Azure Security Best Practices for 2025

Azure Security in 2025: The Baseline Has Risen

The Azure security landscape has shifted dramatically. With the proliferation of Copilot integrations, expanded AI workloads, and increasingly sophisticated supply chain attacks targeting cloud infrastructure, the baseline security requirements for enterprise Azure environments are higher than ever.

This guide reflects current best practices drawn from the CIS Azure Benchmark v2.0, Microsoft Cloud Security Benchmark v1.0, and CyberZonic's experience across enterprise Azure deployments.

Identity and Access Management

Identity remains the highest-priority control surface in Azure.

Must-Have Controls

Conditional Access Policies Every Azure AD tenant should have these baseline policies:

Require MFA for all users (block legacy authentication)
Require compliant device for access to sensitive applications
Block access from high-risk sign-in locations
Require MFA for all administrator roles — always, no exceptions

Privileged Identity Management (PIM) Standing privileged access is a critical risk. PIM enables:

Just-in-time (JIT) access for administrative roles
Approval workflows for sensitive role activations
Time-limited assignments with automatic expiry
Comprehensive audit logs for all privilege usage

Service Principal Security Service principals and managed identities are frequently over-privileged:

Use managed identities instead of service principals where possible
Apply least privilege — avoid Owner and Contributor at subscription scope
Rotate service principal secrets on a 90-day cycle
Monitor for service principal authentication anomalies

Storage Security

Azure Storage Accounts

Disable public blob access across all storage accounts unless explicitly required
Enforce HTTPS-only — disable HTTP access
Enable soft delete with a 30-day retention period for blob and container recovery
Enable versioning for critical data stores
Use private endpoints to eliminate public internet exposure
Enable Defender for Storage for malware scanning and anomaly detection

Azure Key Vault

Store all secrets, keys, and certificates in Key Vault — never in application configuration or environment variables
Enable soft delete and purge protection
Configure Key Vault firewall to allow access only from required network ranges
Enable Key Vault diagnostic logging to Log Analytics
Rotate secrets automatically using Key Vault rotation policies

Network Security

Network Architecture

Implement hub-and-spoke topology with Azure Firewall in the hub
Enable Azure DDoS Protection Standard for public-facing workloads
Use Network Security Groups (NSGs) at both subnet and NIC level
Enable NSG Flow Logs and analyse with Traffic Analytics
Implement Azure Private Endpoint for PaaS service access (eliminate public endpoints)

Azure Firewall Configuration

Enable Threat Intelligence-based filtering in Alert and Deny mode
Implement application rules using FQDNs rather than IP-based rules
Enable IDPS (Intrusion Detection and Prevention System) in Premium tier
Configure centralised logging to Log Analytics workspace

Monitoring and Security Operations

Microsoft Sentinel

Connect all Azure sources to Sentinel:

Azure Activity logs
Azure AD sign-in and audit logs
Microsoft Defender for Cloud alerts
NSG Flow Logs
Azure Firewall logs
Key Vault diagnostic logs

Enable the following built-in analytics rules as a minimum:

Failed authentication from unusual location
New Global Administrator added
Azure Firewall threat intelligence alert
Key Vault access from unusual IP

Defender for Cloud

Set your Defender for Cloud target to a Secure Score above 75. Prioritise:

Enable all Defender plans for production subscriptions
Remediate all Critical and High severity recommendations
Configure regulatory compliance assessments (ISO 27001, NIST)
Enable Defender for Containers if running AKS workloads

Compliance and Governance

Azure Policy

Implement Policy Initiatives (sets of policies) for:

Allowed resource types — restrict which Azure services can be deployed
Allowed locations — restrict deployment to approved regions (UK South, UK West for UK organisations)
Required tags — enforce consistent tagging for cost and security attribution
Defender for Cloud — enforce Defender plans across subscriptions

Cost and Security Tagging

Every resource should have:

Environment: Production | Staging | Development
Owner: Team or individual responsible
DataClassification: Public | Internal | Confidential | Restricted
CostCentre: For charge-back reporting

Quick Win Checklist

For organisations starting their Azure security journey, complete these in the first 30 days:

These controls alone address the majority of Azure-related incidents observed in enterprise environments. Build on this foundation with more advanced controls as your security programme matures.