Azure identity security
Configure Microsoft Entra ID, MFA, Conditional Access, risky sign-in protection, privileged identity, access reviews, and least privilege.
OC Security Audit
Microsoft Azure Cloud Security Audit Services
Assess Azure security risks across identity, subscriptions, virtual networks, workloads, monitoring, data protection, remote access, backup, and compliance evidence.
Entra IDMFA, Conditional Access, privileged identity, roles, and risky sign-ins.
NetworkVNets, NSGs, Azure Firewall, WAF, VPN, Bastion, and segmentation.
WorkloadsVM hardening, Defender for Cloud, patching, backup, and encryption.
EvidenceChecklist controls, risk levels, owners, priorities, and compliance mappings.
Azure cloud security audit services
Know where your Azure tenant, workloads, and data are exposed.
A secure Microsoft Azure environment requires layered protection across identity, governance, network architecture, workloads, data, monitoring, backup, and incident visibility. OC Security Audit helps Orange County and Southern California organizations assess Azure security controls, document gaps, and prioritize practical remediation.
Microsoft Entra ID
Conditional Access
Azure Firewall and WAF
Defender for Cloud
Microsoft Sentinel
Azure Backup
Storage encryption
Compliance evidence
What the Azure audit reviews
Full-stack cloud security review across identity, network, workloads, data, and monitoring.
The review organizes Azure controls into practical audit categories for executives, IT managers, and cloud administrators.
Azure network security
Design secure virtual networks, NSGs, Azure Firewall, WAF, VPN, private endpoints, DDoS protection, and segmented cloud connectivity.
Azure VM security
Harden virtual machines, restrict RDP and SSH, enable Defender, patch operating systems, secure disks, and review management access.
Secure access to Azure servers
Reduce exposed management ports using Azure Bastion, VPN, MFA, just-in-time access, privileged access controls, and logging.
Azure monitoring and SIEM
Enable diagnostic logs, Azure Monitor, Log Analytics, Microsoft Sentinel, alerting, and incident response workflows.
Storage, database, and backup security
Secure storage accounts, SQL databases, key management, encryption, backup, recovery, and retention requirements.
What Azure components need to be secured?
Security must cover the tenant, subscriptions, workloads, data, and operations.
Azure security is not one product or checkbox. The audit needs to address Entra ID, management groups, subscriptions, role assignments, VNets, firewalls, NSGs, WAF, VMs, storage, databases, Defender for Cloud, logging, Sentinel, backup, and compliance reporting.
Secure Microsoft Entra ID, privileged access, MFA, SSO, Conditional Access, and access reviews.
Harden subscriptions, management groups, Azure Policy, resource locks, tagging, and governance.
Protect Azure VNets, NSGs, Firewall, WAF, VPN, private endpoints, and internet-facing services.
Monitor failed logins, privilege changes, public IP creation, malware alerts, and risky sign-ins.
Azure components to secure
Detailed Azure security controls across the cloud environment.
Review the Azure components that affect identity, governance, network exposure, workload protection, monitoring, resilience, and compliance evidence.
Identity and access
Secure Azure starts with identity. Administrators, users, service principals, applications, and privileged roles need MFA, Conditional Access, access reviews, and least-privilege controls.
Enable MFA for administrators and users.
Use Conditional Access policies and disable legacy authentication.
Apply RBAC with least privilege and use PIM for just-in-time admin access.
Monitor risky users, risky sign-ins, and privileged role changes.
Subscriptions and management groups
Azure subscriptions and management groups define how governance, policy, ownership, and security standards are enforced across cloud resources.
Separate production, development, testing, and security subscriptions.
Use management groups for centralized governance.
Apply Azure Policy initiatives and security baselines.
Configure resource locks for critical systems and enable Defender for Cloud.
Azure virtual networks
Virtual networks should be segmented, monitored, and restricted so workloads are not exposed unnecessarily and cloud movement is controlled.
Segment workloads by subnet and separate application, database, management, and security zones.
Apply Network Security Groups to subnets and interfaces.
Use private endpoints for Azure PaaS services.
Monitor network traffic with Network Watcher and flow logs.
Azure Firewall, NSGs, and WAF
Cloud traffic inspection, inbound restrictions, outbound control, and web application protection reduce exposure for internet-facing Azure workloads.
Deploy Azure Firewall or an approved third-party NGFW.
Use route tables to force traffic through inspection points.
Configure deny-by-default rules and restrict RDP, SSH, SMB, SQL, and management ports.
Send firewall, WAF, and NSG logs to Log Analytics or Microsoft Sentinel.
Azure virtual machines
Azure VMs require hardening, patching, endpoint protection, disk encryption, secure administration, and monitoring.
Remove public IPs unless absolutely required.
Use Azure Bastion or VPN instead of direct RDP/SSH exposure.
Enable just-in-time VM access, OS baselines, and managed disk encryption.
Send Windows Event Logs or Linux syslogs to Log Analytics or SIEM.
Administrative access to Azure servers
Remote access is a high-risk area. RDP and SSH should not be exposed directly to the internet, and administrator access should be strongly controlled.
Remove public RDP and SSH access.
Use Azure Bastion, VPN, Conditional Access, and MFA.
Enable just-in-time VM access through Defender for Cloud.
Monitor failed login attempts and brute-force activity.
Antivirus, EDR, and malware protection
Cloud workloads still need malware protection, EDR visibility, attack surface reduction, and centralized alert handling.
Deploy Microsoft Defender for Endpoint or an approved EDR platform.
Enable Defender for Servers where appropriate.
Configure attack surface reduction rules.
Centralize EDR alerts into Microsoft Defender portal or SIEM.
Storage, databases, and data protection
Azure storage accounts, databases, keys, secrets, and backups must be protected from public exposure and excessive access.
Disable anonymous public access unless explicitly required.
Use private endpoints for storage and database services.
Rotate storage account keys and use Key Vault for secrets.
Enable encryption, database auditing, threat detection, and tested backups.
Cloud posture and workload protection
Microsoft Defender for Cloud helps identify misconfigurations, prioritize risk, and detect threats across Azure workloads.
Enable Defender for Cloud on Azure subscriptions.
Review Secure Score and prioritize high-risk recommendations.
Enable workload plans for servers, storage, databases, and containers.
Integrate Defender alerts with Microsoft Sentinel or another SIEM.
Azure logging, monitoring, and Sentinel
Azure Activity Logs, Entra ID logs, diagnostic logs, firewall logs, WAF logs, and NSG flow logs create the evidence needed for investigation and compliance.
