Azure operational security overview

Azure operational security refers to the services, controls, and features available to users for protecting their data, applications, and other assets in Microsoft Azure. It's a framework that incorporates the knowledge gained through a variety of capabilities that are unique to Microsoft. These capabilities include the Microsoft Security Development Lifecycle (SDL), the Microsoft Security Response Center program, and deep awareness of the cybersecurity threat landscape.

Azure management services

An IT operations team is responsible for managing datacenter infrastructure, applications, and data, including the stability and security of these systems. However, gaining security insights across increasingly complex IT environments often requires organizations to cobble together data from multiple security and management systems.

Azure Monitor Logs is a cloud-based IT management solution that helps you manage and protect your on-premises and cloud infrastructure. Azure includes multiple management services that provide specific functions. You can combine services to achieve different management scenarios.

Azure Monitor

Azure Monitor collects data from managed sources into central data stores. This data might include events, performance data, or custom data provided through the API. After the data is collected, it's available for alerting, analysis, and export.

You can consolidate data from a variety of sources and combine data from your Azure services with your existing on-premises environment. Azure Monitor Logs separates the collection of data from the action taken on that data, so all actions are available to all kinds of data.

Automation

Azure Automation provides a way for you to automate the manual, long-running, error-prone, and frequently repeated tasks that are commonly performed in a cloud and enterprise environment. This automation saves time and increases the reliability of administrative tasks. Azure Automation can also schedule these tasks to run automatically at regular intervals. You can automate processes by using runbooks or automate configuration management by using Desired State Configuration.

Backup

Azure Backup is the Azure-based service that you can use to back up (or protect) and restore your data in the Microsoft Cloud. Azure Backup replaces your existing on-premises or off-site backup solution with a cloud-based solution that's reliable, secure, and cost-competitive.

Azure Backup offers components that you download and deploy on the appropriate computer or server, or in the cloud. The component, or agent, that you deploy depends on what you want to protect. All Azure Backup components (whether you're protecting data on-premises or in the cloud) can back up data to an Azure Recovery Services vault in Azure.

For more information, see the Azure Backup components table.

Site Recovery

Azure Site Recovery provides business continuity by orchestrating the replication of on-premises virtual and physical machines to Azure, or to a secondary site. If your primary site is unavailable, you fail over to the secondary location so that users can keep working. You fail back when systems return to working order. Use Microsoft Defender for Cloud to perform more intelligent and effective threat detection.

Microsoft Entra ID

Microsoft Entra ID is a comprehensive identity service that:

• Enables identity and access management (IAM) as a cloud service.
• Provides central access management, single sign-on (SSO), and reporting.
• Supports integrated access management for Microsoft Entra application gallery in the Azure Marketplace, including Salesforce, Box, and Concur.

Microsoft Entra ID also includes a full suite of identity management capabilities, including these:

• Multi-factor authentication
• Self-service password management
• Self-service group management
• Privileged account management
• Azure role-based access control (Azure RBAC)
• Application usage monitoring
• Rich auditing
• Security monitoring and alerting

With Microsoft Entra ID, all applications that you publish for your partners and customers (business or consumer) have the same identity and access management capabilities. This identity capability can significantly reduce your operational costs.

Microsoft Defender for Cloud

Microsoft Defender for Cloud helps you prevent, detect, and respond to threats by providing increased visibility into and control over the security of your Azure resources. Defender for Cloud provides integrated security monitoring and policy management across your subscriptions. It helps detect threats that might otherwise go unnoticed, and it works with a broad ecosystem of security solutions.

Defender for Cloud helps safeguard virtual machine (VM) data in Azure by providing visibility into your virtual machine’s security settings and monitoring for threats. Defender for Cloud can monitor your virtual machines for:

• Operating system security settings with the recommended configuration rules.
• System security and critical updates that are missing.
• Endpoint protection recommendations.
• Disk encryption validation.
• Network-based attacks.

Defender for Cloud uses Azure role-based access control (Azure RBAC). Azure RBAC provides built-in roles that you can assign to users, groups, and services in Azure.

Defender for Cloud assesses the configuration of your resources to identify security problems and vulnerabilities. In Defender for Cloud, you see information related to a resource only when you're assigned the role of owner, contributor, or reader for the subscription or resource group that a resource belongs to.

Defender for Cloud uses the Azure Monitor Agent. Defender for Cloud uses the same agent that Azure Monitor uses. Data collected from this agent is stored in either an existing Log Analytics workspace associated with your Azure subscription or a new workspace, taking into account the geolocation of the VM.

