Building Azure Right: A Practical Checklist for Infrastructure Landing Zones
When the Gaps Start Showing A few months ago, we walked into a high-priority Azure environment review for a customer dealing with inconsistent deployments and rising costs. After a few discovery sessions, the root cause became clear: while they had resources running, there was no consistent foundation behind them. No standard tagging. No security baseline. No network segmentation strategy. In short—no structured Landing Zone. That situation isn't uncommon. Many organizations sprint into Azure workloads without first planning the right groundwork. That’s why having a clear, structured implementation checklist for your Landing Zone is so essential. What This Checklist Will Help You Do This implementation checklist isn’t just a formality. It’s meant to help teams: Align cloud implementation with business goals Avoid compliance and security oversights Improve visibility, governance, and operational readiness Build a scalable and secure foundation for workloads Let’s break it down, step by step. 🎯 Define Business Priorities Before Touching the Portal Before provisioning anything, work with stakeholders to understand: What outcomes matter most – Scalability? Faster go-to-market? Cost optimization? What constraints exist – Regulatory standards, data sovereignty, security controls What must not break – Legacy integrations, authentication flows, SLAs This helps prioritize cloud decisions based on value rather than assumption. 🔍 Get a Clear Picture of the Current Environment Your approach will differ depending on whether it’s a: Greenfield setup (fresh, no legacy baggage) Brownfield deployment (existing workloads to assess and uplift) For brownfield, audit gaps in areas like scalability, identity, and compliance before any new provisioning. 📜 Lock Down Governance Early Set standards from day one: Role-Based Access Control (RBAC): Granular, least-privilege access Resource Tagging: Consistent metadata for tracking, automation, and cost management Security Baselines: Predefined policies aligned with your compliance model (NIST, CIS, etc.) This ensures everything downstream is both discoverable and manageable. 🧭 Design a Network That Supports Security and Scale Network configuration should not be an afterthought: Define NSG Rules and enforce segmentation Use Routing Rules to control flow between tiers Consider Private Endpoints to keep services off the public internet This stage sets your network up to scale securely and avoid rework later. 🧰 Choose a Deployment Approach That Fits Your Team You don’t need to reinvent the wheel. Choose from: Predefined ARM/Bicep templates Infrastructure as Code (IaC) using tools like Terraform Custom Provisioning for unique enterprise requirements Standardizing this step makes every future deployment faster, safer, and reviewable. 🔐 Set Up Identity and Access Controls the Right Way No shared accounts. No “Owner” access to everyone. Use: Azure Active Directory (AAD) for identity management RBAC to ensure users only have access to what they need, where they need it This is a critical security layer—set it up with intent. 📈 Bake in Monitoring and Diagnostics from Day One Cloud environments must be observable. Implement: Log Analytics Workspace (LAW) to centralize logs Diagnostic Settings to capture platform-level signals Application Insights to monitor app health and performance These tools reduce time to resolution and help enforce SLAs. 🛡️ Review and Close on Security Posture Before allowing workloads to go live, conduct a security baseline check: Enable data encryption at rest and in transit Review and apply Azure Security Center recommendations Ensure ACC (Azure Confidential Computing) compliance if applicable Security is not a phase. It’s baked in throughout—but reviewed intentionally before go-live. 🚦 Validate Before You Launch Never skip a readiness review: Deploy in a test environment to validate templates and policies Get sign-off from architecture, security, and compliance stakeholders Track checklist completion before promoting anything to production This keeps surprises out of your production pipeline. In Closing: It’s Not Just a Checklist, It’s Your Blueprint When implemented well, this checklist becomes much more than a to-do list. It’s a blueprint for scalable, secure, and standardized cloud adoption. It helps teams stay on the same page, reduces firefighting, and accelerates real business value from Azure. Whether you're managing a new enterprise rollout or stabilizing an existing environment, this checklist keeps your foundation strong. Tags - Infrastructure Landing Zone Governance and Security Best Practices for Azure Infrastructure Landing Zones Automating Azure Landing Zone Setup with IaC Templates Checklist to Validate Azure Readiness Before Production Rollout Monitoring, Access Control, and Network Planning in Azure Landing Zones Azure Readiness Checklist for ProductionMicrosoft Azure Cloud HSM is now generally available
Microsoft Azure Cloud HSM is now generally available. Azure Cloud HSM is a highly available, FIPS 140-3 Level 3 validated single-tenant hardware security module (HSM) service designed to meet the highest security and compliance standards. With full administrative control over their HSM, customers can securely manage cryptographic keys and perform cryptographic operations within their own dedicated Cloud HSM cluster. In today’s digital landscape, organizations face an unprecedented volume of cyber threats, data breaches, and regulatory pressures. At the heart of securing sensitive information lies a robust key management and encryption strategy, which ensures that data remains confidential, tamper-proof, and accessible only to authorized users. However, encryption alone is not enough. How cryptographic keys are managed determines the true strength of security. Every interaction in the digital world from processing financial transactions, securing applications like PKI, database encryption, document signing to securing cloud workloads and authenticating users relies on cryptographic keys. A poorly managed key is a security risk waiting to happen. Without a clear key management strategy, organizations face challenges such as data exposure, regulatory non-compliance and operational complexity. An HSM is a cornerstone of a strong key management strategy, providing physical and logical security to safeguard cryptographic keys. HSMs are purpose-built devices designed to generate, store, and manage encryption keys in a tamper-resistant environment, ensuring that even in the event of a data breach, protected data remains unreadable. As cyber threats evolve, organizations must take a proactive approach to securing data with enterprise-grade encryption and key management solutions. Microsoft Azure Cloud HSM empowers businesses to meet these challenges head-on, ensuring that security, compliance, and trust remain non-negotiable priorities in the digital age. Key Features of Azure Cloud HSM Azure Cloud HSM ensures high availability and redundancy by automatically clustering multiple HSMs and synchronizing cryptographic data across three instances, eliminating the need for complex configurations. It optimizes performance through load balancing of cryptographic operations, reducing latency. Periodic backups enhance security by safeguarding cryptographic assets and enabling seamless recovery. Designed to meet FIPS 140-3 Level 3, it provides robust security for enterprise applications. Ideal use cases for Azure Cloud HSM Azure Cloud HSM is ideal for organizations migrating security-sensitive applications from on-premises to Azure Virtual Machines or transitioning from Azure Dedicated HSM or AWS Cloud HSM to a fully managed Azure-native solution. It supports applications requiring PKCS#11, OpenSSL, and JCE for seamless cryptographic integration and enables running shrink-wrapped software like Apache/Nginx SSL Offload, Microsoft SQL Server/Oracle TDE, and ADCS on Azure VMs. Additionally, it supports tools and applications that require document and code signing. Get started with Azure Cloud HSM Ready to deploy Azure Cloud HSM? Learn more and start building today: Get Started Deploying Azure Cloud HSM Customers can download the Azure Cloud HSM SDK and Client Tools from GitHub: Microsoft Azure Cloud HSM SDK Stay tuned for further updates as we continue to enhance Microsoft Azure Cloud HSM to support your most demanding security and compliance needs.Cloud Security as a City Planner: A Guide to Azure Well-Architected Framework’s Security Pillar