Enable Azure Activity Logs and Microsoft Entra ID logs.
Enable diagnostic logs for critical Azure services.
Send logs to Microsoft Sentinel or an existing SIEM.
Monitor failed logins, privilege changes, public IP creation, and risky sign-ins.
Audit roadmap
How we audit Microsoft Azure security.
Use this practical audit model to move from discovery and technical validation to evidence collection and remediation planning.
1. Review
Inventory subscriptions, tenants, workloads, users, roles, network paths, exposed services, storage, backup, and current controls.
2. Review identity controls
Assess MFA, Conditional Access, PIM, access reviews, risky sign-in protection, and least privilege.
3. Harden architecture
Apply governance, Azure Policy, secure network segmentation, firewall rules, WAF, private endpoints, and workload baselines.
4. Monitor and improve
Enable Defender, Azure Monitor, Log Analytics, Sentinel, alerting, backup validation, and recurring control reviews.
Audit focus areas
Step-by-step Azure security audit guidance.
Use the guidance below to examine Azure identity, governance, network, workload, monitoring, data protection, and recovery controls in greater depth.
Review the Azure environment
Start by understanding what exists, what is exposed, and who controls it.
Inventory Azure subscriptions, resource groups, public IP addresses, and internet-facing resources.
Identify administrative users, privileged roles, remote access methods, and unprotected VMs.
Review network architecture, logging coverage, monitoring coverage, security gaps, and risk areas.
Secure Microsoft Entra ID
Identity controls reduce tenant takeover risk and improve accountability.
Enforce MFA for administrators and configure Conditional Access policies.
Block legacy authentication, enable PIM, review Global Administrator accounts, and configure access reviews.
Secure service principals, application registrations, risky users, and risky sign-ins.
Harden subscriptions and governance
Governance controls help enforce secure cloud design consistently.
Organize subscriptions under management groups and apply Azure Policy security baselines.
Restrict public IP creation, enforce allowed regions, require ownership tags, and configure locks.
Enable Defender for Cloud, activity logging, and subscription-level role reviews.
Design secure Azure network architecture
Network design should separate workloads and control inbound, outbound, and private traffic paths.
Create separate subnets for web, application, database, management, and security services.
Apply NSGs, restrict traffic by source and port, route outbound traffic through inspection points.
Use private endpoints, VPN or ExpressRoute, DDoS protection, Network Watcher, and flow logs.
Implement Azure Firewall and traffic inspection
Inspection and rule governance reduce accidental exposure and improve evidence quality.
Deploy Azure Firewall or approved NGFW and create application and network rule collections.
Deny unnecessary outbound traffic, block high-risk ports, and restrict administrative traffic.
Enable threat intelligence filtering, DNS/FQDN filtering, logging, and change documentation.
Secure remote access to Azure VMs
Administrative access should be private, monitored, and limited to approved users.
Remove public IP addresses where possible and disable direct internet RDP and SSH.
Deploy Azure Bastion, enable JIT VM access, require MFA, and use Conditional Access.
Restrict access to approved admin groups, monitor failed logins, and document emergency access.
Harden Azure virtual machines
Virtual machines need baseline hardening, patching, endpoint protection, and log collection.
Apply Windows or Linux security baselines, enable disk encryption, and install EDR.
Enable vulnerability assessment, patch operating systems, disable unused services, and restrict local admin accounts.
Configure host firewalls, enable backup, send logs to Log Analytics, and monitor suspicious process execution.
Secure Azure applications and web services
Application security controls protect public-facing workloads and backend secrets.
Place public web apps behind WAF using Application Gateway WAF or Azure Front Door WAF.
Enable HTTPS only, managed certificates, secure TLS, managed identities, and Key Vault.
Restrict app service access with private endpoints or access restrictions and monitor suspicious requests.
Protect storage, databases, and sensitive data
Data security should combine private access, encryption, key management, auditing, and recovery.
Disable public anonymous storage access and use private endpoints.
Restrict access by identity and network, rotate keys, and use Key Vault for secrets.
Enable database auditing, threat detection, backup, restore testing, and unusual access monitoring.
Enable Defender for Cloud and workload protection
Defender helps prioritize remediation and detect threats across cloud resources.
Enable Defender plans for servers, storage, databases, containers, and key services.
Review Secure Score recommendations and assign remediation owners.
Send alerts to Microsoft Sentinel or SIEM and investigate high-risk findings promptly.
Configure Azure logging and Microsoft Sentinel
Centralized logs and SIEM rules help detect identity, network, workload, and data-access threats.
Enable Activity Logs, Entra ID logs, resource diagnostic logs, NSG flow logs, firewall logs, and WAF logs.
Send logs to Log Analytics or Sentinel and create alert rules for high-risk events.
Monitor privilege changes, public IP creation, failed logins, risky sign-ins, and suspicious downloads.
Create ongoing security operations
Azure security should become a recurring program, not a one-time configuration project.
Review security posture, policy compliance, role assignments, firewall rules, and backup evidence on a recurring schedule.
Track findings, remediation owners, due dates, exceptions, and residual risk.
Use the checklist below to support recurring Azure security operations and audit readiness.
Identity-first Azure security
Strong cloud security starts with Microsoft Entra ID and privileged access.
Identity is one of the highest-impact areas in Azure. Compromised accounts, excessive permissions, unmanaged service principals, and weak administrator controls can expose the entire tenant.
Require MFA and stronger authentication for administrators and sensitive applications.
Review privileged roles, service principals, enterprise applications, and owner assignments.
Use PIM, access reviews, Conditional Access, sign-in risk policies, and documented exceptions.
Microsoft Azure Security Checklist
Excel-style Azure audit worksheet for controls, risk, evidence, and remediation.
Use search, filters, sticky headers, and risk badges to review all 61 Azure security controls and identify the evidence, owners, and remediation priorities that need attention.
