We live in a rapidly evolving security landscape π π‘ with new challenges every day. Even after the pandemic, our work continues to be blended with remote work where many organizations enabled the BYOD policies to increase productivity of the people.
Growing landscape of cybersecurity attacks
Relaxed controls on IT assets, welcomed potential vulnerabilities, and attack surfaces are also expanded adding layers of complexity to corporate IT to perform their task to defend and enable organizational services.
Zero Trust model aligned services
Zero Trust model offered by leading industry players likeΒ MicrosoftΒ offers comprehensive solutions to our security challenges. Let’s consider those services and their benefits that are listed below:
β Security Posture Management It is enhanced with Azure Policy and Azure Blueprints by defining and enforcing compliance and control guardrails on Azure resources
β Identities Are strengthened using Entra ID (aka, Azure AD) providing robust authentication and authorization.
β Endpoint Management Services like Microsoft Intune and Entra ID Join manage the corporate and BYOD devices with strict compliance
β Web App protection Azure Defender for Cloud & Azure Web Application Firewall (WAF) protects app services by using bleeding-edge security features
β Data security Remains top priority in transit and rest with advanced security features of Azure Storage services by providing encrypted, reliable, and scalable solutions
β Infrastructure security Secrets and certificates are protected with Azure Key Vault services and Microsoft Defender for Cloud offers comprehensive threat protection from day zero
β Network Security Azure network services like Azure Firewall and Virtual Networks are ensuring traffic is secure and segmented
β Conditional Access & Controls App and data access is guarded by Microsoft Defender for Cloud Apps and Conditional Access services by enforcing specific access controls and providing visibility of your SaaS app landscape to help protect your apps.
β Modern SIEM and SOAR solution The Azure Sentinel stands as a cloud-native solution that combines capabilities by centralizing threat detection and response.
In Summary
In summary, Microsoft Azure provides tools and services that are specifically designed to address growing concerns of vulnerabilities that your IT and Security team are tasked to deal with by following Zero Trust principles.
[π Credit] Microsoft Zero Trust & Conditional Access docs
Subscribe to the #cloudmarathoner LinkedIn #tag ππ Stay tuned for more Cloud, Automation & Security-related posts.
π Check out the LinkedIn post π https://www.linkedin.com/posts/elkhanyusubov_cloudmarathoner-tag-cloudmarathoner-activity-7106249128782749696-4k0j #sharingiscaringΒ β€οΈ
If you have been implementing your customers with the management of enterprise subscriptions and policies, then it is a pretty common need to automate the provisioning of those subscriptions in a controlled and secure manner.
The good news is that you don’t have to reinvent the wheel and do everything from scratch. The Microsoft team that is behind the Azure Landing Zones implementation has a good reference that could tremendously help you.
MicrosoftΒ Global Customer Success team
Have you ever checked the subscription vending IaC Modules from theΒ MicrosoftΒ Global Customer Success team (the same team behind Azure Landing Zones)?
Subscription Vending IaC Modules
Well, if not then Subscription Vending IaC Modules are available for you in two popular infrastructure-as-code (IaC) tools: Bicep and Terraform. AND designed to help you implement the best practices for subscription provisioning.
Why use these modules?
Using these modules, you can quickly and easily provision new Azure subscriptions that are pre-configured to meet your organization’s specific needs. The modules include parameters/variables for Role-Based Access Control, Networking, Tags, and more.
So, what is your preferred way to provision Azure subscriptions β π€ Please, share your feedback π¬ in the comments or in the followingΒ LinkedIn post.
Anyone who manages Azure resources knows that consistent naming is key to understanding what a service is, where its location and purpose, and to whom it belongs to.
Are there any tools?
In a recent couple of days, I was exploring a tool/framework that could help me with consistent naming of cloud resources issues. And I was nicely surprised to find the Azure Naming Tool v2.
“The Azure Naming Tool was created to help administrators define and manage their naming conventions while providing a simple interface for users to generate a compliant name.”
What is it for?
The tool was developed using a naming pattern based on Microsoft’s best practices. Once an administrator has defined the organizational components, users can use the tool to generate a name for the desired Azure resource.
