A

access control, 77

checking, 82–83

configuring for storage accounts, 234–237

RBAC, 77–78

VMs (virtual machines) and, 159

access keys

manually rotating, 245–246

regenerating, 246

storage account, 243–245

access policies, 275–276

access reviews, 45

account SAS (Shared Access Signatures), 255–257

ACR (Azure Container Registry), 163–165

activity log

Azure Firewall, 126–129

Azure Monitor, 204–205

Add-AzVirtualNetworkPeering cmdlet, 102

adding

administrative units, 21

group members, 9

ADE (Azure Data Encryption), 174–175

administrative units, 21

adding, 21

roles, 23

AKS (Azure Kubernetes), 166–167

logical isolation, 166

Microsoft Defender for Cloud and, 168–169

nodes, 168

physical isolation, 166

alerts

analytics, 221–222

creating, 205–210

Microsoft Defender for Storage, 242–243

rules, 210

simulating, 192–193

viewing, 194–195

Always Encrypted, 266

configuring, 267–268

deterministic encryption, 266–267

randomized encryption, 267

API management policies, 76

application gateways, 44. See also Azure Application Gateway

application objects, 2

applications

assigning a role to, 3–4

registering with Azure AD, 2

apps

assigning users to, 70–73

configuring registration permission scopes, 73–74

managing access, 70

managing registration permission consent, 74–75

registrations, 68–70

architecture

Contoso network diagram, 92

Microsoft Sentinel, 215–217

ASGs (application security groups), 117–118

associating with the VM, 119–120

creating, 118–119

assigning

Azure AD roles

built-in, 83–86

custom, 86–89

permissions to service principals, 3–5

users to apps, 70–73

assigning, RBAC roles to storage accounts, 234–237

auditing a database, 259–262

authentication

Azure AD, 247

Domain Services, 251–252

domain services for Azure files, 247–248

enabling, 248–250

share-level permissions, configuring, 250–251

Azure App Service, 171–173

certificate-based, 66–67

database, 258–259

Federation Services, 61

multifactor

account lockout, 37

block/unblock users, 37–38

fraud alert settings, 38

implementing, 30

OATH tokens, 38–39

performing a bulk reset, 35–36

phone call settings, 39

setting up on Azure AD, 30–34

user administration, 34–37

utilization reports, 40

pass-through, 61

passwordless, 43–45

SAS (Shared Access Signatures), configuring, 253–254

service principals, 76–77

VPN, 107–108

az ad group create command, 9

az storage account update command, 256

AzNetworkSecurityRuleConfig cmdlet, 117

Azure AD (Active Directory), 14, 247, 250

adding and removing members, 9

administrative units, 21

application object, 2

apps

assigning users, 70–73

managing access, 70

managing registration permission consent, 74–75

registrations, 68–70

authentication, 63–66

certificate-based, 66–67

database, 258–259

Domain Services, 251–252

enabling, 248–250

file and folder permissions, configuring, 251

share-level permissions, configuring, 250–251

B2B (business-to-business) accounts, creating, 14–17

built-in roles, 83–86

configuring domain services authentication for Azure files, 247–248

External Collaboration settings, 20–21

Federation Services, 61

groups, 6–7

creating, 7–9

nested, 9–11

guest accounts, creating, 17–19

identities, 1

Identity Protection, 40–43

MFA (multifactor authentication)

