Azure Logging & Detection Hardening

Every subscription in the tenant routes its Activity Log via a Diagnostic Setting into a single central Log Analytics workspace (the "LAW"), and an Azure Policy assigned at the tenant-root management group enforces that the diagnostic setting exists on every subscription — including ones created tomorrow by a workload team self-service-provisioning a sandbox (Microsoft Learn — Azure Monitor Activity Log (accessed 2026-05)). At minimum eight log categories stream: Administrative (ARM control-plane writes), Security (Defender for Cloud alert events into Activity Log), ServiceHealth (Azure platform health), Alert (Activity Log alert fires), Recommendation (Defender recommendations), Policy (policy evaluation results, including non-compliance), Autoscale (autoscale rule executions), and ResourceHealth (per-resource health transitions). The 90-day platform retention on raw Activity Log is the timer that this control beats — anything beyond 90 days requires the durable sink. The cross-cutting principle is reinforced in General Logging — centralization; the underlying audit-integrity expectation in General Logging — log integrity.

Remediation — Azure CLI

# Azure CLI 2.x
# Audit: list every subscription whose Activity Log lacks a diagnostic setting.
for sub in $(az account list --query '[].id' -o tsv); do
  count=$(az monitor diagnostic-settings subscription list \
    --subscription "$sub" --query 'length(value)' -o tsv 2>/dev/null || echo 0)
  echo "sub=$sub diag_settings=$count"
done

# Apply the canonical 8-category diagnostic setting to one subscription.
SUB_ID=$(az account show --query id -o tsv)
LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-security-logging-westeu \
  --workspace-name law-central-prod \
  --query id -o tsv)

az monitor diagnostic-settings subscription create \
  --name send-activity-to-law \
  --subscription "$SUB_ID" \
  --workspace "$LAW_ID" \
  --logs '[
    {"category":"Administrative","enabled":true},
    {"category":"Security","enabled":true},
    {"category":"ServiceHealth","enabled":true},
    {"category":"Alert","enabled":true},
    {"category":"Recommendation","enabled":true},
    {"category":"Policy","enabled":true},
    {"category":"Autoscale","enabled":true},
    {"category":"ResourceHealth","enabled":true}
  ]'

# Enforce tenant-wide via root-mgmt-group policy assignment (built-in initiative
# 'Configure Azure Activity logs to stream to specified Log Analytics workspace').
az policy assignment create \
  --name pa-activity-log-to-law \
  --scope "/providers/Microsoft.Management/managementGroups/tenant-root" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/<activity-log-diag-setting-policy-id>" \
  --params "{\"logAnalytics\":{\"value\":\"$LAW_ID\"}}" \
  --location westeurope \
  --mi-system-assigned \
  --role Contributor \
  --identity-scope "/providers/Microsoft.Management/managementGroups/tenant-root"

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — Activity Log routed via Diagnostic Settings.

resource "azurerm_log_analytics_workspace" "central" {
  name                = "law-central-prod"
  resource_group_name = "rg-security-logging-westeu"
  location            = "westeurope"
  sku                 = "PerGB2018"
  retention_in_days   = 730  # 2-year hot retention; archive tier configured separately
}

resource "azurerm_monitor_diagnostic_setting" "activity_log_to_law" {
  name                       = "send-activity-log-to-central-law"
  target_resource_id         = "/subscriptions/${var.subscription_id}"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.central.id

  enabled_log { category = "Administrative" }
  enabled_log { category = "Security" }
  enabled_log { category = "ServiceHealth" }
  enabled_log { category = "Alert" }
  enabled_log { category = "Recommendation" }
  enabled_log { category = "Policy" }
  enabled_log { category = "Autoscale" }
  enabled_log { category = "ResourceHealth" }
}

# Root-management-group policy assignment: every subscription must stream
# Activity Log to the central LAW.
resource "azurerm_management_group_policy_assignment" "activity_log_to_law" {
  name                 = "activity-log-to-central-law"
  management_group_id  = "/providers/Microsoft.Management/managementGroups/tenant-root"
  policy_definition_id = var.activity_log_diag_policy_definition_id
  description          = "Stream subscription Activity Log to the central Log Analytics workspace"
  location             = "westeurope"

  identity { type = "SystemAssigned" }

  parameters = jsonencode({
    logAnalytics = { value = azurerm_log_analytics_workspace.central.id }
  })
}