Creating and keeping your cloud environment secure has never been more important. Whether you're expanding your cloud footprint or revisiting an Azure deployment that’s been in production for a while, the security pillar of the Microsoft Azure Well-Architected Framework has you covered with a solid security strategy. Microsoft designed the Well-Architected Framework to help everyone build more secure, efficient, and reliable cloud applications. Let’s dive into a few of the key components of the framework's Security pillar and explore how you can secure your Azure environment, step by step. Think of designing secure applications like you are planning a bustling city. You need to give city workers (users) only the access they need to do their jobs. You need to have multiple layers of security (defense in depth), such as security cameras and locked doors, and you need to ensure you are building your city’s infrastructure with the safest materials right from the start (secure defaults). By following these guidelines, you’ll create applications that can be as resilient as a well-planned city. Security Baseline Establishing a security baseline is like setting the building codes and regulations for your city. This step is crucial for maintaining a secure cloud environment. Define well-thought-out security configurations and settings to ensure compliance and protect against threats. Start by assessing your current security posture to pinpoint gaps and areas for improvement. Then, set and enforce security policies that match your organization’s goals. Keep an eye on this baseline and update it as needed to stay ahead of evolving threats. Threat Modeling Threat modeling is similar to preparing for natural disasters and emergencies. Identify what needs protection, like important buildings and infrastructure (data and applications). Analyze potential threats and how they might exploit vulnerabilities. Implement controls to mitigate these risks and regularly update your threat models to stay ahead of new threats. Data Classification Data classification plays a key role in securing your city’s valuables. Categorize data based on sensitivity and importance. Assign a classification level to each type of data and implement appropriate security access controls. Regularly review and update your data classifications to ensure sensitive information is protected. Network Segmentation Network segmentation is like dividing your city into districts and neighborhoods. Isolate critical systems and data to limit the lateral movement of attackers. Use Azure Virtual Networks (VNets) to create isolated environments and apply micro-segmentation with Network Security Groups (NSGs) to control traffic. Implement Azure Firewall to monitor and enforce policies. Identity and Access Management (IAM) Effective identity and access management (IAM) is about knowing who gets access to which buildings in your city. Use multi-factor authentication (MFA) for additional verification and implement role-based access control (RBAC) to assign permissions based on roles. Regularly review and adjust access controls as needed. Network Controls Like keeping the communication lines and transportation routes in your city safe, you need to do the same with your network traffic. Use Virtual Private Networks (VPNs) for secure connections and encrypt data in transit with protocols like TLS. Monitor and control network traffic using NSGs and Azure Firewall to allow only authorized traffic. Secret Storage (Encryption) Like the blueprints and plans for your city’s infrastructure, securing your application secrets, like API keys and connection strings, is crucial. Store secrets securely using Azure Key Vault. Regularly rotate and update secrets to minimize the risk of unauthorized access, and restrict access based on the principle of least privilege. Monitoring and Threat Detection Continuous monitoring and threat detection are essential. It’s like having a dedicated team of city inspectors and surveillance systems. Use tools like the Azure Security Center and Microsoft Sentinel to monitor resources and receive alerts on potential threats. Develop and test incident response plans to handle security incidents quickly. Regularly review and update your strategies to address new threats. Incident Response Plan A well-defined incident response plan is vital for handling security breaches. You need to outline the steps to take during a security incident, including detection, containment, eradication, and recovery. Regularly review, test and update your incident response plan for effectiveness. Tradeoffs When you're designing your workload’s security be sure to think about how choices based on the Security principles and the tips in the Security section might affect other aspects and other pillars in the design framework. Some security decisions might be great for certain areas but could mean compromises for others. Conclusion Security is ongoing work that requires continuous assessment and improvement. By using the guidance provided in the Security section of the Azure Well-Architected Framework, you can help ensure a secure and resilient Azure environment. To dive deeper into the Well Architected Framework’s security pillar, check out the library on Microsoft Learn. Please bookmark the Azure Infrastructure Blog as we continue to publish weekly blogs to help keep you safe on Azure.Securing the digital future: Advanced firewall protection for all Azure customers