Scroll horizontally and vertically to review all Azure security columns. The header row and first column remain visible while reviewing audit guidance, evidence, owner, priority score, and compliance mapping.
| # | Azure Security Area | Control Type | Checklist Item / Security Control | Azure Services / Scope | Audit / Remediation Guidance | Verification Questions | Evidence / Documents to Review | Risk Level | Risk Assessment | Risk Impact if Not Controlled | Recommended Frequency | Last Date Checked | Status | Owner | Remediation / Action Required | Due Date | Residual Risk / Exception Notes | Priority Score | Compliance Mapping |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Identity | Technical | Enforce MFA for all users with priority protection for administrators and high-risk roles. | Microsoft Entra ID, admin accounts, standard users, privileged roles | Require MFA for all users. Use stronger authentication methods for administrators and sensitive applications. Document and approve all MFA exclusions. | Is MFA required for all users? Are administrators protected? Are exclusions documented and approved? | MFA registration report, Conditional Access policies, exception list, admin role inventory | Critical | MFA reduces credential-based attacks and account takeover risk across Azure and Microsoft 365. | Compromised passwords may lead to tenant takeover, data exposure, and privileged misuse. | Monthly | Locked field | Not Started | Identity Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST AC-2, IA-2; CIS Azure |
| 2 | Identity | Technical | Configure Conditional Access policies for location, device, risk, and application sensitivity. | Conditional Access, Entra ID, compliant devices, sensitive applications | Create baseline and privileged-access policies. Require MFA, compliant devices, trusted locations, or session controls based on risk. | Are risky locations blocked? Are managed devices required? Are sensitive apps protected with stronger controls? | Conditional Access policy export, report-only results, sign-in logs, device compliance reports | Critical | Reduces unauthorized access through context-aware authentication controls. | Risky sign-ins may reach Azure, SaaS, or Microsoft 365 resources. | Monthly | Locked field | Not Started | Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST AC-3, IA-2; CIS Azure |
| 3 | Identity | Technical | Block legacy authentication protocols. | Entra ID, Exchange Online, Microsoft 365, legacy protocols | Block protocols that cannot enforce MFA, such as POP, IMAP, SMTP AUTH where not required, and other legacy methods. | Are legacy protocols disabled? Are legacy sign-ins monitored? Are exceptions removed or approved? | Legacy authentication sign-in report, Conditional Access policies, service exception records | High | Blocks insecure authentication methods that bypass modern protections. | Attackers may bypass MFA and compromise accounts through outdated protocols. | Monthly | Locked field | Not Started | Identity Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | CIS Azure; NIST IA-2 |
| 4 | Identity | Technical | Enable Identity Protection policies for risky users and risky sign-ins. | Microsoft Entra ID Protection, user risk, sign-in risk | Configure risk-based policies to require password reset, MFA, or block access based on user and sign-in risk severity. | Are user-risk policies enabled? Are sign-in risk policies enforced? Are risky accounts reviewed? | Identity Protection settings, risky users report, sign-in risk logs, remediation records | High | Automates response to suspected credential compromise and abnormal sign-ins. | Compromised accounts may remain active and continue accessing sensitive resources. | Weekly | Locked field | Not Started | Identity Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AU-6, IA-5 |
| 5 | Identity | Administrative | Review and lifecycle-manage guest and external users. | Entra B2B, guest users, external collaboration settings | Restrict guest invitations, enforce access reviews, remove inactive guests, and limit external sharing based on business need. | Are guests reviewed regularly? Are inactive guests removed? Are external sharing settings restricted? | Guest user inventory, access review reports, collaboration settings, removal records | Medium | Limits external access to approved users and business needs. | Former vendors or unmanaged guests may retain access to sensitive resources. | Quarterly | Locked field | Not Started | Identity Governance Owner | Locked remediation notes | Locked field | Locked exception notes | 65 | NIST AC-2; ISO 27001 |
| 6 | Privileged Access | Technical | Enable Privileged Identity Management for Azure and Entra administrator roles. | Microsoft Entra PIM, Azure roles, Entra roles, privileged groups | Convert standing admin roles to eligible roles. Require MFA, approval, justification, and time-bound activation. | Are admin roles eligible instead of permanent? Are activation durations limited? Is justification required? | PIM role settings, activation logs, eligible assignment report, approval workflow settings | Critical | Limits standing administrative privilege and reduces impact of compromised admin accounts. | Permanent admin access can enable full tenant or subscription compromise. | Monthly | Locked field | Not Started | PIM Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST AC-5, AC-6; CIS Azure |
| 7 | Privileged Access | Administrative | Review excessive, permanent, stale, or unnecessary admin role assignments. | Global Administrator, Privileged Role Administrator, Owner, Contributor, security roles | Review privileged assignments and remove unnecessary access. Require approval records for permanent access. | Who has admin access? Are permanent assignments justified? Are stale assignments removed? | Admin role assignment report, access review evidence, remediation tickets, approval records | Critical | Ensures privileges remain appropriate, justified, and auditable. | Excessive privilege increases blast radius of account compromise and insider misuse. | Monthly | Locked field | Not Started | Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST AC-2, AC-6 |
| 8 | RBAC | Technical | Apply RBAC using least privilege at the minimum required scope. | Management groups, subscriptions, resource groups, resources, managed identities | Assign roles at resource or resource group scope where possible. Avoid broad subscription Owner or Contributor assignments. | Are roles assigned at minimum scope? Are broad subscription assignments justified? | RBAC export, role assignment report, scope review, access review records | High | Limits permissions to the smallest practical scope. | Over-scoped access may allow users or services to modify unrelated resources. | Quarterly | Locked field | Not Started | Azure Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AC-6; CIS Azure |
| 9 | RBAC | Technical | Review custom roles, orphaned assignments, service principals, and automation identities. | Custom RBAC roles, service principals, managed identities, automation accounts | Audit non-human identities and custom role definitions. Remove stale identities and overbroad permissions. | Do custom roles grant broad actions? Are unused assignments removed? Are service identities least-privileged? | Custom role definitions, service principal permission review, orphaned assignment report | High | Prevents hidden privilege paths through custom roles and application identities. | Automation or application identities may be abused to modify resources or exfiltrate data. | Quarterly | Locked field | Not Started | Cloud Identity Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AC-6, IA-5 |
