Azure Security

This roadmap covers securing Microsoft Azure: Entra ID identities, governance, networks, secrets, monitoring and incident response. A free Azure account and basic cloud knowledge are enough to start.

• Create a separate subscription for learning
• Protect your admin account with MFA
• Set a budget alert

• CyberA4U Academy — courses

Azure organizes resources into tenants, management groups, subscriptions and resource groups. Security settings and permissions follow this hierarchy.

• Explain tenants, subscriptions and resource groups
• Understand Azure's shared responsibility model
• Find built-in security features for common services

الأدوات والتقنيات: Azure

• Microsoft Learn — Introduction to Azure security

Microsoft Entra ID is the identity provider behind Azure and Microsoft 365. Users, groups, app registrations and sign-in logs all live here.

• Manage users, groups and roles
• Understand app registrations and service principals
• Read sign-in and audit logs

الأدوات والتقنيات: Azure

• What is Microsoft Entra ID?

Conditional Access applies "if this, then that" rules to sign-ins — for example, require MFA from unknown locations or block legacy authentication.

• Design baseline Conditional Access policies
• Use report-only mode before enforcing
• Plan exclusions for emergency accounts

الأدوات والتقنيات: Azure

• What is Conditional Access?

Azure role-based access control grants permissions at a scope. Management groups let you apply roles and policies to many subscriptions at once.

• Assign built-in roles at the right scope
• Avoid broad Owner assignments
• Use management groups for consistent governance

الأدوات والتقنيات: Azure

• What is Azure RBAC?
• What are Azure management groups?

Network security groups filter traffic to subnets and network interfaces. Combined with private endpoints they keep services off the public internet.

• Write NSG rules with least privilege
• Understand default rules and priority
• Use private endpoints for PaaS services

الأدوات والتقنيات: Azure

• Azure network security groups overview

Key Vault stores secrets, keys and certificates. Access should use managed identities, not passwords in configuration files.

• Store and retrieve a secret
• Use RBAC or access policies correctly
• Enable soft-delete and purge protection

الأدوات والتقنيات: Azure

• About Azure Key Vault

Microsoft Defender for Cloud assesses your security posture and provides threat protection for workloads.

• Read the secure score and recommendations
• Enable Defender plans for key workloads
• Prioritize remediation

الأدوات والتقنيات: Azure

• What is Microsoft Defender for Cloud?

Azure Monitor collects logs and Microsoft Sentinel turns them into detections and investigations.

• Send activity and sign-in logs to a Log Analytics workspace
• Connect data sources to Sentinel
• Write a simple KQL query

الأدوات والتقنيات: Azure

• What is Microsoft Sentinel?

Storage accounts are a frequent source of data exposure. Disable anonymous access, require secure transfer and use identity-based access.

• Disable public blob access
• Prefer Entra ID authorization over shared keys
• Configure encryption and network restrictions

الأدوات والتقنيات: Azure

• Azure Blob Storage — Security recommendations

App Service hosts web apps. Harden it with HTTPS only, managed identities, authentication and network restrictions.

• Enforce HTTPS and a modern TLS version
• Use managed identities for downstream access
• Restrict inbound access

الأدوات والتقنيات: Azure

• Azure App Service — Security overview

Open management ports, public storage, over-privileged identities and disabled logging are the most common Azure misconfigurations. The Microsoft cloud security benchmark lists the controls that prevent them.

• Recognize common misconfigurations
• Map them to benchmark controls
• Fix them with Azure Policy

الأدوات والتقنيات: Azure

تعلّمها على CyberA4U:Module 21: Cloud Environment Attack Techniques

• Microsoft cloud security benchmark — Introduction

Most Azure compromises start with identity: phished users, leaked app secrets or over-privileged service principals. Entra ID Protection flags risky sign-ins and users.

• Understand common identity attack patterns at a high level
• Review risky sign-ins and users
• Reduce standing privileged access

الأدوات والتقنيات: Azure

• What is Microsoft Entra ID Protection?

Responding in Azure means using sign-in logs, activity logs and Defender alerts to scope an incident, then revoking sessions and isolating resources.

• Revoke user sessions and reset credentials
• Isolate a compromised VM
• Collect logs for investigation

الأدوات والتقنيات: Azure

• Microsoft — Incident response overview

A hardening checklist turns best practices into repeatable steps for every new subscription.

• Build a baseline from Microsoft's best practices
• Automate it with Azure Policy
• Review it regularly

الأدوات والتقنيات: Azure

• Azure security best practices and patterns

Check that you can secure identities, networks, data and monitoring in Azure.

• Configure Conditional Access and RBAC
• Secure network and storage
• Detect and respond with Sentinel

• CyberA4U CTF Arena — practice challenges

You can now secure common Azure workloads. Consider the Microsoft AZ-500 certification, and continue with Zero Trust or Cloud Detection & Response.

• Keep a documented baseline
• Choose your next roadmap
• Share one lesson learned

• CyberA4U CTF Arena — practice challenges