Remediation — Bicep

targetScope = 'subscription'

@description('Subscription-level diagnostic setting routing Activity Log to central LAW.')
param workspaceId string

resource diag 'Microsoft.Insights/diagnosticSettings@2024-01-01-preview' = {
  name: 'subscription-activity-log-central'
  scope: subscription()
  properties: {
    workspaceId: workspaceId
    logs: [
      { category: 'Administrative',      enabled: true }
      { category: 'Security',            enabled: true }
      { category: 'ServiceHealth',       enabled: true }
      { category: 'Alert',               enabled: true }
      { category: 'Recommendation',      enabled: true }
      { category: 'Policy',              enabled: true }
      { category: 'Autoscale',           enabled: true }
      { category: 'ResourceHealth',      enabled: true }
    ]
  }
}

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as insights from "@pulumi/azure-native/insights";

new insights.DiagnosticSetting("subscription-activity-log-central", {
  resourceUri: "/subscriptions/<sub-id>",
  workspaceId: "/subscriptions/.../workspaces/central-law",
  logs: [
    { category: "Administrative", enabled: true },
    { category: "Security", enabled: true },
    { category: "ServiceHealth", enabled: true },
    { category: "Alert", enabled: true },
    { category: "Recommendation", enabled: true },
    { category: "Policy", enabled: true },
    { category: "Autoscale", enabled: true },
    { category: "ResourceHealth", enabled: true },
  ],
});

Compliance mapping

AzureActivity
          | where OperationNameValue startswith "Microsoft.Insights/diagnosticSettings/"
          | where ResourceId contains "providers/microsoft.insights/diagnosticsettings" or ResourceId !contains "/resourcegroups/"
          | project TimeGenerated, Caller, OperationNameValue, ResourceId, ActivityStatusValue, Properties
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Every Storage Account holding regulated data has a Diagnostic Setting that streams data-plane operations (StorageRead, StorageWrite, StorageDelete) plus the Transaction and Capacity metrics to the central Log Analytics workspace, for each of the four storage services in use (Blob, File, Queue, Table) (Microsoft Learn — Diagnostic settings in Azure Monitor (accessed 2026-05)). Activity Log alone (azure-log-01) covers control-plane writes against the Storage Account resource (e.g., key rotation, network-ACL change); it does not cover the data-plane events that matter for breach investigation — who read which blob, who wrote which object, who deleted which container. Without this control, the question "which 12,000 objects did the leaked SAS token enumerate" has no answer in the platform; with it, the answer is a KQL query against StorageBlobLogs. Enforce via an Azure Policy initiative at the root management group that targets Microsoft.Storage/storageAccounts and assigns the canonical diagnostic setting on creation and on existing resources via deployIfNotExists.

Remediation — Azure CLI

# Azure CLI 2.x
# Inventory: list every Storage Account in the tenant without a diagnostic setting.
for sub in $(az account list --query '[].id' -o tsv); do
  az storage account list --subscription "$sub" --query '[].id' -o tsv | while read sa_id; do
    count=$(az monitor diagnostic-settings list --resource "$sa_id" --query 'length(value)' -o tsv 2>/dev/null || echo 0)
    [ "$count" -eq 0 ] && echo "MISSING: $sa_id"
  done
done

# Apply the diagnostic setting to one Storage Account, scoping each storage service.
SA_ID=$(az storage account show --resource-group rg-data-prod --name stregprod001 --query id -o tsv)
LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-security-logging-westeu --workspace-name law-central-prod --query id -o tsv)

# Blob service: data-plane read/write/delete + transaction/capacity metrics.
az monitor diagnostic-settings create \
  --name stg-blob-diag \
  --resource "$SA_ID/blobServices/default" \
  --workspace "$LAW_ID" \
  --logs '[
    {"category":"StorageRead","enabled":true},
    {"category":"StorageWrite","enabled":true},
    {"category":"StorageDelete","enabled":true}
  ]' \
  --metrics '[{"category":"Transaction","enabled":true},{"category":"Capacity","enabled":true}]'