account lockout, 37

block/unblock users, 37–38

fraud alert settings, 38

OATH tokens, 38–39

performing a bulk reset, 35–36

phone call settings, 39

setting up, 30–34

utilization reports, 40

pass-through authentication, 61

password synchronization, 60–61

PIM (Privileged Identity Management, 23–26

access review, 45–47

monitoring privileged access for, 47–49

RBAC (role-based access control), 78

custom roles, 86–89

delegating admin rights, 79–80

interpreting role and resource permissions, 81

permissions, 81–82

resource group permissions, 80

registering applications with, 2

resource audit history, viewing, 48–49

self-service password reset, 61–63, 67

service principals, 2–3

assigning permissions through roles, 3–5

authentication, 76–77

certificate-based authentication, 77

creating, 3

UPN suffixes, 59–60

user accounts

administration tasks, 13

creating, 12–13

managing, 12–13

user principals, 2

Azure AD Connect, 50, 59–60

installing, 52–59

pass-through authentication, 61

password synchronization, 60–61

requirements, 50

connectivity, 50–51

deployment accounts, 52

SQL server, 51

UPN suffixes, 59–60

Azure App Service, 169, 173

advantages and limitations, 170–171

authentication, 171–173

CDS (Common Data Service), 173

encryption

ADE (Azure Data Encryption), 174–175

certificates, 175–178

firewall, 146–147

identity providers, 173

security recommendations, 171

Azure Application Gateway

modes, 140

WAF (web application firewall) and, 139–140

Azure Bastion, 93

Azure CLI

commands for backup and recovery, 298

commands for management Key Vault certifications, 287–288

commands for managing Key Vault secrets, 290–291

configuring access policies, 277

creating user delegation SAS, 255

key management commands, 293–294

Azure DDoS protection, 151

basic versus standard tiers, 151

configuring, 152–153

diagnostic logging, 154–155

DoS attack mitigation report, 153–154

Azure Defender for Servers, 159

Azure ExpressRoute, 94

encryption, 109

Microsoft Defender for Storage, 242–243

Azure Firewall, 120–121

activity log, 126–129

configuring, 122–124

Premium tier, 122

rules, 121

application, 124–125

network, 126

Standard tier, 121–122

Azure Firewall Manager, 129–130

Firewall policy, 130

hub virtual network deployment, 131

policies, 130

use cases, 130–131

Azure Front Door, 131

capabilities, 132

configuring, 133–138

Azure Key Vault, 243, 278. See also encryption

backup and recovery, 296–299

certificate policies, 281

certificate-issuance providers, 282

cmdlets for managing certifications, 286

configuring access to, 275

configuring firewalls and virtual networks, 64

creating, 274

firewall, 145–146

key management, 291–294

Azure CLI commands, 293–294

cmdlets, 293

key rotation, 294–295

manage permissions to secrets, certificates, and keys, 275–277

network access rules, 279

RBAC, 277–278

secrets, 288–291

cmdlets, 290

viewing, 289

X509 certificates, managing, 281

Azure Monitor, 201

Activity Log, 204–205

alerts

creating, 205–210

rules, 210

architecture diagram, 202–203

logs

diagnostic, 211–213

security, 213–215

metrics, 203

resources and, 203

Azure Policy, 186–189

Azure portal, creating administrative units, 21

Azure Private Link, isolating data solutions, 270

Azure SQL

Always Encrypted, 266

configuring, 267–268

deterministic encryption, 266–267

randomized encryption, 267

auditing, 259–262

database authentication, 258–259

database encryption, 264–266

dynamic masking, 262–263

firewall, 143–145

masking functions, 263

Microsoft Defender for SQL, configuring, 271–272

vulnerability assessment, 198–199

Azure Storage. See also storage accounts

access keys, 243

manually rotating, 245–246

viewing, 244–245

Azure AD authentication, 247

encryption, 237–239

infrastructure, 239–240

key management, 239

scopes, 240–242

firewall, 141–143

B

B2B (business-to-business) accounts

creating, 14–17

external sharing, 19–21

backup and recovery, Key Vault items, 296–299

blobs

authorizing access to data, 247

Azure Storage encryption, 237–239

Microsoft Defender for Storage, 242–243