| 10 | Privileged Access | Technical | Secure and monitor break-glass emergency accounts. | Emergency access accounts, Entra ID, alerting, audit logs | Use cloud-only emergency accounts, protect credentials, monitor all sign-ins, and test access periodically. | Are emergency accounts cloud-only? Are they monitored? Are credentials protected and tested? | Break-glass account inventory, sign-in alerts, access test records, credential handling procedure | High | Maintains emergency access while preventing misuse or unnoticed sign-ins. | Emergency accounts may be abused or unavailable during tenant lockout events. | Quarterly | Locked field | Not Started | Identity Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST CP-2, AC-2 |
| 11 | Governance | Administrative | Organize Azure subscriptions under management groups. | Management groups, subscriptions, landing zones | Use management groups to separate production, non-production, shared services, security, and sandbox environments. | Are subscriptions logically grouped? Are policies and RBAC inherited from the right scope? | Management group hierarchy, subscription inventory, access model, landing zone design | Medium | Provides consistent governance and access control across Azure. | Unstructured subscriptions lead to inconsistent controls and unclear ownership. | Semiannually | Locked field | Not Started | Cloud Governance Owner | Locked remediation notes | Locked field | Locked exception notes | 65 | NIST PM-5; ISO 27001 |
| 12 | Governance | Technical | Apply Azure Policy initiatives for baseline security. | Azure Policy, initiatives, management groups, subscriptions | Assign policies for diagnostics, encryption, allowed locations, public IP restrictions, tagging, Defender coverage, and private endpoints. | Are security baselines enforced? Are non-compliant resources remediated? Are exemptions approved? | Policy assignments, compliance dashboard, remediation tasks, exemptions | High | Enforces consistent security standards and reduces configuration drift. | Uncontrolled resources may violate security and compliance requirements. | Monthly | Locked field | Not Started | Governance Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | CIS Azure; NIST CM-6 |
| 13 | Governance | Administrative | Separate production, development, testing, and security subscriptions. | Subscriptions, resource groups, RBAC, networks | Segment environments using subscriptions, resource groups, RBAC, VNets, and policies to prevent accidental access and lateral movement. | Are production resources isolated? Are developers restricted from production? | Subscription map, RBAC assignments, network diagram, deployment process | High | Reduces operational mistakes and cross-environment compromise. | Dev/test compromise may impact production systems and data. | Semiannually | Locked field | Not Started | Cloud Platform Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AC-4, SC-7 |
| 14 | Governance | Administrative | Require resource tags for owner, application, environment, and data classification. | Azure resources, tags, cost management, asset inventory | Enforce mandatory tags and use them for reporting, ownership, incident response, and cost/security optimization. | Are resources tagged? Are unowned resources investigated? | Tag compliance report, asset inventory, cost report, owner register | Medium | Improves accountability, asset management, and incident response. | Unowned resources may remain unpatched, exposed, or unmanaged. | Monthly | Locked field | Not Started | Cloud Operations Owner | Locked remediation notes | Locked field | Locked exception notes | 65 | NIST CM-8 |
| 15 | Network Security | Technical | Segment VNets and subnets to isolate workloads and reduce lateral movement. | VNets, subnets, route tables, peering | Separate web, application, database, management, security, and shared services subnets. | Are sensitive workloads isolated? Are routes documented? Are unnecessary peerings removed? | VNet diagrams, subnet list, route tables, peering inventory | High | Segmentation reduces lateral movement and limits compromise impact. | Flat networks can allow compromised workloads to reach sensitive systems. | Quarterly | Locked field | Not Started | Network Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST SC-7; CIS Azure |
| 16 | Network Security | Technical | Use hub-and-spoke architecture for centralized security controls where appropriate. | Hub VNet, spoke VNets, Azure Firewall, DNS, VPN, ExpressRoute | Route spoke traffic through a central hub for inspection, shared services, DNS, and secure hybrid connectivity. | Is traffic inspected through central controls? Are shared services protected? Are routes validated? | Network architecture diagram, route tables, firewall routing evidence, hub-and-spoke design | Medium | Supports consistent inspection, routing, and policy enforcement. | Inconsistent network controls may create unmanaged paths and security gaps. | Semiannually | Locked field | Not Started | Cloud Network Owner | Locked remediation notes | Locked field | Locked exception notes | 65 | NIST SC-7 |
| 17 | Network Security | Technical | Use Private Endpoints for critical Azure PaaS services. | Storage, SQL, Key Vault, App Services, private DNS zones, Private Link | Deploy private endpoints and disable public network access for sensitive services where possible. | Which services still allow public access? Are private DNS zones configured correctly? | Private Endpoint inventory, public network access settings, private DNS configuration | Critical | Restricts access to sensitive services through private connectivity. | Critical services may be reachable from the internet and targeted for attack. | Monthly | Locked field | Not Started | Network Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SC-7; CIS Azure |
| 18 | Network Security | Technical | Review NSG inbound and outbound rules for least access and conflicts. | NSGs, Application Security Groups, flow logs, Traffic Analytics | Remove broad rules, restrict management ports, define outbound controls, and resolve rule conflicts. | Are broad inbound ports restricted? Are outbound controls defined? Are rule conflicts resolved? | NSG rule export, flow logs, Traffic Analytics reports, unused rule review | Critical | Controls network access and supports forensic visibility. | Exposed services, data exfiltration, rule bypass, and unauthorized network access. | Monthly | Locked field | Not Started | Network Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SC-7 |
| 19 | Network Security | Technical | Review and reduce public exposure. | Public IPs, VMs, databases, App Services, APIs, load balancers | Identify and remove exposed RDP/SSH, databases, APIs, public storage, and unmanaged internet-facing resources. | Are management ports exposed? Are databases public? Are undocumented resources identified? | Public IP inventory, Defender exposure findings, NSG review, asset inventory | Critical | Reduces attack surface by finding and removing unnecessary internet exposure. | Brute-force attacks, service exploitation, data exposure, and unmanaged attack paths. | Monthly | Locked field | Not Started | Cloud Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | CIS Azure; NIST SC-7 |
| 20 | Firewall / WAF | Technical | Deploy Azure Firewall or approved NGFW for centralized traffic inspection. | Azure Firewall, Firewall Policy, route tables, NGFW | Inspect ingress, egress, and east-west traffic. Use route tables to force traffic through approved security controls. | Is traffic routed through inspection? Are firewall logs enabled? Are rules documented? | Firewall policy export, route tables, diagnostic logs, network diagram | Critical | Provides centralized traffic control, inspection, and logging. | Uninspected traffic may enable malware communication, exfiltration, or lateral movement. | Monthly | Locked field | Not Started | Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SC-7 |