# Repeat for fileServices/default, queueServices/default, tableServices/default.

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — Storage Account diagnostic settings.

variable "regulated_storage_account_ids" {
  type = map(string)  # keyed by friendly name
}

# Per-service diagnostic setting; iterate the four storage services per account.
locals {
  storage_services = ["blobServices", "fileServices", "queueServices", "tableServices"]
  account_service_pairs = merge([
    for acc_name, acc_id in var.regulated_storage_account_ids : {
      for svc in local.storage_services :
      "${acc_name}-${svc}" => { acc_id = acc_id, svc = svc }
    }
  ]...)
}

resource "azurerm_monitor_diagnostic_setting" "storage" {
  for_each                   = local.account_service_pairs
  name                       = "diag-${each.key}"
  target_resource_id         = "${each.value.acc_id}/${each.value.svc}/default"
  log_analytics_workspace_id = var.central_law_id

  enabled_log { category = "StorageRead" }
  enabled_log { category = "StorageWrite" }
  enabled_log { category = "StorageDelete" }

  metric {
    category = "Transaction"
    enabled  = true
  }
  metric {
    category = "Capacity"
    enabled  = true
  }
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Storage account whose blob/queue/table/file ops should be audited.')
param storageName string
@description('Workspace receiving the data-plane logs.')
param workspaceId string

resource storage 'Microsoft.Storage/storageAccounts@2024-01-01' existing = {
  name: storageName
}

resource blobSvc 'Microsoft.Storage/storageAccounts/blobServices@2024-01-01' existing = {
  parent: storage
  name: 'default'
}

resource diagBlob 'Microsoft.Insights/diagnosticSettings@2024-01-01-preview' = {
  scope: blobSvc
  name: 'blob-audit'
  properties: {
    workspaceId: workspaceId
    logs: [
      { category: 'StorageRead',   enabled: true }
      { category: 'StorageWrite',  enabled: true }
      { category: 'StorageDelete', enabled: true }
    ]
  }
}

Compliance mapping

AzureActivity
          | where ResourceId contains "Microsoft.Storage/storageAccounts"
          | where OperationNameValue in ("Microsoft.Insights/diagnosticSettings/delete", "Microsoft.Insights/diagnosticSettings/write")
          | extend body = tostring(parse_json(Properties).requestbody)
          | project TimeGenerated, Caller, ResourceId, OperationNameValue, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Microsoft Defender for Cloud's regulatory compliance dashboard is configured with the CIS Microsoft Azure Foundations Benchmark v3.0.0 policy initiative assigned at the tenant-root management group, plus auto-remediation policies (deployIfNotExists / modify effects) on the high-priority recommendations the organisation has signed off on remediating without human review (typically: enable diagnostic settings, enable encryption-by-default, lock storage to private network access, enforce TLS 1.2+) (Microsoft Learn — Defender for Cloud regulatory compliance dashboard (accessed 2026-05)). The dashboard scores every subscription against every CIS sub-ID in the assigned initiative and gives the security and compliance teams a per-control remediation queue keyed to the audit framework's sub-IDs. Distinction from azure-log-05: this control is the regulatory compliance surface (score per assigned initiative; CIS sub-IDs; deployIfNotExists auto-remediation); azure-log-05 is the umbrella Secure Score surface (cross-initiative weighted score; monthly review cadence; workflow automation on Defender recommendations as events). Both ship; both are populated by the same Defender engine but answer different review-cadence questions. The underlying compliance-engineering principle is in General Compliance Frameworks.

Remediation — Azure CLI

# Azure CLI 2.x
# Find the built-in policy set definition GUID for CIS Microsoft Azure Foundations v3.0.0.
az policy set-definition list --query "[?contains(displayName, 'CIS Microsoft Azure Foundations Benchmark v3')].{name:name, displayName:displayName}" -o table

# Assign at the tenant-root management group.
CIS_SET_ID="/providers/Microsoft.Authorization/policySetDefinitions/<cis-azure-v3-policy-set-guid>"

az policy assignment create \
  --name cis-azure-v3 \
  --scope "/providers/Microsoft.Management/managementGroups/tenant-root" \
  --policy-set-definition "$CIS_SET_ID" \
  --location westeurope \
  --mi-system-assigned \
  --role Contributor \
  --identity-scope "/providers/Microsoft.Management/managementGroups/tenant-root" \
  --display-name "CIS Microsoft Azure Foundations Benchmark v3.0.0"

