Harden Azure workloads
Harden App Service, Functions, AKS, container registry, SQL, Cosmos, APIM and messaging.
Lessons in this path
- 1 Compliance AZURE
Harden the AKS control plane
One capability across Kubernetes: make sure the cluster's front door is not reachable from the whole internet, and that Azure Policy is installed so guardrails are evaluated and enforced inside every cluster rather than only hoped for.
15 min - 2 Compliance AZURE
Enforce AKS pod security
One capability across every workload in an AKS cluster: make sure no pod runs more privileged than it needs, no container pulls from a registry you do not trust, and no deployment can quietly grant itself root, host access or a writable filesystem, unless you genuinely intend it.
15 min - 3 Compliance AZURE
Harden Azure API Management
One capability across your API gateway: make sure every published endpoint is authenticated, monitored by Defender for APIs, scoped to least privilege, and that nothing it talks to (backends, secrets, the management plane) bypasses the checks you meant to enforce.
15 min - 4 Compliance AZURE
Harden Azure App Service apps
One capability across web apps and API apps: make sure every app forces HTTPS, refuses remote debugging, scopes CORS to the origins you actually own, and runs a supported language runtime, instead of shipping the permissive defaults to the internet.
14 min - 5 Compliance AZURE
Protect Azure resources with backup
One capability across virtual machines and managed databases: make sure every resource that holds state has a recoverable, regularly tested backup, and that the backup itself survives the loss of the region it lives in.
14 min - 6 Compliance AZURE
Harden Azure Container Registry
One capability across the registries that hold your images: make sure no registry is reachable from the public internet by default, that the images it stores are pulled over a private path, and that regulated workloads can prove their layers are encrypted under a key you control.
14 min - 7 Compliance AZURE
Harden Azure Cosmos DB
One capability across every Cosmos DB API: make sure no database account is reachable from the public internet, by routing access through a private endpoint and shutting public network access off, unless you genuinely intend a store to be public.
13 min - 8 Compliance AZURE
Harden Azure Function apps
One capability across every Function app: make sure the HTTP surface it exposes is not reachable by anyone the internet, that nobody can attach a debugger or call an admin endpoint, and that every endpoint behind it is authenticated, used and deliberate.
14 min - 9 Compliance AZURE
Harden Azure MySQL and PostgreSQL
One capability across Azure Database for MySQL and PostgreSQL: make sure no open-source database server is reachable from the public internet, that nothing it serves travels unencrypted, that identity runs through Microsoft Entra, and that what it does is audited and backed up, unless you genuinely intend otherwise.
15 min - 10 Compliance AZURE
Harden Azure SQL Database
One capability across Azure SQL Database and SQL Managed Instance: make sure every advanced threat protection type is switched on, so anomalous and malicious database activity, SQL injection, brute force, access from an unfamiliar principal, is detected and alerted rather than discovered after the fact.
14 min