user delegation SAS, 254

BYOK (‘Bring Your Own Key’), 264

C

CDS (Common Data Service), 173

centralized policy management, 181

certificate-based authentication, 66–67, 77

certificates

cmdlets, 286

creating, 282–285

importing, 285–286

X509, 281

cloning, roles, 87–89

cloud computing, shared responsibility model, 91

cmdlets, 299. See also PowerShell

Add-AzVirtualNetworkPeering, 102

AzNetworkSecurityRuleConfig, 117

Debug-AzStorage AccountAuth, 250

Get-AzureADTrustedCertificateAuthority, 67

Get-AzureKeyVaultSecret, 289

for group management, 7

key management, 293

for managing Azure Key Vault certificates, 286

New-AzRoleAssignment, 5

New-AzureADMSAdministrativeUnit PowerShell, 21

New-AzureADTrustedCertificateAuthority, 67

New-AzVirtualNetwork, 97

Set-AzKeyVaultAccessPolicy, 276–277

Set-AzStorageAccount, 256

Set-AzVmDiskEncryptionExtension, 175

commands

az ad group create, 9

az storage account update, 256

for backup and recovery of Key Vault items, 298

certificate-management, 287–288

for managing Key Vault secrets, 290–291

Revoke-AzStorageAccountUserDelegationKeys, 254

conditional access policies, 26–29

configuring, 59–60

access to Azure Key Vault, 275

Always Encrypted, 267–268

API management policies, 76

app registration permission scopes, 73–74

Azure AD, 247–248

Azure DDoS protection, 152–153

Azure Firewall, 122–124

Azure Front Door, 133–138

endpoint protection, 155–158

firewalls

Azure App Service, 146–147

Azure Key Vault, 145–146

Azure SQL, 145

Azure Storage, 141–143

MFA (multifactor authentication), 30–34

account lockout, 37

block/unblock users, 37–38

fraud alert settings, 38

OATH tokens, 38–39

phone call settings, 39

utilization reports, 40

Microsoft Defender for SQL, 200–201, 271–272

NSGs (network security groups), 114–117

SAS (Shared Access Signatures), 253–254

account, 255–257

user delegation, 254–255

service endpoints, 149–150

share-level permissions, 250–251

storage accounts, access control, 234–237

UPN suffixes, 59–60

VNets (virtual networks), 94–96, 99–102

VPNs (virtual private networks), authentication, 107–108

connectivity, Azure AD Connect, requirements, 50–51

connectors, Microsoft Sentinel, 217–221

containers. See also storage accounts

ACR (Azure Container Registry), 163–165

storage accounts

access keys, 243

assigning RBAC roles to, 234–237

configuring access control, 234–237

encryption key management, 239

encryption scopes, 240–242

infrastructure encryption, 239–240

manually rotating access keys, 245–246

Microsoft Defender for Storage, 242–243

viewing access keys, 244–245

user delegation SAS, 254–255

creating

administrative units, 21

alerts, 205–210

application rules, 124–125

ASGs (application security groups), 118–119

Azure AD user accounts, 12–13

Azure Key Vault, 274

B2B (business-to-business) accounts, 14–17

certificates, 282–285

conditional access policies, 27–29

groups, 7–9

guest accounts, 17–19

incidents, 226–227

keys, 292

NAT gateway, 104–105

network rules, 126

NSGs (network security groups), 114–117

policy initiative, 182–185

service principals, 3

VNets (virtual networks), 97

custom

roles, assigning, 86–89

routes, creating, 99

D

data solutions, isolating, 269

using IP firewall rules, 270

using service endpoints, 269

database(s). See also Azure SQL

auditing, 259–262

authentication, 258–259

encryption, 264–266

isolating, using Azure Private Link, 270

Debug-AzStorage AccountAuth cmdlet, 250

deterministic encryption, 266–267

diagnostic logging, 211–213

dynamic masking, 262–263

E

encryption

Azure ExpressRoute, 109

Azure Storage, 237–239

infrastructure, 239–240

key management, 239

scopes, 240–242

BYOK (‘Bring Your Own Key’), 264–266

database, 264–266

deterministic, 266–267

IPSec, 109

MACsec, 109

randomized, 267

in transit, 175–177

VMs (virtual machines), 159

endpoint

protection, 155–158

service, isolating data solutions, 269

enforcing, policies, 186–189

external identities

B2B (business-to-business), creating, 14–17

guest accounts, creating, 17–19

F

Federation Services, 61

FIDO2 security key, 43

