboard — assess against Essential Eight, ISO 27001, CIS benchmarks

Defender for Cloud's Secure Score is the single most useful starting point for Azure security. Enable it, address the high-severity recommendations, and you've resolved the most common Azure misconfigurations.

04

Network Security

Network Segmentation

✓Use Virtual Networks (VNets) with subnets — don't deploy everything in a flat network
✓Apply Network Security Groups (NSGs) to subnets — deny by default, allow by exception
✓Use Azure Firewall or Network Virtual Appliance for centralised egress filtering
✓Separate production, development, and management networks

Remote Access

✓No RDP or SSH directly exposed to the internet — use Azure Bastion or VPN Gateway
✓Just-in-time VM access via Defender for Cloud — open management ports only when needed, for specific IPs
✓Private endpoints for PaaS services — Azure SQL, Storage, Key Vault accessible only from within the VNet

DDoS Protection

✓Azure DDoS Protection Standard — for production workloads with public endpoints
✓Application Gateway with WAF — protect web applications from OWASP Top 10 attacks
05

Logging and Monitoring: Microsoft Sentinel

All Azure resources generate logs. Without collection and analysis, you have no visibility into what's happening.

✓Enable Diagnostic Settings on all resources — send logs to Log Analytics workspace
✓Azure Activity Log — all control plane actions (who changed what in the Azure portal)
✓Microsoft Entra ID Sign-in Logs — all authentication activity
✓Defender for Cloud alerts — forwarded to Microsoft Sentinel
✓VM security events — forwarded via Azure Monitor Agent

Microsoft Sentinel Analytics

✓Scheduled analytics rules — detect patterns across logs over time
✓Near-real-time rules — alert within minutes of suspicious activity
✓Threat intelligence matching — known attacker IPs and IOCs matched against your logs
✓UEBA — User and Entity Behaviour Analytics, detect anomalous behaviour patterns
06

De4sec Azure Security Service

Architecture Review
Review current Azure environment against security best practices. Identify misconfigurations, overprovisioned identities, and network gaps.
Secure Baseline
Implement security baseline: PIM, Conditional Access, Defender for Cloud, NSGs, Bastion, private endpoints.
Microsoft Sentinel
Deploy Sentinel, configure data connectors, create analytics rules, establish monitoring cadence.
Ongoing Managed Security
Monthly Secure Score review, alert monitoring, quarterly architecture review, patch compliance for Azure VMs.
// NEXT STEP

Ready to implement this?

De4sec provides hands-on implementation. Book a free discovery call — we assess your environment at no cost, no obligation.

Book a Free Discovery Call →de4sec.technology
De4sec
© 2026 DE4SEC TECHNOLOGY. ALL RIGHTS RESERVED.