Security Hardening

Principle of least privilege

• Assign RBAC at the narrowest scope (resource > resource group > subscription > management group).
• Use built-in roles before creating custom ones.
• Common roles: Reader, Contributor, Owner, Key Vault Secrets User, Storage Blob Data Reader.
• Avoid Owner on production subscriptions — use Contributor + specific data-plane roles.

Key Vault best practices

• Soft delete + purge protection: always on in production.
• Restrict access with Key Vault Firewall + private endpoint.
• Use Managed Identity (not service principal secrets) to read secrets.
• Rotate secrets every 90 days; use Key Vault references in App Service / AKS.
• Audit access with diagnostic settings → Log Analytics.

Encryption

• Storage at rest: enabled by default (AES-256, Microsoft-managed keys).
• Customer-managed keys (CMK) in Key Vault for compliance requirements.
• TLS 1.2+ everywhere; disable older protocols.
• Encryption in transit: HTTPS-only for storage, SQL, App Service.

Network isolation

• Disable public network access on PaaS services when possible.
• Use private endpoints for Storage, Key Vault, SQL, ACR.
• Apply NSGs with default-deny inbound.

Microsoft Defender for Cloud

Enable Defender plans for:

• Servers (VM vulnerability scanning)
• Containers (AKS runtime threat detection)
• Storage (malware scanning, anomaly detection)
• Key Vault (unusual access patterns)
• SQL (SQL injection detection)

Secure Score is your KPI — target 80%+.