| 21 | Firewall / WAF | Technical | Review firewall policies for permissive rules and threat intelligence settings. | Azure Firewall, firewall policies, threat intelligence | Use deny-by-default policy, restrict broad rules, enable threat intelligence filtering, and assign owners to exceptions. | Are firewall rules overly broad? Are temporary rules expired? Are threat intelligence controls enabled? | Firewall policy export, rule owner list, exception records, change tickets | Critical | Protects Azure network workloads from malicious traffic and unmanaged access. | Overly broad rules can expose services and allow threat communication. | Monthly | Locked field | Not Started | Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SC-7, CM-3 |
| 22 | Firewall / WAF | Technical | Use WAF for public-facing web applications. | Application Gateway WAF, Front Door WAF, OWASP rules | Enable managed OWASP rules, review exclusions, and monitor blocked requests for public web apps. | Are public apps behind WAF? Are WAF exclusions justified? Are blocked requests reviewed? | WAF policy settings, blocked request logs, application inventory, exclusion list | Critical | Protects web apps from common application-layer attacks. | Web attacks may exploit vulnerable applications or expose data. | Monthly | Locked field | Not Started | Application Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | OWASP ASVS; PCI DSS |
| 23 | Remote Access | Technical | Remove direct internet exposure of RDP and SSH. | Azure VMs, public IPs, NSGs, management ports | Block direct inbound RDP and SSH from the internet. Remove public IPs from VMs where possible. | Are any VMs exposing RDP or SSH? Are exceptions approved? Are brute-force attempts monitored? | Public IP inventory, NSG rules, Defender findings, failed login logs | Critical | Reduces brute-force, credential stuffing, and remote exploitation risk. | Exposed management ports may lead to server compromise and ransomware. | Monthly | Locked field | Not Started | Server Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | CIS Azure; NIST SC-7 |
| 24 | Remote Access | Technical | Use Azure Bastion, VPN, or ExpressRoute for administrative access. | Azure Bastion, VPN Gateway, ExpressRoute, admin networks | Require private administrative access through Bastion, VPN, or ExpressRoute. Limit access to approved administrators. | Is Bastion deployed? Are admins required to use private access? Are access logs reviewed? | Bastion configuration, VPN settings, route tables, access logs | High | Provides secure remote administration without exposing VM management ports. | Admins may connect insecurely from unmanaged networks or expose management services. | Quarterly | Locked field | Not Started | Network Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AC-17 |
| 25 | Remote Access | Technical | Enable just-in-time VM access. | Defender for Cloud JIT, Azure VMs, NSGs | Open management ports only when approved, for limited time, and from approved source IPs. | Is JIT enabled? Are source IPs restricted? Are requests logged? | JIT policy settings, Defender recommendations, request logs | High | Reduces management port exposure windows. | Persistent management access increases attack surface and brute-force risk. | Monthly | Locked field | Not Started | Cloud Security Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AC-17 |
| 26 | Virtual Machines | Technical | Apply Windows and Linux security baselines to Azure VMs. | Azure VMs, Windows, Linux, configuration management | Harden OS settings, disable unused services, restrict local admins, enable host firewall, and remove unnecessary software. | Are OS baselines applied? Are local admins restricted? Are unused services disabled? | Baseline reports, configuration records, local admin review, VM inventory | High | Reduces compromise risk for compute workloads. | Weak server configuration may enable malware, lateral movement, or privilege escalation. | Quarterly | Locked field | Not Started | Workload Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | CIS Benchmarks; NIST CM-6 |
| 27 | Virtual Machines | Technical | Patch operating systems and third-party applications regularly. | Azure Update Manager, VMs, applications | Use Azure Update Manager or approved patching process. Prioritize critical and internet-facing systems. | Are critical patches installed? Are failed updates remediated? Are exceptions documented? | Patch reports, update compliance dashboard, vulnerability scan results | Critical | Reduces exploit risk for known vulnerabilities. | Unpatched systems may be exploited, encrypted by ransomware, or used for lateral movement. | Weekly | Locked field | Not Started | Workload Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SI-2 |
| 28 | Virtual Machines | Technical | Encrypt VM managed disks and use customer-managed keys where required. | Managed disks, Disk Encryption Sets, Key Vault, CMK | Enable encryption for managed disks. Use CMK for regulated or high-sensitivity workloads. | Are disks encrypted? Are CMKs required? Are key permissions controlled? | Disk encryption settings, Key Vault integration, CMK inventory | High | Protects data confidentiality for VM disks. | Disk data may be exposed through theft, misconfiguration, or compliance failure. | Quarterly | Locked field | Not Started | Data Protection Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST SC-28 |
| 29 | Virtual Machines | Technical | Collect VM security logs centrally. | Windows Event Logs, Linux syslog, Azure Monitor Agent, Log Analytics | Install Azure Monitor Agent and collect security, system, application, and syslog events as required. | Are VM logs collected? Are agents healthy? Are logs retained? | Log Analytics coverage report, agent health, data collection rules | High | Supports threat detection, troubleshooting, and forensic investigations. | Compromise evidence may be unavailable during incident response. | Monthly | Locked field | Not Started | Monitoring Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AU-2, AU-6 |
| 30 | Endpoint Security | Technical | Deploy EDR or Microsoft Defender for Endpoint to Azure VMs. | Microsoft Defender for Endpoint, Defender for Servers, Azure VMs | Deploy and monitor endpoint protection on Windows and Linux VMs. Confirm all agents are healthy. | Are all VMs covered? Are agents healthy? Are detections reviewed? | EDR coverage report, device inventory, alert records, agent health report | Critical | Detects malware, suspicious behavior, credential theft, and lateral movement. | Compromised endpoints may remain undetected and spread ransomware. | Weekly | Locked field | Not Started | Endpoint Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SI-3, SI-4 |
| 31 | Endpoint Security | Technical | Enable malware protection, tamper protection, and attack surface reduction controls. | Defender for Endpoint, antivirus, ASR rules | Enable real-time protection, ransomware protection, tamper protection, and attack surface reduction rules. | Is antivirus active? Are signatures current? Are ASR rules enforced? | AV status report, EDR policy, ASR settings, malware alert history | High | Reduces malware execution and endpoint compromise. | Malware or attacker tools may run without prevention or detection. | Monthly | Locked field | Not Started | Endpoint Security Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST SI-3 |