These recent updates come with globally optional components, multi-type name generation, some style and/or layout updates, and more.
Summary
The Azure Naming Tool was designed to be as extendable and functional as possible. In order to accommodate that flexibility, several architecturalΒ aspects were implemented.
The ANT team will continue to improve the tool and publish updates to the GitHub repository. All feedback is welcome, and feel free to submit a code change if you have a better idea for any part of the tool. Good luck!
I would like to welcome everyone who is landed on this page to check out the Azure Spring Clean 2023 event and Learn new cloud skills!
Before kicking off the topic, I would like to start with a βTHANK YOUβ message for the organizers of the event; especially for Joe, Thomas, and everyone who is involved in making this event a successful experience for everyone!
Note:
Introduction
In the spirit of Azure Spring Clean, we will explore how to organize Azure Security Services using the infrastructure-as-Code (IaC) approach with Azure Bicep.
We will look into how you could declaratively define and deploy your Azure security resources including Azure Policies to tackle real-world business problems. So, get yourself ready for simple yet powerful demos that will turn you into a hero.
And don’t worry, if you are new to Azure Bicep as we will have a super express introduction to this new IaC language to get you started with fundamentals.
Azure Bicep is a new declarative Domain Specific Language (DSL) for provisioning Azure resources. The purpose of Azure Bicep is to simplify the resource creation and management experience with a cleaner syntax and more code reuse.
Declaring resources as IaC
There are many benefits in declaring and managing cloud infrastructure resources as a code. It provides benefits, such as increased compliance, visibility, controlled deployments and versioning of changes that get deployed into your cloud environments.
The following screenshot demonstrates how Azure Bicep declares cloud resources on the left side of the panel:
Organizing cloud resources
No matter how small or big is your project, taking time to think through the approach of how to organize your digital assets is an important task. In Microsoft Azure, you would need to consider a couple of points while trying to make this decision. Namely, you would need to consider the following factors:
Resource Governance approach
Management scopes
IaC management options
Modules, ACR, Template Specs, etc.
Azure Policies for governance
The Azure Policies are assigned with a unique mission to guard the compliance aspect of your cloud resources and workloads. It evaluates resources at specific times (by default happens every 24 hours) during the resource lifecycle changes and the policy assignment lifecycle updates.
Thus, whenever you get a resource created, updated, or deleted within a scope of the monitored compliance, or if you update/create an Azure policy then the compliance evaluation cycle will determine the compliance of these changes by auditing, blocking, or allowing the action to be performed.
Securing storage account options
Note: this section of the post is in progress… It will be presented with the screenshots and GitHub repo for you. Stay tuned, and check in a few days π
video & Demo – a sweet combo
In the video below, I briefly cover the posted information in this blog post which also includes the instructions on how to run the demo and get the scripts to deploy Azure Policies for your Tag Governance scenario.
Without any overdue, here is the video that should be available to you:
The following image is a screenshot from the slide that demonstrates the Bicep code that declares the policy definition and initiative, with the final view of deployment on the Azure portal.
Thank you so much for reading this post and learning about Azure security and compliance and how IaC language Azure Bicep can help you in this journey. This is a bit different perspective to strengthen your resource/workload compliance on Azure using IaC approach.
Please, keep up the good work by securing your organizational and customer cloud environments!
I am really excited and happy to see my session is accepted β for this year’s #AzureSpringClean2023 event π
What is Azure Spring Clean?
The Azure Spring Clean 2023 is an event that promotes well-managed Azure tenants. In order to achieve this goal, organizers encourage the cloud community professionals to create articles that highlight best-practices, and lessons learned, and help with some of the more difficult topics of Azure Management.
Session details
Join me this March, to learn and explore π how to organize Azure Security Services using the IaC approach with Azure Bicep.
We will look into how you could declaratively define and deploy your Azure security resources including Azure Policies to tackle real-world business problems. Thus, get yourself ready for simple yet powerful demos that will turn you into a hero.
In Summary
I would highly encourage everyone to join this event and learn best practices on Azure this spring!
