Cloud Security Posture Checklist

Identity & Access

Identity is the perimeter. Every item here should be a baseline — if any are missing, prioritise closing them before anything else.

• Break-glass accounts exist, are excluded from Conditional Access, and have MFA via hardware tokens only
• All privileged roles require Privileged Identity Management (PIM) activation with MFA + approval
• Conditional Access baseline policies enforce MFA for all users, block legacy auth, and require compliant devices for admin portals
• Guest access is restricted at tenant level — guest invitations are limited to specific roles
• Password hash sync is enabled, and Self-Service Password Reset is configured with writeback
• Identity Protection risk policies are enabled in audit or enforced mode with documented response actions
• Sign-in logs are shipped to a Log Analytics workspace with 90+ days retention

Network

• No public IPs on production workloads unless explicitly approved and documented
• Azure Firewall or NVA is deployed at hub with deny-by-default egress rules
• Private Endpoints are used for PaaS services (Storage, SQL, Key Vault, Cosmos)
• NSG flow logs are enabled and ingested by Traffic Analytics
• DDoS Network Protection is enabled on VNets hosting public-facing workloads
• Bastion is the only path for VM management — no jump boxes with public IPs

Data Protection

• Storage accounts require HTTPS only, disable public blob access, and enforce TLS 1.2+
• Customer-managed keys are used for Storage, SQL, and Key Vault where regulatory requirements apply
• Soft delete + versioning is enabled on all production Storage accounts and Key Vaults
• SQL Transparent Data Encryption is enabled and Always Encrypted is used for sensitive columns
• Purview sensitivity labels are published and applied to SharePoint, OneDrive, and Teams
• DLP policies are in monitor or enforce mode for email, Teams chat, and Endpoint

Workload & Endpoint

• Defender for Cloud is enabled on all subscriptions at the Standard tier for relevant plans
• Defender for Endpoint is onboarded to all Windows, macOS, and Linux servers
• All VMs enforce Trusted Launch (secure boot + vTPM) and have the latest OS image
• Container images are scanned pre-deploy and registries require signed images
• Backup is configured for critical workloads with immutability and geo-redundancy
• Microsoft Sentinel is ingesting Azure Activity, Sign-in, and Defender logs with analytics rules enabled

Governance & Operations

• Azure Policy enforces baseline via initiative (at least MCSB or CIS) at the root management group
• Resource locks are applied to production subscriptions and critical resources
• Cost alerts and budget thresholds are configured per subscription
• Tagging policy is enforced for environment, owner, data-classification, and cost-centre
• Change management is evidenced — approvals are logged in Azure DevOps or ServiceNow
• Incident response runbooks exist for common scenarios (compromise, data leak, ransomware)
• An annual tabletop exercise validates the IR plan end-to-end