Introduction In today's digital landscape, rapid innovation—especially in areas like AI—is reshaping how we work and interact. With this progress comes a growing array of cyber threats and gaps that impact every organization. Notably, the convergence of AI, data security, and digital assets has become particularly enticing for bad actors, who leverage these advanced tools and valuable information to orchestrate sophisticated attacks. Security is far from an optional add-on; it is the strategic backbone of modern business operations and resiliency. The evolving threat landscape Cyber threats are becoming more sophisticated and persistent. A single breach can result in costly downtime, loss of sensitive data, and damage to customer trust. Organizations must not only detect incidents but also proactively prevent them –all while complying with regulatory standards like GDPR and HIPAA. Security requires staying ahead of threats and ensuring that every critical component of your digital environment is protected. Azure Firewall: Strengthening security for all users Azure Firewall is engineered and innovated to benefit all users by serving as a robust, multifaceted line of defense. Below are five key scenarios that illustrate how Azure Firewall provides security across various use cases: First, Azure Firewall acts as a gateway that separates the external world from your internal network. By establishing clearly defined boundaries, it ensures that only authorized traffic can flow between different parts of your infrastructure. This segmentation is critical in limiting the spread of an attack, should one occur, effectively containing potential threats to a smaller segment of the network. Second, the key role of the Azure Firewall is to filter traffic between clients, applications, and servers. This filtering capability prevents unauthorized access, ensuring that hackers cannot easily infiltrate private systems to steal sensitive data. For instance, whether protecting personal financial information or health data, the firewall inspects and controls traffic to maintain data integrity and confidentiality. Third, beyond protecting internal Azure or on-premises resources, Azure Firewall can also regulate outbound traffic to the Internet. By filtering user traffic from Azure to the Internet, organizations can prevent employees from accessing potentially harmful websites or inadvertently downloading malicious content. This is supported through FQDN or URL filtering, as well as web category controls, where administrators can filter traffic to domain names or categories such as social media, gambling, hacking, and more. In addition, security today means staying ahead of threats, not just controlling access. It requires proactively detecting and blocking malicious traffic before it even reaches the organization’s environment. Azure Firewall is integrated with Microsoft’s Threat Intelligence feed, which supplies millions of known malicious IP addresses and domains in real time. This integration enables the firewall to dynamically detect and block threats as soon as they are identified. In addition, Azure Firewall IDPS (Intrusion Detection and Prevention System) extends this proactive defense by offering advanced capabilities to identify and block suspicious activity by: Monitoring malicious activity: Azure Firewall IDPS rapidly detects attacks by identifying specific patterns associated with malware command and control, phishing, trojans, botnets, exploits, and more. Proactive blocking: Once a potential threat is detected, Azure Firewall IDPS can automatically block the offending traffic and alert security teams, reducing the window of exposure and minimizing the risk of a breach. Together, these integrated capabilities ensure that your network is continuously protected by a dynamic, multi-layered defense system that not only detects threats in real time but also helps prevent them from ever reaching your critical assets. Image: Trend illustrating the number of IDPS alerts Azure Firewall generated from September 2024 to March 2025 Finally, Azure Firewall’s cloud-native architecture delivers robust security while streamlining management. An agile management experience not only improves operational efficiency but also frees security teams to focus on proactive threat detection and strategic security initiatives by providing: High availability and resiliency: As a fully managed service, Azure Firewall is built on the power of the cloud, ensuring high availability and built-in resiliency to keep your security always active. Autoscaling for easy maintenance: Azure Firewall automatically scales to meet your network’s demands. This autoscaling capability means that as your traffic grows or fluctuates, the firewall adjusts in real time—eliminating the need for manual intervention and reducing operational overhead. Centralized management with Azure Firewall Manager: Azure Firewall Manager provides centralized management experience for configuring, deploying, and monitoring multiple Azure Firewall instances across regions and subscriptions. You can create and manage firewall policies across your entire organization, ensuring uniform rule enforcement and simplifying updates. This helps reduce administrative overhead while enhancing visibility and control over your network security posture. Seamless integration with Azure Services: Azure Firewall’s strong integration with other Azure services, such as Microsoft Sentinel, Microsoft Defender, and Azure Monitor, creates a unified security ecosystem. This integration not only enhances visibility and threat detection across your environment but also streamlines management and incident response. Conclusion Azure Firewall's combination of robust network segmentation, advanced IDPS and threat intelligence capabilities, and cloud-native scalability makes it an essential component of modern security architectures—empowering organizations to confidently defend against today’s ever-evolving cyber threats while seamlessly integrating with the broader Azure security ecosystem.So, you want to have a public IP Address for your application?
In Microsoft Azure, a public IP address is a fundamental component for enabling internet-facing services, such as hosting a web application, facilitating remote access, or exposing an API endpoint. While this connectivity drives functionality, it also exposes resources to the unpredictable and often hostile expanse of the internet. This blog dives deep into the security implications of a public IP in Azure, using a detailed scenario to illustrate potential threats and demonstrating how Azure’s robust toolkit—Network Security Groups (NSGs), Azure DDoS Protection, Azure Firewall, Web Application Firewall (WAF), Private Link, and Azure Bastion—can safeguard against them. Scenario: The exposed e-commerce platform Imagine a small e-commerce business launching its online store on Azure. The infrastructure includes an application gateway hosting a web server with a public IP (e.g., 20.55.123.45), an Azure SQL Database for inventory and customer data, and a load balancer distributing traffic. Initially, the setup works flawlessly, customers browse products, place orders, and the business grows. But one day, the IT team notices unusual activity: failed login attempts spike, site performance dips, and a customer reports a suspicious pop-up on the checkout page. The public IP left with minimal protection has become a target. The threats of public IP exposure A public IP is like an open address in a bustling digital city. It’s visible to anyone with the means to look, and without proper safeguards, it invites a variety of threats: Brute Force Attacks: Exposed endpoints, such as a VM with Remote Desktop Protocol (RDP) or SSH enabled, become prime targets for attackers attempting to guess credentials. With enough attempts, weak passwords can crumble, granting unauthorized access to sensitive systems. Exploitation of Vulnerabilities: Unpatched software or misconfigured services behind a public IP can be exploited. Attackers regularly scan for known vulnerabilities—like outdated web servers or databases—using automated tools to infiltrate systems and extract data or plant malware. Distributed Denial of Service (DDoS) Attacks: A public IP can attract floods of malicious traffic designed to overwhelm resources, rendering services unavailable. For businesses