As I always say this motto: The #cloudjourney and learning never stops
What is the Microsoft SOC exam?
I am happy to share that I was able to pass an Azure security certificate before the end of 2022!!!
As you might know, this certification belongs to an important Microsoft Security operations space. I am very glad to finish this year with this achievement.
Studying for this certification helped me gain the skills and knowledge required to reduce my organization’s risk by rapidly remediating active attacks on the environment, advising on improvements to threat protection practices, and referring violations of organizational policies to appropriate people and teams.
As an important part of the exam preparation, I did labs that investigate, respond to, and hunt for threats using Microsoft products, such as Azure Defender, Azure Sentinel, Microsoft 365 Defender, and other related security products.
Summary
Please, let me know if you are targeting this certification. I would be more than glad to provide additional guidance for your preparations!
Thank you everyone for your greetings and wishes on social media. I do really appreciate your continued support!!!
I had a great interaction with Kerry, Head of Marketing at DynamicsSmartzΒ few weeks ago. I was offered to share my technical insights into some of the Microsoft technologies and interesting trends in the Cloud and Security areas. As a Microsoft MVP in Azure, I was really excited to share my take on Cloud Security and Governance topics using this Platfrom.
what is Microsoft Dynamics Influencer Insights?
This program provides a look at what Industry Experts and Influencers have to say about the partner benefits of pursuing Digital Transformation. It is also important to note that Microsoft MVPs are usually providing the technical insights freely for the community benefit.
Insights on Cloud Security and Governance
There are multiple questions on Microsoft tech trends and opportunities that have been addressed in my interview. In addition, I also shared my success mantra that you could check it here.
Today, on August 30th, I have been informed by DynamicsSmartz that my interview has been featured on “The Microsoft Partner Daily” publication. Thank you Kerry for notifying me and great job that you are doing.
Please, let me know your take on my shared tech insights, and what would be the question you want to ask. As usual, please connect with me on @LinkedIn or @Twitter.
The following post is going to be covered in the Azure Spring Clean 2022 event’s website too. Thus, you might be wondering what the Azure Spring Clean is?
Azure Spring Clean 2022 Overview
The Azure Spring Clean is a community-driven event focused on Azure management topics and gradually publishes content from March 14-18, 2022.
I would like sincerely Thank – Joe Carlyle and Thomas Thornton for putting time and effort in organizing this event. From a #cloudmarathoner βs perspective itβs been enjoyable to contribute and be a part of this event. This topic specifically outlines how to understand the pros and cons of your initial Azure AD settings that will be aligned with your project’s expectations.
Indeed, this is a very legit question and I would like to address it with the following quote from Alex Weinert:
…our telemetry tells us that more than 99.9% of organization account compromise could be stopped by simply using MFA, and that disabling legacy authentication correlates to a 67% reduction in compromise risk (and completely stops password spray attacks, 100% of which come in via legacy authentication)…
Alex Weinert – Director of Identity Security at Microsoft
The main purpose behind these default settings is to make sure that all organizations using Azure AD have a basic level of security, and it is enabled at no extra cost according to Microsoft.
Azure AD security defaults are something you need to enable at the tenant level. Once you do this, the rules will apply to all users in your tenant without any exceptions.
If you are looking for enforce rules more selectively ( or exclude some users ) then security defaults wonβt be a fit solution for you. For this scenario, you would need to look at getting some P1 or P2 licenses and use the conditional access instead.
How can I set up my Azure AD Security Defaults?
The Microsoft Azure AD team did a fantastic job by simplifying this option. You need to navigate int0 Azure AD -> Properties -> and click on link Manage Security defaults.
You will end-up with the following window on the right panel of Azure portal:
Enabling Security Defaults in Azure AD
What is baked inside the security defaults in azure ad?
There are a number of things baked into the “Security Defaults” by Azure AD team. You could read about an official and detailed description here – Security defaults in Azure AD.
One of the BIG incentives for the security defaults is that it brings Multi-Factor Authentication (MFA) to your users for #free. Of course, there are some limitations around this which I will cover later on, but this option does allow you to get an MFA with no additional cost.