| 32 | Storage & Data | Technical | Disable public blob access unless explicitly approved. | Azure Storage, Blob containers, file shares | Block anonymous public access for storage accounts and containers unless documented and approved. | Is public blob access disabled? Are public containers approved and reviewed? | Storage configuration, public access report, container inventory, exception records | Critical | Prevents accidental or malicious exposure of cloud-stored data. | Sensitive files may be publicly accessible or reachable from untrusted networks. | Monthly | Locked field | Not Started | Storage Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | CIS Azure; NIST AC-3 |
| 33 | Storage & Data | Technical | Restrict storage access through private endpoints or approved networks. | Storage accounts, firewalls, private endpoints, Entra ID | Use storage firewall, private endpoints, Microsoft Entra authentication, and least-privilege IAM. | Are storage accounts restricted to trusted networks? Are private endpoints configured? | Storage firewall settings, private endpoint inventory, IAM assignments, access logs | Critical | Restricts data access to trusted identities and networks. | Attackers may access storage data over public endpoints or weak credentials. | Monthly | Locked field | Not Started | Storage Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SC-7, AC-3 |
| 34 | Storage & Data | Technical | Control and rotate storage keys and SAS tokens. | Storage account keys, SAS tokens, managed identities | Use short-lived SAS tokens, rotate keys, monitor key usage, and replace stored secrets with managed identities. | Are access keys rotated? Are SAS tokens short-lived? Are shared secrets minimized? | Key rotation records, SAS review, access logs, key usage report | High | Reduces unauthorized data access from leaked or long-lived storage credentials. | Leaked tokens or keys may provide broad access to storage data. | Monthly | Locked field | Not Started | Storage Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST IA-5 |
| 35 | Storage & Data | Technical | Enable storage logging and monitor unusual access. | Storage logs, diagnostic settings, Log Analytics, Sentinel | Log storage access and alert on unusual downloads, anonymous access, key usage, or access from risky locations. | Are storage logs enabled? Are unusual downloads alerted? | Diagnostic settings, storage access logs, Sentinel alerts, incident records | High | Improves visibility into data access and possible exfiltration. | Data theft may not be detected or investigated effectively. | Monthly | Locked field | Not Started | SOC Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AU-6 |
| 36 | Key Management | Technical | Store secrets, keys, and certificates in Azure Key Vault. | Azure Key Vault, secrets, certificates, applications | Remove secrets from code, app settings, scripts, and documents. Use Key Vault references and managed identities. | Are secrets stored in Key Vault? Are secrets removed from code? Are managed identities used? | Key Vault inventory, app configuration review, code review findings | Critical | Protects credentials and cryptographic material from exposure. | Secret leakage can lead to application compromise and data theft. | Monthly | Locked field | Not Started | Key Vault Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST IA-5, SC-12 |
| 37 | Key Management | Technical | Restrict Key Vault access, enable soft delete, purge protection, and private endpoints. | Key Vault, RBAC, private endpoints, purge protection | Limit access by role, restrict network access, enable soft delete and purge protection, and alert on high-risk operations. | Who can access secrets? Is purge protection enabled? Are secret reads monitored? | Key Vault access review, RBAC assignments, soft delete settings, diagnostic logs | Critical | Protects secrets, certificates, and encryption keys from unauthorized use or deletion. | Secret theft, key deletion, application compromise, and irreversible data access issues. | Monthly | Locked field | Not Started | Key Vault Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SC-12, SC-28 |
| 38 | Databases | Technical | Disable public network access for Azure databases where possible. | Azure SQL, MySQL, PostgreSQL, Cosmos DB, private endpoints | Use private endpoints and restrict firewall rules. Require documented approval for public database exposure. | Are databases publicly accessible? Are private endpoints configured? Are firewall rules restricted? | Database networking settings, firewall rules, private endpoint inventory | Critical | Reduces exposure of sensitive data services to internet-based attacks. | Public databases may be brute-forced, exploited, or accessed by unauthorized users. | Monthly | Locked field | Not Started | Database Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SC-7; CIS Azure |
| 39 | Databases | Technical | Enable database auditing, threat detection, and vulnerability assessment. | Azure SQL, Defender for SQL, database logs | Enable audit logs, failed login monitoring, vulnerability assessment, and Defender alerts for database services. | Is auditing enabled? Are failed logins reviewed? Are database alerts escalated? | Audit settings, database logs, Defender for SQL alerts, assessment reports | High | Provides visibility into database misuse, attacks, and weak configuration. | Database attacks may go undetected and evidence may be missing. | Monthly | Locked field | Not Started | Database Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AU-2, SI-4 |
| 40 | Databases | Technical | Back up databases and test restore procedures. | Azure SQL, PostgreSQL, MySQL, Cosmos DB, backups | Confirm backup retention, geo-redundancy if needed, and periodic restore testing for critical databases. | Are backups configured? Are restores tested? Are RPO/RTO requirements met? | Backup settings, restore test records, recovery plan, retention policy | Critical | Supports recovery from deletion, corruption, ransomware, or outage. | Data loss, extended downtime, and failed disaster recovery. | Quarterly | Locked field | Not Started | Database Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST CP-9, CP-10 |
| 41 | Applications | Technical | Secure Azure App Services and Function Apps. | App Services, Function Apps, managed identities, TLS, Key Vault | Enforce HTTPS, modern TLS, managed identities, Key Vault references, access restrictions, and diagnostic logs. | Are secrets removed from app settings? Is HTTPS enforced? Are logs enabled? | App configuration review, managed identity assignments, Key Vault references, TLS settings | High | Protects hosted applications from weak configuration and credential exposure. | Hard-coded secrets, insecure traffic, unauthorized access, and weak incident investigation. | Monthly | Locked field | Not Started | Application Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | OWASP ASVS; NIST SC-8 |
| 42 | Applications | Technical | Protect APIs with authentication, authorization, and abuse controls. | API Management, App Gateway, WAF, Entra ID, rate limiting | Require authentication, authorization, rate limiting, logging, and validation for APIs. Use WAF or API gateway controls where appropriate. | Are APIs authenticated? Are rate limits configured? Are unauthorized requests monitored? | API Management policies, authentication settings, access logs, WAF logs | Critical | Prevents unauthorized API access and abuse. | Unauthenticated APIs may expose data, business logic, or administrative functions. | Monthly | Locked field | Not Started | Application Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | OWASP API Security |