file shares

Azure AD DS authentication, configuring, 247–248

file and folder permissions, configuring, 251

share-level permissions, configuring, 250–251

Firewall policy, 130

firewalls. See also Azure Firewall

Azure App Service, 146–147

Azure Key Vault, 145–146

Azure SQL, 143–145

Azure Storage, 141–143

Key Vault, 279–281

WAF (web application firewall), 121, 138–140

folder permissions, configuring, 251

G

Get-AzureADTrustedCertificateAuthority cmdlet, 67

Get-AzureKeyVaultSecret cmdlet, 289

groups, 6–7

adding and removing members, 9

creating, 7–9

nested, 9–11

guest accounts, creating, 17–19

H

hub virtual network, Azure Firewall Manager deployment, 130–131

hybrid networks, VPNs (virtual private networks), 106–107

authentication, 107–108

types of, 107

I

IaaS (Infrastructure as a Service), 91

identities, 1. See also external identities

PIM (Privileged Identity Management, 23–26

access review, 45–47

monitoring privileged access for, 47–49

Identity Protection, 40–43

implementing, MFA (multifactor authentication), 30

importing, certificates, 285–286

inbound rules, NSGs (network security groups), 113

incidents

creating, 226–227

evaluating, 229–230

infrastructure, Azure Storage encryption, 239–240

installing, Azure AD Connect, 52–59

IP addressing, NAT (network address translation), 102–103

IP firewall rules, isolating data solutions, 270

IPSec, 109

isolating data solutions, 269

using Azure Private Link, 270

using IP firewall rules, 270

using service endpoints, 269

J-K

Kerberos, creating a storage account key, 248–249

key management

Azure Key Vault, 276

Azure Key Vault and, 291–294

Azure Storage encryption, 239

BYOK (‘Bring Your Own Key’), 264–266

cmdlets, 293

key rotation, 294–295

L

licensing, PIM (Privileged Identity Management, 25–26

Linux

Microsoft Defender for Servers, 191–192

VMs, ADE (Azure Data Encryption) and, 175

logs

diagnostic, 211–213

security, 213–215

M

MACsec, 109

managing

access to apps, 70

groups, 7

security updates, 162–163

user accounts, 12–13

manually rotating access keys, 245–246

members, adding and removing from groups, 9

MFA (multifactor authentication), 107

account lockout, 37

block/unblock users, 37–38

fraud alert settings, 38

implementing, 30

OATH tokens, 38–39

performing a bulk reset, 35–36

phone call settings, 39

setting up on Azure AD, 30–34

user administration, 34–37

utilization reports, 40

Microsoft 365

external sharing, 19

groups, 6. See also groups

Microsoft Authenticator app, 44

Microsoft Defender for Cloud and, 168–169

Microsoft Defender for Servers, 190–191

for Linux, 191–192

vulnerability assessment, 195–197

for Windows, 191

Microsoft Defender for SQL

configuring, 200–201, 271–272

vulnerability assessment, 198–199

Microsoft Defender for Storage, 242–243

Microsoft Sentinel, 201

analytics, 221–222

architecture, 215–217

connectors, 217–221

incidents

creating, 226–227

evaluating, 229–230

Log Analytics workspace, 228

scheduled query rule, creating, 222–226

threat hunting, 230–231

Workbooks, 228–229

Microsoft Threat Intelligence, 121

mobile devices

apps

configuring registration permission scopes, 73–74

managing access, 70

managing registration permission consent, 74–75

registrations, 68–70

MFA (multifactor authentication) and, 30

passwordless authentication, 43–45

N

NAT (network address translation), 102–105

nested groups, 9–11

network rules, 126

network segmentation, 94

New-AzRoleAssignment cmdlet, 5

New-AzureADMSAdministrativeUnit PowerShell cmdlet, 21

New-AzureADTrustedCertificateAuthority cmdlet, 67

New-AzVirtualNetwork cmdlet, 97

nodes, AKS (Azure Kubernetes), 168

NSGs (network security groups), 93, 111–112

creating, 114–117

inbound rules, 113

outbound rules, 113–114

O

OATH tokens, MFA (multifactor authentication), 38–39

OneDrive, external sharing, 19

outbound rules, NSGs (network security groups), 113–114

OWASP (Open Web Application Security Project), 139–140

P

PaaS (Platform as a Service), 91

pass-through authentication, 61

passwordless authentication, 43–45

password(s)