Previously, you would have to have either Azure AD P1 licenses, or pay per use for MFA functionality. Thus, this is a big game changer benefit that you are getting for free in your tenant and will bring a significant extra level of security. And this defaults includes both Azure and Office 365 services.
Along with MFA, security defaults are enforcing several policies that make your tenant more secure:
Requiring all users to sign up for MFA (for free)
Requiring those in Azure administrator roles to perform MFA
Blocking legacy authentication protocols – this includes clients that donβt use modern authentication and so donβt support MFA, and older mail protocols like IMAP, SMTP and POP3
Requiring MFA authentication when undertaking privileged actions using the Azure portal, PowerShell or CLI
Will Security Defaults replace my Azure AD licenses ?
In short, the answer is No. Your Azure AD licenses provide more security protection services than what you get from “Security Defaults”.
Think of a “Security Defaults” as a security design approach for users on a free Azure AD tier. Because, if you are already using P1 or P2 licenses you would want to look at using conditional access to perform this (and more) rather than security defaults.
What you need to know before deploying the Security Defaults?
Based on Microsoft security guidelines, every organization should have at least two emergency access accounts configured. These accounts are intended for use when your regular administrator account’s can not be used. A typical example is: when person with the most recent Global Admin access has left your company.
What are the emergency access accounts ? Well, following three criteria defines it pretty well:
Aren’t used on a daily basis
Are protected with a long complex password
Has an assigned Global Administrator rights in Azure AD
These emergency access accounts and credentials are very sensitive and should be stored in a secure location like a fireproof safe. And only authorized people in your organization should have access to these accounts.
What to do when switching from Security Defaults to azure ad Conditional Access Policies?
In order to provide more productivity and better security to your users, you could replicate the policies created by Azure AD Security Defaults. First, your customerβs tenant must be licensed with Azure AD Premium P2. However, the majority of policies can also be accomplished using the Azure AD Premium P1 license.
Check out the following Microsoft documented guides on how you can use Conditional Access to configure equivalent policies to the once that get set by the security defaults:
All these policies could be implemented with Premium P1 license, except the last one. The last policy requires Azure AD Identity Protection feature of the Azure AD and could be provided via Premium P2 license.
Summary
Thank you so much for reading this post and learning about the Azure AD Security defaults. I tried my best to provide my perspective on this important topic while using availiable Microsoft docs and resources.
Please, keep up the good work by securing your and customer’s cloud environments!
I am very excited to see you all in the next Omaha Azure User Group meetup. This time we will speak about the latest advancements and use cases you could apply in your Azure resource authoring toolkit.
As you may know, it is that time of a year when great content will be coming to the town! You could enjoy and learn throughout the month of December, as people behind the #festivetechcalendar will be bringing you lots of new content from different communities and people around the globe.
This year, I have submitted two sessions and have been nicely surprised yesterday. Both sessions have been accepted and I am looking forward to deliver following sessions for the community:
Session # 1: What you need to know about Azure AD security defaults?
Accepted session – “What you need to know about Azure AD security defaults?“
In this session above, we will discuss about how to get started with Azure security on right foot and its challenges. We will focus on importance of a strong Identity and Access in any cloud solution that we are creating for our customers. One simple way to get started is review and adjustment of security default options in Azure AD. We will also look into the set of practices to get you started with Azure AD setup and learn about the benefits of Azure Security Benchmark.
Session # 2: All you need to know about Azure Bicep configurations
Accepted session -“All you need to know about Azure Bicep configurations”
In the second session, we will talk about Azure Bicep – a new language that aims to ease Azure resource authoring and management. This new language comes with a powerful VS Code extension and config file options. In this session, we will unveil dozens of powerful features in our config file to suit your style of coding on VS Code and cheer up our productivity skills. We will apply our fresh skills by creating several Bicep demos in the process.
Conclusion
I sincerely hope that these sessions will spark your interest and I am looking forward to see you all during this event. But most importantly, I hope you could have lots of fun during this festive month.
Stay tuned for more Azure AD, Automation & Security related posts.