relying on uptime, this can lead to lost revenue and damaged trust. Application-Layer Attacks: Web applications exposed via a public IP are susceptible to threats like SQL injection, cross-site scripting (XSS), or other exploits that manipulate poorly secured code, potentially compromising data integrity or user privacy. Left unprotected, a public IP becomes a liability, amplifying the attack surface and inviting persistent threats from the internet’s darker corners. Azure’s Security Arsenal Azure provides a layered approach to securing resources with public IPs. By leveraging its built-in services, organizations can transform that open gateway into a fortified checkpoint. Here’s how these tools work together to mitigate risks: Azure DDoS Protection Azure DDoS Protection protects from overwhelming public IPs with malicious traffic. Azure DDoS Protection, available for infrastructure protection and as Network & IP Protection SKUs, monitors and mitigates these threats. The Network and IP Protection SKUs uses machine learning to profile normal traffic patterns, automatically detecting and scrubbing malicious floods—such as SYN floods or UDP amplification attacks—before they impact application availability. Azure Web Application Firewall (WAF) When a public IP fronts a web application (e.g., via Azure Application Gateway), the WAF adds application-layer protection. It inspects HTTP/HTTPS traffic, thwarting attacks like SQL injection or XSS by applying OWASP core rule sets. This is critical for workloads where the public IP serves as the entry point to customer-facing services. Network Security Groups (NSGs) NSGs act as a virtual firewall at the subnet or network interface level, filtering traffic based on predefined rules. For the specific scenario above, an NSG should be used to restrict inbound traffic to an Application Gateway’s public IP, allowing only specific ports (e.g., HTTPS on port 443) from trusted sources while blocking unsolicited RDP or SSH attempts. This reduces the attack surface by ensuring only necessary traffic reaches the resource. Azure Private Link Sometimes, the best defense is to avoid public exposure entirely. Azure Private Link allows resources—like Azure SQL Database or Storage—to be accessed over a private endpoint within a virtual network, bypassing the public internet. By pairing a public IP with Private Link for internal services, organizations can limit external exposure while maintaining secure, private connectivity. Azure Bastion For administrative access to backend VMs, exposing RDP or SSH ports via a public IP is a common risk. Azure Bastion eliminates this need by providing a fully managed, browser-based jump box. Admins connect securely through the Azure portal over TLS, reducing the chance of brute force attacks on open ports. Building a Secure Foundation A public IP in Azure doesn’t have to be a vulnerability, it can be a controlled entryway when paired with the right defenses. Start by applying the principle of least privilege with NSGs, restricting traffic to only what’s necessary. Layer on DDoS Protection and Azure Firewall for network-level resilience and add WAF for web-specific threats. Where possible, shift sensitive services to Private Link, and use Bastion for secure management. Together, these services create a multi-tiered shield, turning a potential weakness into a strength. In today’s threat landscape, a public IP is inevitable for many workloads. But leveraging Azure’s built in security tools, your organization can embrace the cloud’s connectivity while keeping threats at bay, allowing you to embrace the cloud without compromising security.How Proactive Network Security Helps Secure Azure Workloads
Today’s network security landscape is a dynamic and challenging frontier. Distributed Denial of Service (DDoS) attacks have escalated, with over 21 million mitigated in 2024—a 53% surge from 2023—peaking at 5.6 terabits per second (Tbps) in Q4, driven by botnets like Mirai variants. Application-layer threats, such as HTTP/HTTPS floods, spiked 548% against telecom sectors, exploiting vulnerabilities in web-facing services. Geopolitical hacktivism has also fueled targeted assaults, with Ukraine seeing a 519% attack increase in 2024. Beyond DDoS, Remote Desktop Protocol (RDP) and Secure Shell (SSH) attacks are on the rise, with over 35% of cloud breaches in 2024 tied to compromised credentials or brute-force attempts on exposed endpoints, according to industry reports. Misconfigured servers, unpatched vulnerabilities (e.g., CVE-2024-3080 in ASUS routers), and weak network policies amplify these risks. For enterprises leveraging Azure’s vast ecosystem, these threats underscore the need to secure virtual networks, public endpoints, and remote access points. Maintaining business continuity, data integrity, and customer trust is crucial. A robust network security strategy strengthens the security and quality of Azure deployments. Proper network security practices ensure availability, so DDoS floods can’t knock critical apps offline, potentially costing you millions if the outage occurs during a peak time. A secure network also helps you protect sensitive data, as network breaches risk customer data, your own IP, and personal data triggering potential compliance violations (e.g. GDPR, CCPA) and loss of trust. These benefits include managing cloud complexity and countering threats like remote access, making proactive network security essential. Application architectures and Azure Native Services for protection Let’s examine two Azure architectures, their threats, and how native services—including Azure Front Door, Azure Firewalls and Azure Network Security Perimeter—mitigate them. Example 1: Multi-Tier Web Application Architecture: A customer-facing web app on Azure App Service, Azure SQL Database backend, and Azure Virtual Network (VNet) connectivity. Traffic flows through Azure Front Door; admins access VMs via RDP/SSH. Threats: - DDoS floods targeting the front-end. - RDP/SSH brute force attacks on exposed VM ports (e.g., 3389, 22). - SQL injection via public endpoints. Azure Services for Protection: Azure Front Door: Acts as a global entry point, providing DDoS protection and Web Application Firewall (WAF) capabilities. It mitigates volumetric and application-layer attacks using Microsoft’s CDN-scale infrastructure, offloading traffic before it reaches the VNET. Azure DDoS Protection: Complements Front Door by protecting VNet resources with real-time traffic analysis, absorbing multi-Tbps floods with 200+ Tbps capacity. Azure Web Application Firewall (WAF): Blocks Layer 7 exploits (e.g., SQL injection, XSS) using OWASP rules. Azure Bastion: Provides secure RDP/SSH access to VMs via a browser-based, managed jumpbox, eliminating public IP exposure for cost-effective dev/test scenarios. Azure Firewall: Inspects VNet traffic, blocking unauthorized RDP/SSH attempts with application-aware rules (e.g., deny port 3389 from untrusted IPs). Network Security Groups (NSGs): Locks down VNet subnets, restricting inbound traffic to trusted sources and protecting against exploits targeting unpatched vulnerabilities (e.g., RDP CVE-2021-34527). Azure Network Security Perimeter: Defines a secure boundary around PaaS services, enforcing centralized policies to block traffic and ensure compliance with organizational standards. Example 2: Microservices with Kubernetes Architecture: A microservices app on Azure Kubernetes Service (AKS), with Azure Load