| 43 | Containers / AKS | Technical | Restrict AKS cluster access and enforce Kubernetes RBAC. | AKS, Microsoft Entra ID, Kubernetes RBAC, API server | Integrate AKS with Entra ID, restrict API server access, use least-privilege Kubernetes RBAC, and avoid local admin accounts. | Is AKS admin access restricted? Is API server exposed? Are Kubernetes roles reviewed? | AKS access settings, Kubernetes RBAC, API server settings, audit logs | High | Reduces cluster takeover and privilege escalation risk. | Exposed or over-permissioned clusters may enable container compromise and lateral movement. | Monthly | Locked field | Not Started | Container Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AC-6; CIS Kubernetes |
| 44 | Containers / AKS | Technical | Scan container images and protect registries. | Azure Container Registry, container images, Defender for Containers | Scan images, remove vulnerable images, restrict registry permissions, and monitor image pulls and pushes. | Are images scanned? Are vulnerable images blocked? Is ACR access controlled? | Image scan reports, ACR permissions, registry logs, deployment records | High | Reduces supply-chain and vulnerable image risk. | Vulnerable images or unauthorized registry access may compromise workloads. | Monthly | Locked field | Not Started | Container Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST SI-2; SLSA |
| 45 | Containers / AKS | Technical | Apply AKS network policies and runtime monitoring. | AKS, network policies, Defender for Containers, Log Analytics | Enforce pod-to-pod network controls, monitor runtime activity, and forward container logs to SIEM. | Are network policies enforced? Are runtime alerts reviewed? Are logs centralized? | Network policies, cluster logs, Defender alerts, Log Analytics records | High | Reduces container lateral movement and improves detection. | Container compromise may spread or remain undetected. | Monthly | Locked field | Not Started | Container Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | CIS Kubernetes; NIST SI-4 |
| 46 | Defender & Monitoring | Technical | Enable Microsoft Defender for Cloud across all subscriptions. | Defender for Cloud, Defender plans, subscriptions | Enable Defender CSPM and relevant workload plans for servers, storage, SQL, containers, APIs, and key services. | Are Defender plans enabled for all needed services? Are critical workloads covered? | Defender plan coverage, subscription settings, Secure Score report | Critical | Provides posture management and workload threat protection. | Security gaps may persist and active threats may not be detected quickly. | Monthly | Locked field | Not Started | Cloud Security Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST RA-5, SI-4 |
| 47 | Defender & Monitoring | Technical | Review Secure Score, attack paths, recommendations, and threat alerts. | Defender for Cloud, Secure Score, recommendations, alerts | Prioritize critical recommendations, assign owners, remediate findings, and track exceptions. | Are critical recommendations prioritized? Are alerts investigated? | Secure Score report, recommendation backlog, threat alert records, remediation tracker | High | Improves Azure security posture and remediation accountability. | Misconfigurations and active threats may remain unresolved. | Weekly | Locked field | Not Started | Cloud Security Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST RA-5, CA-7 |
| 48 | Logging & Monitoring | Technical | Enable Azure Activity Logs and Microsoft Entra logs. | Azure Activity Logs, Entra sign-in logs, audit logs, risk logs | Collect and retain control-plane, identity, sign-in, audit, and risk events. | Are subscription and identity logs collected? Are logs retained and protected? | Diagnostic settings, Log Analytics workspace, Entra logs, retention configuration | Critical | Provides visibility into administrative and identity activity. | Unauthorized changes or account compromise may not be investigated. | Monthly | Locked field | Not Started | Monitoring Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST AU-2, AU-6 |
| 49 | Logging & Monitoring | Technical | Enable diagnostic logs for critical Azure resources. | Azure Monitor, diagnostic settings, Log Analytics | Enable logs for firewall, NSGs, WAF, Key Vault, Storage, SQL, VMs, App Services, AKS, and backup services. | Are diagnostic settings enabled everywhere? Are logs sent to the correct workspace? | Diagnostic settings export, workspace coverage report, data collection rules | High | Creates visibility for security detection, audit, and forensics. | Security events may be missed or unavailable during investigation. | Monthly | Locked field | Not Started | Monitoring Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AU-12 |
| 50 | Logging & Monitoring | Technical | Configure log retention and protect logging workspaces. | Log Analytics workspaces, retention, RBAC, resource locks | Set retention based on compliance and forensic needs. Restrict access and deletion of logs and workspaces. | Does retention meet requirements? Are logs protected from deletion? | Workspace retention settings, RBAC assignments, resource locks, policy settings | High | Preserves evidence for investigations and compliance. | Logs may be unavailable or deleted during an incident. | Quarterly | Locked field | Not Started | SOC Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST AU-11 |
| 51 | Sentinel & Response | Technical | Connect Microsoft Sentinel to required Azure and Microsoft security data sources. | Microsoft Sentinel, data connectors, Log Analytics | Connect Entra ID, Azure Activity, Defender for Cloud, Defender for Endpoint, firewall, WAF, VM, Key Vault, Storage, and database logs. | Are all required data sources connected? Are logs flowing? Are connector failures monitored? | Sentinel connector list, data ingestion report, connector health, workspace logs | Critical | Improves detection, correlation, and incident response. | Delayed detection, poor correlation, and incomplete forensic evidence. | Monthly | Locked field | Not Started | SOC Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST SI-4, IR-5 |
| 52 | Sentinel & Response | Technical | Configure Sentinel analytics rules, incidents, watchlists, and automation playbooks. | Microsoft Sentinel, analytics rules, playbooks, incidents | Create and tune analytics rules, build watchlists for critical assets and privileged users, and test SOAR playbooks. | Are analytics rules tuned? Are playbooks tested? Are incidents assigned and tracked? | Analytics rule review, playbook test records, incident queue, watchlists | High | Improves threat detection and response automation. | Manual response delays and missed correlations may increase breach impact. | Monthly | Locked field | Not Started | SOC Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST IR-4, IR-5 |
| 53 | Backup & Recovery | Technical | Enable Azure Backup for critical VMs and workloads. | Azure Backup, Recovery Services Vault, Backup Vault | Enable backup for critical workloads, configure retention, and monitor backup success and failures daily. | Are backups enabled? Are backup jobs successful? Are failures escalated? | Backup reports, vault settings, retention policy, failure alerts | Critical | Ensures recoverability after deletion, ransomware, corruption, or outage. | Data loss, downtime, failed recovery, and ransomware payment pressure. | Daily | Locked field | Not Started | Backup Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST CP-9 |
| 54 | Backup & Recovery | Technical | Protect backup vaults and test restores. | Recovery Services Vault, soft delete, immutability, restore testing | Enable soft delete, immutability where appropriate, restricted administration, and quarterly restore testing. | Are restores tested? Are vaults protected? Are immutable protections configured? | Vault security settings, restore test records, ransomware protection settings | Critical | Validates recovery and reduces ransomware impact. | Backups may be deleted, corrupted, or unusable when needed. | Quarterly | Locked field | Not Started | Backup Owner | Locked remediation notes | Locked field | Locked exception notes | 115 | NIST CP-10 |
