Close Azure network exposure
Public database access, Key Vault private link and VM exposure: close the Azure doors.
Lessons in this path
- 1 Compliance AZURE
Protect Azure networks with DDoS and firewalls
One capability across the network edge: make sure every internet-facing virtual network can absorb a volumetric attack, that traffic crossing a trust boundary is inspected by a firewall, and that the same protection extends to host and VM networking on Azure Local.
14 min - 2 Compliance AZURE
Put Azure Key Vault behind a private network
One capability across every vault in the estate: make sure the store that holds your secrets, keys and certificates is not reachable from the public internet, and that the only paths to it are a private endpoint or a tightly scoped firewall, unless you genuinely intend otherwise.
14 min - 3 Compliance AZURE
Require private endpoints for Azure PaaS services
One capability across Storage, SQL Database, Machine Learning, Event Grid, SignalR and App Configuration: take each managed service off its public endpoint and reach it only over a private IP on your own network, so the data plane never travels the public internet.
15 min - 4 Compliance AZURE
Restrict public network access to Azure databases
One capability across Azure SQL Database, Azure Database for PostgreSQL and Azure Cosmos DB: make sure no managed database is reachable from the open internet, and that the only paths in are a private endpoint or a tightly scoped set of trusted networks.
14 min - 5 Compliance AZURE
Restrict virtual machine network exposure
One capability across every VM in the estate: make sure no machine has its management ports open to the internet, that every internet-facing VM sits behind a network security group, and that the ports you do need to reach are opened only when someone is using them.
14 min - 6 Compliance AZURE
Harden Azure Storage accounts
One capability across Blob, File, Table and Queue: make sure no storage account is reachable from, or shareable with, the public internet, and that nothing it serves travels unencrypted, unless you genuinely intend it.
14 min