Balancer, Azure Cosmos DB, and API server VNET integration for private network traffic between API server and node pools. Azure Front Door manages ingress; DevOps teams use SSH to manage nodes. Threats: - DDoS targeting public IP resources. - SSH brute-force or credential stuffing on AKS nodes. -insecure network communications between pods, containers running with excessive permissions, leaking of secrets and data breach. - API abuse and container vulnerabilities. Azure Services for Protection: Azure Front Door and Azure Web Application Firewall: Delivers global load balancing and DDoS protection for AKS ingress, filtering floods and Layer 7 threats with integrated WAF, reducing load on downstream services. Azure DDoS Protection: Shields Bastion and Firewall from flood attacks, using adaptive mitigation to maintain uptime. Azure Bastion Developer: Secures SSH access to AKS nodes via private connectivity, avoiding public endpoints—ideal for DevOps workflows. Azure Firewall: Deploys at the VNet edge to filter traffic, blocking SSH exploits and enforcing FQDN-based rules for outbound container updates, thwarting CVE-driven attacks. Network Security Groups (NSGs): Applies granular controls to AKS subnets, denying unauthorized SSH (port 22) or RDP traffic and mitigating risks from misconfigured pods. Azure Network Security Perimeter: Defines a secure boundary around PaaS services, enforcing centralized policies to block traffic and ensure compliance with organizational standards. These tools form a defense-in-depth strategy, leveraging Azure’s scale and intelligence to counter both brute-force and targeted threats. Strategies to help secure your Azure workloads Securing Azure workloads involves consistent monitoring and auditing. Enterprises should use Azure Monitor and Security Center to detect anomalies, such as RDP login spikes or UDP floods, which trigger real-time alerts. Additionally, it is important to audit configurations regularly by reviewing NSGs, Firewall rules, Front Door policies, and Bastion access on a regular basis to correct any misconfigurations, as these are a common cause of breaches according to 2024 data. After monitoring and auditing has succeeded, patching proactively is vital. Update your VMs, containers, and services to address vulnerabilities like CVE-2024-3080, which led to a 3.4 Tbps attack in 2021. After patching, integrate Azure Sentinel with global feeds to preempt exploits or DDOS attacks using Microsoft's threat intelligence. Finally, test your resilience by simulating DDoS and RDP attacks and common vulnerabilities to validate Azure Front Door, Azure Bastion, Azure Firewall, and NSG efficacy, refining your incident response. Protect your business with a network security strategy In network security, threats are multifaceted: DDoS, RDP/SSH exploits, and vulnerabilities threaten Azure workloads, demanding comprehensive security. Azure delivers the tools and native services needed to help fortify your networks against diverse risks. Stay ahead of network threats by integrating security into deployments and maintaining it with monitoring, audits, and testing. While Azure provides the platform, your strategy, including network security, is ultimately what ensures safety.Strengthening Azure infrastructure and platform security - 5 new updates
In the face of AI-driven digital growth and a threat landscape that never sleeps, Azure continues to raise the bar on Zero Trust-ready, “secure-by-default” networking. Today we’re excited to announce five innovations that make it even easier to protect your cloud workloads while keeping developers productive: Innovation What it is Why it matters Next generation of Azure Intel® TDX Confidential VMs (Private Preview) Azure’s next generation of Confidential Virtual Machines now powered by the 5th Gen Intel® Xeon® processors (code-named Emerald Rapids) with Intel® Trust Domain Extensions (Intel® TDX). Enables organizations to bring confidential workloads to the cloud without code changes to applications. The supported VMs include the general-purpose families DCesv6-series and the memory optimized families ECesv6-series. CAPTCHA support for Azure WAF (Public Preview) A new WAF action that presents a visual / audio CAPTCHA when traffic matches custom or Bot Manager rules. Stops sophisticated, human-mimicking bots while letting legitimate users through with minimal friction. Microsoft Learn Azure Bastion Developer (New Regions, simplified secure-by-default UX) A free, lightweight Bastion offering surfaced directly in the VM Connect blade. One-click, private RDP/SSH to a single VM—no subnet planning, no public IP. Gives dev/test teams instant, hardened access without extra cost, jump servers, or NSGs. Azure Azure Virtual Network TAP (Public Preview) Native agentless packet mirroring available for all VM SKUs with zero impact to VM performance and network throughput. Deep visibility for threat-hunting, performance, and compliance—now cloud-native. Microsoft Learn Azure Firewall integration in Security Copilot (GA) A generative AI-powered solution that helps secure networks with the speed and scale of AI. Threat hunt across Firewalls using natural language questions instead of manually scouring through logs and threat databases. Microsoft Learn 1. Next generation of Azure Intel® TDX Confidential VMs (Private Preview) We are excited to announce the preview of Azure’s next generation of Confidential Virtual Machines powered by the 5th Gen Intel® Xeon® processors (code-named Emerald Rapids) with Intel® Trust Domain Extensions (Intel® TDX). This will help to enable organizations to bring confidential workloads to the cloud without code changes to applications. The supported VMs include the general-purpose families DCesv6-series and the memory optimized families ECesv6-series. Azure’s next generation of confidential VMs will bring improvements and new features compared to our previous generation. These VMs are our first offering to utilize our open-source paravisor, OpenHCL. This innovation allows us to enhance transparency with our customers, reinforcing our commitment to the "trust but verify" model. Additionally, our new confidential VMs support Azure Boost, enabling up to 205k IOPS and 4 GB/s throughput of remote storage along with 54 GBps VM network bandwidth. We are expanding the capabilities of our Intel® TDX powered confidential VMs by incorporating features from our general purpose and other confidential VMs. These enhancements include Guest Attestation support, and support of Intel® Tiber™ Trust Authority for enterprises seeking operator independent attestation. The DCesv6-series and ECesv6-series preview is available now in the East US, West US, West US 3, and West Europe regions. Supported OS images include Windows Server 2025, Windows Server 2022, Ubuntu 22.04, and Ubuntu 24.04. Please sign up at aka.ms/acc/v6preview and we will reach out to you. 2. Smarter Bot Defense with WAF + CAPTCHA Modern web applications face an ever-growing array of automated threats, including bots, web scrapers, and brute-force attacks. Many of these attacks evade common security measures such as IP blocking, geo-restrictions, and rate limiting, which struggle to differentiate between legitimate users and automated traffic. As cyber threats become more sophisticated, businesses require stronger, more adaptive security solutions. Azure Front Door’s Web Application Firewall (WAF) now introduces CAPTCHA in public preview—an interactive