| 55 | Compliance | Administrative | Map Azure controls to applicable compliance requirements. | Azure Policy, Defender compliance dashboard, evidence repository | Map controls to HIPAA, PCI DSS, NIST, CIS, ISO 27001, SOC 2, or internal policies as applicable. | Are standards mapped? Are gaps assigned? Is evidence maintained? | Compliance mapping, regulatory dashboard, evidence repository, remediation tracker | High | Supports compliance readiness and governance. | Audit gaps, unmanaged regulatory risk, and inconsistent controls. | Quarterly | Locked field | Not Started | Compliance Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | HIPAA, PCI, NIST, CIS, ISO |
| 56 | Compliance | Administrative | Document exceptions, residual risk, and compensating controls. | Risk register, exception register, approvals | Ensure exceptions have owner, approval, business justification, expiration date, and compensating controls. | Are exceptions documented and time-bound? Are compensating controls validated? | Exception register, risk acceptance approvals, review records | High | Prevents permanent undocumented security gaps. | Untracked exceptions may become long-term unmanaged risk. | Monthly | Locked field | Not Started | Risk Owner | Locked remediation notes | Locked field | Locked exception notes | 90 | NIST RA-3, POA&M |
| 57 | Cost & Optimization | Administrative | Review unused and orphaned Azure resources. | Subscriptions, public IPs, disks, NICs, storage, snapshots | Identify and remove unused public IPs, VMs, disks, NICs, load balancers, snapshots, and unowned resources. | Are unused resources removed? Are orphaned resources investigated? Are resources tagged? | Cost reports, unused resource inventory, tag compliance report, asset inventory | Medium | Reduces attack surface and unnecessary cloud spend. | Unused resources may remain exposed, unpatched, and costly. | Monthly | Locked field | Not Started | Cloud Operations Owner | Locked remediation notes | Locked field | Locked exception notes | 65 | NIST CM-8 |
| 58 | Cost & Optimization | Administrative | Review Defender licensing and security-versus-cost decisions. | Defender plans, licensing, cost management | Confirm security plans are enabled for critical workloads and cost reductions do not disable required protections. | Is Defender coverage cost-effective? Are critical workloads protected? | Defender licensing review, cost report, workload criticality list | Medium | Balances security coverage and cloud cost management. | Critical workloads may lose security visibility due to cost-cutting. | Quarterly | Locked field | Not Started | Cloud Security Owner | Locked remediation notes | Locked field | Locked exception notes | 65 | FinOps; NIST PM-3 |
| 59 | Operations | Administrative | Maintain an Azure security remediation roadmap. | Risk register, remediation backlog, executive reporting | Prioritize improvements by risk, business impact, exposure, and compliance requirements. Assign owners and target dates. | Are improvements prioritized by risk? Are owners assigned? Is progress reported? | Security roadmap, executive risk reports, remediation tracker | Medium | Creates long-term improvement plan for sustainable Azure security maturity. | Security gaps may remain unresolved without ownership or sequencing. | Quarterly | Locked field | Not Started | Security Leadership | Locked remediation notes | Locked field | Locked exception notes | 65 | NIST CA-5 |
| 60 | Operations | Administrative | Perform continuous Azure security operations reviews. | Defender, Sentinel, Azure Policy, RBAC, network, backups | Review posture, alerts, incidents, access, firewall rules, vulnerabilities, backups, and exceptions on a recurring schedule. | Are security reviews recurring? Are metrics reported? Are stale risks closed? | Monthly review minutes, KPI dashboard, incident metrics, remediation progress | Medium | Ensures Azure security remains effective as the environment changes. | Configuration drift and unresolved risks may grow over time. | Monthly | Locked field | Not Started | Security Operations Owner | Locked remediation notes | Locked field | Locked exception notes | 65 | NIST CA-7 |
Resilience and continuity
Secure Azure workloads need backup, recovery, and tested failover planning.
Azure security should include more than prevention. Recovery planning, backup configuration, logging, alerting, and tested restoration help reduce downtime and business impact when incidents happen.
Enable Azure Backup and recovery controls for critical VMs, databases, and storage.
Protect management access to backup and recovery systems with MFA and privileged access controls.
Document recovery objectives, retention, evidence, and recurring restoration tests.
From findings to implementation
Turn Azure audit findings into prioritized security improvements.
Start with the Azure Cloud Security Readiness Check when you need an initial review. For independent validation, evidence, and a risk-based remediation roadmap, request an Azure security audit.
Implementation and ongoing operations
When audit findings require configuration, monitoring, backup, or day-to-day Azure administration, Azure managed services through IT Perfection can support the technical work. Review Ali Hassani's cybersecurity and infrastructure experience for professional background and credentials.
CISO-led guidance
Managed by Ali Hassani with 25+ years of IT, cybersecurity, compliance, Microsoft infrastructure, and cloud security experience.
Ali Hassani helps organizations connect Azure technical controls to executive risk, compliance readiness, remediation priorities, and operational resilience. His background includes Microsoft infrastructure, Azure, Microsoft 365 security, network security, firewall security, vulnerability management, compliance auditing, and IT operations.
CISSPCCISOCCNPCCNAMCSEMCSA SecurityMCITPMCPMCTS
FAQ
Microsoft Azure cloud security audit questions.
What is an Azure cloud security audit?
An Azure cloud security audit reviews controls across identity, subscriptions, networks, workloads, data, monitoring, backup, and compliance evidence so security gaps can be documented and prioritized.
Is this different from Azure implementation support?
Yes. An Azure security audit identifies gaps, evidence needs, and risk. Implementation support turns those findings into working controls such as Conditional Access, Defender for Cloud, Azure Firewall, Sentinel logging, backup protection, and governance policies.
Does Azure security include Microsoft Entra ID?
Yes. Entra ID is central to Azure security because administrator roles, MFA, Conditional Access, enterprise applications, PIM, service principals, and risky sign-ins can directly affect tenant and workload security.
How should the Azure checklist be used?
The checklist helps organize Azure control review, evidence requests, ownership, risk scoring, and remediation planning. A professional review is still needed when the business requires independent validation, audit-ready reporting, or executive risk guidance.
Do you support Irvine and Orange County businesses?
Yes. OC Security Audit supports businesses in Irvine, Orange County, Los Angeles County, and Southern California that need Azure security, Microsoft 365 security, compliance readiness, and practical remediation guidance.
Audit Azure security with confidence
Turn Azure security gaps into evidence, priorities, and a practical roadmap.
OC Security Audit helps organizations review Microsoft Azure security controls that support risk reduction, compliance readiness, cyber insurance discussions, and resilient cloud operations.