self-service reset, 61–63

synchronization, 60–61

writeback, 67

peering, 94, 99–102

permissions, 81–82

app registration, 73–75

assigning to service principals, 3–5

Azure Key Vault, 276

file and folder, configuring, 251

resource group, 80

share-level, configuring, 250–251

PIM (Privileged Identity Management, 23–26

access reviews, 45–47

monitoring privileged access for, 47–49

point-to-site VPNs, 110

advantages and limitations, 110

policy(ies), 158, 181–182, 186

access, 275–276

API management, 76

certificate, 281

conditional access, 26–29

definition, 185

dynamic masking, 263

enforcement, 186–189

Firewall, 130

initiatives, creating, 182–185

risk, 41–43

stored access, 257

PowerShell

AzFilesHybrid module, 249–250

cmdlets

Add-AzVirtualNetworkPeering, 102

AzNetworkSecurityRuleConfig, 117

for backup and recovery of Key Vault items, 299

Debug-AzStorage AccountAuth, 250

Get-AzureADTrustedCertificateAuthority, 67

Get-AzureKeyVaultSecret, 289

for group management, 7

key management, 293

for managing Azure Key Vault certificates, 286

for managing Key Vault secrets, 290

New-AzRoleAssignment, 5

New-AzureADMSAdministrativeUnit PowerShell, 21

New-AzureADTrustedCertificateAuthority, 67

New-AzVirtualNetwork, 97

Set-AzStorageAccount, 256

Set-AzVmDiskEncryptionExtension, 175

creating user delegation SAS, 254–255

regenerating storage account access keys, 246

on-premises Active Directory. See also Azure AD (Active Directory)

pass-through authentication, 61

password synchronization, 60–61

UPN suffixes, 59–60

pricing, ACR (Azure Container Registry), 163

private endpoints, 150–151

Private Link service, 151

Q-R

RADIUS, 108

randomized encryption, 267

RBAC (role-based access control), 77–78

administrative units and, 23

assigning roles to storage accounts, 234–237

configuring in Azure Key Vault, 277–278

delegating admin rights, 79–80

interpreting role and resource permissions, 81

permissions, 81–82

resource group permissions, 80

roles, 78, 83–86

scopes, 78

regenerating access keys, 246

registering, apps, 68–70

removing, group members, 9

requirements, Azure AD Connect, 50

connectivity, 50–51

deployment accounts, 52

SQL server, 51

resources, 203

API management policies, 76

audit history, viewing, 48–49

permissions, 81

updating tags, 187

restoring Key Vault items, PowerShell cmdlets, 299

Revoke-AzStorageAccountUserDelegationKeys command, 254

revoking, user delegation SAS, 254

risk policies, 41–43

roles, 78

access review, 45–47

administrative units and, 23

assigning to applications, 3–4

built-in, 83–86

cloning, 87–89

custom, 86–89

for passwordless authentication, 44

permissions, 81

PIM (Privileged Identity Management, 23–26

verifying, 5

viewing, 79–80

routing, 97–99

creating custom routes, 99

resource audit history, viewing, 48–49

routing table, 98–99

rules

alert, 210

Azure Firewall, 121

application, 124–125

network, 126

S

SAS (Shared Access Signatures)