mechanism designed to verify human users and block malicious automated traffic in real time. By requiring suspicious traffic to successfully complete a CAPTCHA challenge, WAF ensures that only legitimate users can access applications while keeping bots at bay. This capability is particularly valuable for common login and sign-up workflows, mitigating the risk of account takeovers, credential stuffing attacks, and brute-force intrusions that threaten sensitive user data. Key Benefits of CAPTCHA on Azure Front Door WAF Prevent Automated Attacks – Blocks bots from accessing login pages, forms, and other critical website elements. Secure User Accounts – Mitigates credential stuffing and brute-force attempts to protect sensitive user information. Reduce Spam & Fraud – Ensures only real users can submit comments, register accounts, or complete transactions. Easy Deployment and Management – Requires minimal configuration, reducing operational overhead while maintaining a robust security posture. How CAPTCHA Works When a client request matches a WAF rule configured for CAPTCHA enforcement, the user is presented with an interactive CAPTCHA challenge to confirm they are human. Upon successful completion, Azure WAF validates the request and allows access to the application. Requests that fail the challenge are blocked, preventing bots from proceeding further. Getting Started CAPTCHA is now available in public preview for Azure WAF. Administrators can configure this feature within their WAF policy settings to strengthen bot mitigation strategies and improve security posture effortlessly. To learn more and start protecting your applications today, visit our Azure WAF documentation. 3. Azure Bastion Developer—Secure VM Access at Zero Cost Azure Bastion Developer is a lightweight, free offering of the Azure Bastion service designed for Dev/Test users who need secure connections to their Virtual Machines (VMs) without requiring additional features or scalability. It simplifies secure access to VMs, addressing common issues related to usability and cost. To get started, users can sign in to the Azure portal and follow the setup instructions for connecting to their VMs. This service is particularly beneficial for developers looking for a cost-effective solution for secure connectivity. It's now available in 36 regions with a new portal secure by default user experience. Key takeaways Instant enablement from the VM Connect tab. One concurrent session, ideal for dev/test and PoC environments. No public IPs, agents, or client software required. 4. Deep Packet Visibility with Virtual Network TAP Azure virtual network terminal access point enables customers to mirror virtual machine traffic to packet collectors or analytics tools without having to deploy agents or impact virtual machine network throughput, allowing you to mirror 100% of your production traffic. By configuring virtual network TAP on a virtual machine’s network interface, organizations can stream inbound and outbound traffic to destinations within the same or peered virtual network for real-time monitoring for various uses cases, including: Enhanced security and threat detection: Security teams can inspect full packet data in real-time to detect and respond to potential threats. Performance monitoring and troubleshooting: Operations teams can analyze live traffic patterns to identify bottlenecks, troubleshoot latency issues, and optimize application performance. Regulatory compliance: Organizations subject to compliance frameworks such as Health Insurance Portability and Accountability Act (HIPAA), and General Data Protection Regulation (GDPR) can use virtual network TAP to capture network activity for auditing and forensic investigations. Virtual network TAP supports all Azure VM SKU and integrates seamlessly with validated partner solutions, offering extended visibility and security capabilities. For a list of partner solutions that are validated to work with virtual network TAP, see partner solutions. 5. Protect networks at machine speed with Generative AI Azure Firewall intercepts and blocks malicious traffic using the intrusion detection and prevention system (IDPS) today. It processes huge volumes of packets, analyzes signals from numerous network resources, and generates vast amounts of logs. To reason over all this data and cut through the noise to analyze threats, analysts spend several hours if not days performing manual tasks. The Azure Firewall integration in Security Copilot helps analysts perform these investigations with the speed and scale of AI. An example of a security analyst processing the threats their Firewall stopped can be seen below: Analysts spend hours writing custom queries or navigating several manual steps to retrieve threat information and gather additional contextual information such as geographical location of IPs, threat rating of a fully qualified domain name (FQDN), details of common vulnerabilities and exposures (CVEs) associated with an IDPS signature, and more. Copilot pulls information from the relevant sources to enrich your threat data in a fraction of the time and can do this not just for a single threat/Firewall but for all threats across your entire Firewall fleet. It can also correlate information with other security products to understand how attackers are targeting your entire infrastructure. To learn more about the user journey and value that Copilot can deliver, see the Azure blog from our preview announcement at RSA last year. To see these capabilities in action, take a look at this Tech Community blog, and to get started, see the documentation. Looking Forward Azure is committed to delivering secure, reliable, and high-performance connectivity so you can focus on building what’s next. Our team is dedicated to creating innovative, resilient, and secure solutions that empower businesses to leverage AI and the cloud to their fullest potential. Our approach of providing layered defense in depth via our security solutions like Confidential Compute, Azure DDoS Protection, Azure Firewall, Azure WAF, Azure virtual network TAP, network security perimeter will continue with more enhancements and features upcoming. We can’t wait to see how you’ll use these new security capabilities and will be keen to hear your feedback.Cloud security in the fast lane: Navigating PaaS challenges
In the fast-evolving world of cloud computing, Platform as a Service (PaaS) drives innovation, agility, and scalability like never before. As organizations unlock its full potential, ensuring strong security measures remains essential. With the cloud landscape continuously evolving, adopting proactive security strategies helps organizations stay resilient against emerging threats. The security gaps in PaaS Unlike Azure Virtual Networks, which provide a strong security perimeter for compute resources, PaaS services operate in a different security model. While they include network controls, there is an opportunity to enhance granularity and deepen virtual network integrations. Strengthening these areas can help reduce potential security blind spots that attackers might attempt to exploit. Additionally, the reduced visibility into infrastructure and the complexities of shared responsibility models make securing PaaS environments a unique challenge. So, what’s the solution? To bridge these gaps, organizations must adopt a new security paradigm—one that moves beyond traditional models and embraces zero-trust security specifically tailored for PaaS environments. Data exfiltration: The silent threat As organizations increasingly rely on PaaS, the risk of unauthorized data exposure grows. Without proper controls, sensitive data can be maliciously or accidentally leaked, resulting in compliance violations, financial losses, and reputational damage. 