Azure Monitor

Performance problems in your cloud app can affect your business. With multiple interconnected components and frequent releases, degradations can happen at any time. And if you're developing an app, your users usually discover problems that you didn't find in testing. You should know about these problems immediately, and you should have tools for diagnosing and fixing the problems.

Azure Monitor is a basic tool for monitoring services running on Azure. It gives you infrastructure-level data about the throughput of a service and the surrounding environment. If you're managing your apps entirely in Azure and deciding whether to scale up or down resources, Azure Monitor is the place to start.

You can also use monitoring data to gain deep insights about your application. That knowledge can help you improve application performance or maintainability, or automate actions that would otherwise require manual intervention.

Azure Monitor includes the following components.

Azure activity log

The Azure Activity Log provides insight into the operations that were performed on resources in your subscription. The Azure Activity Log was previously known as "Audit Log" or "Operational Log," because it reports control-plane events for your subscriptions.

Azure diagnostic logs

Azure diagnostic logs are emitted by a resource and provide rich, frequent data about the operation of that resource. The content of these logs varies by resource type.

Windows event system logs are one category of diagnostic logs for VMs. Blob, table, and queue logs are categories of diagnostic logs for storage accounts.

Diagnostic logs differ from the Activity Log. The Activity log provides insight into the operations that were performed on resources in your subscription. Diagnostic logs provide insight into operations that your resource performed itself.

Metrics

Azure Monitor provides telemetry that gives you visibility into the performance and health of your workloads on Azure. The most important type of Azure telemetry data is the metrics (also called performance counters) emitted by most Azure resources. Azure Monitor provides several ways to configure and consume these metrics for monitoring and troubleshooting.

Azure diagnostics

Azure Diagnostics enables the collection of diagnostic data on a deployed application. You can use the Diagnostics extension from various sources. Currently supported are Azure cloud service roles, Azure virtual machines running Microsoft Windows, and Azure Service Fabric.

Azure Network Watcher

Organizations build an end-to-end network in Azure by orchestrating and composing individual network resources such as virtual networks, Azure ExpressRoute, Azure Application Gateway, and load balancers. You can monitor each of the network resources.

The end-to-end network can have complex configurations and interactions between resources. You need scenario-based monitoring through Azure Network Watcher for these complex scenarios.

Network Watcher simplifies monitoring and diagnostics for your Azure network. Use the diagnostic and visualization tools in Network Watcher to:

• Take remote packet captures on an Azure virtual machine.
• Gain insights into your network traffic by using flow logs.
• Diagnose Azure VPN Gateway and connections.

Network Watcher currently has the following capabilities:

• Topology: Provides a view of the various interconnections and associations between network resources in a resource group.
• Variable packet capture: Captures packet data in and out of a virtual machine. Advanced filtering options and fine-tuned controls, such as the ability to set time and size limitations, provide versatility. You can store the packet data in a blob store or on the local disk in .cap format.
• IP flow verify: Checks if a packet is allowed or denied based on 5-tuple packet parameters for flow information (destination IP, source IP, destination port, source port, and protocol). If a security group denies the packet, the rule and group that denied the packet are returned.
• Next hop: Determines the next hop for packets being routed in the Azure network fabric, so you can diagnose any misconfigured user-defined routes.
• Security group view: Gets the effective and applied security rules that are applied on a VM.
• NSG flow logs for network security groups: Enable you to capture logs related to traffic that's allowed or denied by the security rules in the group. The flow is defined by 5-tuple information: source IP, destination IP, source port, destination port, and protocol.
• Virtual network gateway and connection troubleshooting: Provides the ability to troubleshoot virtual network gateways and connections.
• Network subscription limits: Enables you to view network resource usage against limits.
• Diagnostic logs: Provides a single pane to enable or disable diagnostic logs for network resources in a resource group.

For more information, see Configure Network Watcher.

Standardized and compliant deployments

Use Azure Deployment Stacks to define, deploy, and manage a repeatable set of Azure resources that follows your organization's standards, patterns, and requirements. Deployment stacks provide lifecycle management and deny settings for resources defined in Bicep or Azure Resource Manager templates. Use Azure Resource Manager template specs to store, version, and share approved templates across your organization.

Next steps

To learn about the Security and Audit solution, see the following articles:

• Microsoft Trust Center compliance offerings
• Microsoft Defender for Cloud
• Azure Monitor