account, 255–257

configuring, 253–254

stored access policies, 257

token parameters, 256

user delegation, 254–255

scheduled query rule, creating, 222–226

scopes, 78, 240–242

secrets

cmdlets for managing, 290

Key Vault, 288–291

viewing, 289

Security Alert dashboard, 192–195

Security Center, 155, 159, 160

security groups, 6. See also groups

adding and removing members, 9

nested groups, 9–11

security updates

managing, 162–163

VMs, 160–162

segmentation, 94

self-service password reset, 61–63, 67

serverless compute, AKS (Azure Kubernetes), 166–167

isolation, 166–167

logical isolation, 166

Microsoft Defender for Cloud and, 168–169

nodes, 168

physical isolation, 166

service endpoints, 147–148

advantages of, 148–149

configuring, 149–150

service endpoints, isolating data solutions, 269

service principal, 2

service principals, 2–3

assigning permissions through roles, 3–5

authentication, 76–77

certificate-based authentication, 77

creating, 3

roles, verifying, 5

Set-AzKeyVaultAccessPolicy cmdlet, 276–277

Set-AzStorageAccount cmdlet, 256

Set-AzVmDiskEncryptionExtension cmdlet, 175

shared responsibility model, 91

share-level permissions, configuring, 250–251

SharePoint Online, external sharing, 19–21

sign-in risk policies, 41

site-to-site VPNs, 111

SQL, Azure AD Connect requirements, 51. See also Azure SQL

storage accounts

access keys, 243

manually rotating, 245–246

regenerating, 246

viewing, 244–245

assigning RBAC roles, 234–237

authentication, SAS (Shared Access Signatures), 253–254

Azure-supported, 234

configuring access control, 234–237

encryption, 237–239

infrastructure, 239–240

key management, 239

scopes, 240–242

Microsoft Defender for Storage, 242–243

stored access policies, 257

subnetting, NSGs (network security groups), 93

subscriptions, API management policies, 76

T

TDE (transparent data encryption), 264–266

threat

detection, 190–191

for Linux, 191–192

for Windows, 191

hunting, 230–231

protection, 190

TLS (Transport Layer Security), 140

token parameters, SAS (Shared Access Signatures), 256

U

Update Management, 160–163

UPN suffixes, 59–60

user accounts. See also permissions

assigning to apps, 70–73

Azure AD (Active Directory)

administration tasks, 13

creating, 12–13

setting up MFA, 30–34

blocking/unblocking, 37–38

checking access, 82–83

fraud alert settings, 38

managing, 12–13

PIM (Privileged Identity Management, 23–26

requirements for Azure AD Connect deployment, 52

roles, viewing, 79–80

UPN suffixes and, 59–60

user delegation SAS

configuring, 254–255

revoking, 254

user principals, 2

user-risk policies, 41

utilization reports, MFA (multifactor authentication), 40

V

verifying, service principal roles, 5

viewing

access keys, 244–245

alerts, 194–195

guest accounts, 18

resource audit history, 48–49

roles, 79–80

secrets, 289

virtual hubs, Azure Firewall Manager deployment, 130

virtual network gateway, 93

VMs (virtual machines), 93

access control, 159

ADE (Azure Data Encryption), 174–175

ASGs (application security groups), 117–118

associating with the VM, 119–120

creating, 118–119

disk encryption, 159

endpoint protection, 155–158

security updates, 160–162

threat detection, 159

Update Management, 160–163

vulnerability assessment, 195–197

VNets (virtual networks), 92–93

configuring, 94–96

creating, 97

Key Vault, 279–281

NAT (network address translation), 102–105

NSGs (network security groups), 111–112

creating, 114–117

inbound rules, 113

outbound rules, 113–114

peering, 94, 99–102

private endpoints, 150–151

routing, 97–99

routing table, 98–99

segmentation, 94

service endpoints, 147–148

advantages of, 148–149

configuring, 149–150

service endpoints, isolating data solutions, 269

subnets, 92–93

VPNs (virtual private networks), 106

authentication, 107–108

point-to-site, 110

site-to-site, 111

types of, 107

vulnerability assessment

for SQL, 198–199

for VMs, 195–197

W

WAF (web application firewall), 121, 138–140

Windows

Hello for Business, 43

Microsoft Defender for Servers, 191

X-Y-Z

X509 certificates

importing, 285–286

managing, 281