🔐 Case study: In a recent incident, attackers exploited misconfigured access controls to exfiltrate sensitive data from a cloud-based platform. The lack of network segmentation and outbound traffic restrictions allowed unauthorized data transfers, going undetected until it was too late. 🔑 The takeaway: To mitigate data exfiltration risks, enforce strict outbound traffic controls, conduct regular access policy audits, and implement monitoring for early threat detection. This proactive approach helps ensure that sensitive data remains safe from both internal and external threats. The visibility void PaaS streamlines deployment by abstracting the underlying infrastructure, though there is an opportunity to enhance visibility into security events. By improving access to logs, network traffic insights, and threat monitoring, organizations can strengthen their ability to detect and respond to potential security incidents more effectively. 🔎 Solution: Organizations must implement comprehensive security telemetry, logging, and automated monitoring tools to gain deeper visibility into their PaaS environments. These solutions help identify potential threats before they escalate into full-blown security incidents. The shared responsibility conundrum Navigating the shared responsibility model in PaaS security can be challenging. While cloud providers secure the underlying infrastructure, customers are responsible for application security, configurations, and access management. A lack of clarity in these roles often leads to security gaps. ⚠️ Case study: In a 2024 breach, attackers exploited inadequate network access controls to access sensitive data without authorization. Although the PaaS platform itself was secure, the incident underscored the importance of implementing strong customer-side security measures. 🔑 The takeaway: Enforcing zero-trust principles, least-privilege access, and strong authentication protocols is essential to mitigate such attacks. Insider threats: The growing risk from within Insider threats continue to be one of the most insidious risks in cloud security, particularly in PaaS environments. While external attackers often capture the spotlight, insiders—whether malicious or negligent—can exploit system vulnerabilities, misconfigurations, or weak access controls to gain unauthorized access to sensitive data. Insiders often have legitimate access to systems and networks, making these threats harder to detect. ⚠️ Case study: In a 2024 breach, an employee’s compromised credentials were used to exfiltrate sensitive customer data from a cloud-based application. The attack went undetected for weeks due to insufficient internal traffic monitoring and overly broad access permissions. 🔑 The takeaway: Address insider threats by implementing strong access controls, continuous monitoring, and proper segmentation of duties Azure's network security perimeter: A game-changer for PaaS security To address the evolving threat landscape in cloud environments, Microsoft Azure has introduced network security perimeter, a powerful innovation that reinforces a multi-layered security approach for PaaS resources. By embracing zero-trust principles and leveraging identity-aware perimeter architectures, organizations can secure their cloud-based assets more effectively than ever before. What makes network security perimeter a must-have? Azure's network security perimeter provides a robust set of features to safeguard PaaS environments. Here’s how it helps secure your cloud assets: ✅ Micro-segmentation and least-privilege access – Take full control over who and what can access your PaaS resources. With finely tuned access rules, administrators can regulate inbound and outbound traffic, enforce least-privilege access, and reduce the attack surface. ✅Data exfiltration prevention – When PaaS resources are in enforced mode, all public traffic is automatically blocked, preventing unauthorized data leaks and ensuring a secure, controlled environment for your sensitive data. ✅Seamless hybrid cloud security – Securely connect your on-premises and cloud environments using private endpoints, eliminating exposure to the public internet. This boosts security in hybrid cloud deployments. ✅ Unified security management – Eliminate the complexity of managing security policies for each PaaS resource individually. Group multiple PaaS resources under a single security profile, simplifying access control and creating a centralized, streamlined security approach. ✅ Enhanced monitoring and compliance – Gain deep visibility into your security posture. With perimeter access logs, organizations can monitor traffic patterns, detect anomalies, and respond to security threats—keeping compliance in check. Key use cases for network security perimeter Azure's network security perimeter offers effective, real-world security solutions tailored for PaaS environments. - Network isolation: Establish a protective perimeter around PaaS resources, blocking unauthorized access and preventing data exfiltration to unauthorized destinations. - Private hybrid connectivity: Enables secure on-prem-to-cloud connections with private endpoints. - Granular access control: Administrators can define explicit access rules, ensuring only trusted users and applications interact with PaaS resources. - Centralized security management: Streamlines security configurations, reducing misconfigurations and minimizing security risks. - Regulatory compliance and auditing: Provides detailed access logs that are essential for audit and compliance readiness, making it easier to meet regulatory requirements. 🚀 Why network security perimeter matters now more than ever The rise in PaaS-targeted attacks demands a stronger defense strategy. The breaches in 2024 made one thing crystal clear: access controls and identity security are mission critical. Network security perimeter closes the security gaps, ensuring only the right entities access your most valuable cloud assets. Final thoughts: future-proofing PaaS security PaaS offers unmatched efficiency, but security must always be a top priority. Organizations need to fortify key pillars such as identity management, data protection, access control, and visibility to defend against evolving cyber threats. By leveraging Azure’s network security perimeter, organizations can go beyond traditional security measures and embrace a more proactive, intelligent, and resilient cloud security posture. 🔹 Ready to take control of your PaaS security? Explore Azure's network security perimeter today and safeguard your cloud journey!Introducing XFF header for Azure Firewall: Gain crucial insights to help stay secure
The X-Forwarded-For (XFF) HTTP header provides crucial insight into the origin of web requests. The header works as a mechanism for conveying the original source IP addresses of clients, and not just across one hop, but through chains of multiple intermediaries. Information embedded in XFF headers is vital to network security to help with both enforcement and auditing. Thus, it’s important for proxies like Azure Firewall to preserve this information when packets flow through the networks. This blog shares Azure Firewall handling XFF headers. How does Azure Firewall handle XFF headers? Proxies can perform several actions on the XFF headers received. This includes preserving the XFF contents received before forwarding to the next hop, augmenting client IP to the XFF header and enforcing policies based on XFF contents. Azure Firewall preserves and augments XFF header based on how the traffic is received and processed. Behavior is detailed below. Traffic/Payload Rule Processed Preserves original content in the XFF header Augment Client IP to the XFF header HTTP payload Application Rules Preserved YES HTTPs payload Application Rules Preserved NO (XFF header is encrypted) HTTPs with TLS termination Application Rules Preserved YES HTTP or HTTPs payload DNAT/Network rules Preserved – Azure Firewall doesn’t impact HTTP headers as traffic is processed at layer 4 Validating Azure Firewall behavior: For this blog, I set up a local environment with NGINX to validate Firewall behavior. This includes a local client running in Azure, Internet client and a NGINX webserver to process http/s traffic. I used a private DNS zone to redirect traffic of a popular domain (example.com) to my NGINX server behind the firewall. HTTP/s client traffic and response: The client sends a http payload to example.com after adding 192.0.2.100 to XFF header. Azure Firewall output: The Azure Firewall receives both HTTP and HTTPs requests as the NGINX server redirects the client HTTP traffic to HTTPs listener. Server XFF header output: For HTTP requests, XFF output displays both the client IP and the appended IP in the curl request. For HTTPs requests, XFF output displays only the IP added by the client. DNAT traffic to the server: Internet clients send https traffic to the NGINX server via Azure Firewall Public IP. Azure Firewall receives the traffic as a DNAT rule and redirects the traffic to the translated destination server. Server XFF header output: Traffic is received with XFF header inserted by the client. Azure Firewall doesn’t impact this header as it receives the traffic on the network. Conclusion: In conclusion, the X-Forwarded-For (XFF) HTTP header plays a crucial role in providing insight into the origin of web requests. It helps convey the original source IP addresses of clients through multiple intermediaries, which is vital for network security, enforcement, and auditing. Azure Firewall's handling of XFF headers ensures that this information is preserved and augmented based on how the traffic is received and processed. By maintaining the integrity of XFF headers, Azure Firewall enhances security measures and provides a reliable mechanism for tracking the source of web traffic.Enhancing VM security: Azure's approach to safer connectivity for all users
When it comes to cloud security, one of the most critical aspects is managing connectivity to your virtual machines (VMs) without exposing them to unnecessary risks. To help you with this, Azure provides secure and seamless remote access to your Azure VMs over TLS – at no added cost - through Azure Bastion Developer, a fully managed, platform-native service. Enabling secure connectivity goes beyond just securing remote access to VMs; it plays an integral role in a broader security strategy for Azure customers under the “Secure-By-Default” initiative. By eliminating the need for public IPs on your VMs and the complexities associated with traditional remote access methods, Bastion Developer fundamentally changes how Azure customers approach security. In this blog, we will discuss how secure connectivity via Bastion Developer enhances security for all Azure customers. Reduced attack surface Public IPs and open ports are significant vulnerabilities in traditional remote access methods. They can be exploited by attackers to gain unauthorized access to your VMs, leading to data breaches, malware infections, and other security incidents. Open ports can also be scanned and targeted by malicious actors, increasing the likelihood of successful attacks. By eliminating the need for public IPs, Bastion Developer minimizes these risks and enhances the overall security of your Azure environment. This secure-by-default approach ensures that your VMs are only accessible through a secure connection to a private IP, safeguarding your sensitive data and resources from external threats. Simplified security management Bastion Developer simplifies security by removing the need for complex VPN configurations, public IPs, and agent-based installation. It’s a centralized, managed solution that integrates directly into your Azure environment, making security management much more straightforward. Additionally, Bastion Developer offers a one-click connection feature, allowing users to securely access their virtual machines without the need for any deployment. This feature enables developers and IT teams to connect to their VMs in just seconds, streamlining the process and enhancing productivity. With no additional infrastructure required, users can enter their VM credentials, click “Connect,” and gain secure access almost instantly in the Azure portal. Bastion Developer also offers CLI-based connectivity for SSH connections. Reduced risk of misconfigurations Bastion Developer's automated and streamlined approach eliminates the risks of human error and configuration mistakes, which can be common source of security vulnerabilities. By eliminating the need for manual configuration or deployment, Azure Bastion Developer eliminates the risks of human error and configuration mistakes that could otherwise lead to insecure access points, making it an accessible option for all Azure customers, regardless of their level of networking expertise. No added cost The best part? Azure Bastion Developer is 100% free with every Azure subscription. This lightweight connectivity offering was made free under Microsoft’s “Secure-by-Default” initiative to ensure that security is accessible and affordable for all Azure users. Unlike traditional public IP methods, which can cost more than $4 per IP address per month, Bastion Developer offers secure connections to one VM at a time at zero additional cost. This affordability removes barriers to robust security by making it more economically viable for developers and IT teams. Additionally, the cost-effectiveness of this service encourages widespread adoption, ensuring that even smaller organizations with limited budgets can benefit from enhanced security measures. This seamless and cost-effective approach ensures that all Azure customers can easily enhance their security posture without incurring extra expenses. Conclusion In Azure, our goal is to offer the most secure platform for our customers as the default. Cyberattacks are becoming more and more common, and exposing VM ports with public IPs increases their vulnerability. Our approach with Bastion Developer is to enable secure connectivity by default without exposing public endpoints -- at no additional cost. We received this feedback from our users, especially developers who need to make brief and limited persistent connections to VMs regularly. With its ability to reduce your attack surface, simplify security management, and integrate seamlessly with the Azure ecosystem, Bastion Developer is a must-have tool for any developer looking to improve their cloud security. Start using Azure Bastion Developer today to secure your Azure VMs and improve your overall security posture at no extra cost.