# Inspect compliance state for one subscription via the regulatory-compliance API.
az rest --method GET --uri "https://management.azure.com/subscriptions/$(az account show --query id -o tsv)/providers/Microsoft.Security/regulatoryComplianceStandards/CIS-Microsoft-Azure-Foundations-Benchmark-v3.0.0/regulatoryComplianceControls?api-version=2019-01-01-preview"

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — Defender for Cloud regulatory compliance initiative assignment.

variable "cis_azure_v3_policy_set_definition_id" {
  type        = string
  description = "Built-in policy set GUID for CIS Microsoft Azure Foundations Benchmark v3.0.0"
}

resource "azurerm_management_group_policy_assignment" "cis_azure_v3" {
  name                 = "cis-azure-v3"
  display_name         = "CIS Microsoft Azure Foundations Benchmark v3.0.0"
  management_group_id  = "/providers/Microsoft.Management/managementGroups/tenant-root"
  policy_definition_id = var.cis_azure_v3_policy_set_definition_id
  location             = "westeurope"

  identity { type = "SystemAssigned" }
}

# Auto-remediation on a specific high-priority recommendation: enable secure
# transfer required on Storage Accounts. Uses the modify effect.
resource "azurerm_management_group_policy_assignment" "secure_transfer" {
  name                 = "stg-secure-transfer"
  management_group_id  = "/providers/Microsoft.Management/managementGroups/tenant-root"
  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9"
  location             = "westeurope"

  identity { type = "SystemAssigned" }

  parameters = jsonencode({
    effect = { value = "Modify" }
  })
}

Remediation — Bicep

targetScope = 'subscription'

resource autoProv 'Microsoft.Security/autoProvisioningSettings@2024-08-01' = {
  name: 'default'
  properties: {
    autoProvision: 'On'
  }
}

resource defenderContact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
  name: 'default'
  properties: {
    emails: 'soc@example.org'
    notificationsByRole: { state: 'On', roles: ['Owner', 'ServiceAdmin'] }
    alertNotifications: { state: 'On', minimalSeverity: 'High' }
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue in ("Microsoft.Security/autoProvisioningSettings/write", "Microsoft.Security/assessmentMetadata/write", "Microsoft.Security/securityStandards/write")
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"autoProvision\":\"Off\"" or body has "exempt" or OperationNameValue endswith "assessmentMetadata/write"
          | project TimeGenerated, Caller, SubscriptionId, OperationNameValue, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Microsoft Defender for Cloud's workload-protection plans are enabled subscription-wide for every resource type the tenant operates: Defender for Servers Plan 2 (MDE auto-deploy, vulnerability assessment via Defender Vulnerability Management, just-in-time VM access, file integrity monitoring, adaptive application controls), Defender for Storage v2 (malware scanning + sensitive-data discovery), Defender for SQL (Standard), Defender for SQL Server on machines (Standard), Defender for App Service (Standard), Defender for Key Vault (Standard), Defender for Resource Manager (Standard, "Arm"), Defender for DNS (Standard), Defender for Containers (Standard, MDC for AKS + ACR), and Defender CSPM (Standard, "CloudPosture") (Microsoft Learn — What is Microsoft Defender for Cloud (accessed 2026-05)). Each plan is billed per protected-resource-hour and emits its own alert taxonomy into the Defender alerts blade; alerts flow into Microsoft Sentinel via the Defender for Cloud data connector (azure-log-08) where incidents are correlated and automation rules execute SOAR playbooks. Anti-conflation with azure-log-08 (Sentinel): Defender for Cloud is the CSPM + CWPP plane (posture management, regulatory compliance scoring, workload-protection plans that run against Servers / Storage / SQL / Containers / Key Vault / App Service / RM / DNS); Microsoft Sentinel is the SIEM + SOAR plane (data ingestion across Defender, Entra, Activity, Office 365, third-party syslog; KQL analytics on top; Logic App playbook automation). They complement each other and are independently licensed — Defender for Cloud per protected resource-hour, Sentinel per GB ingested. The intended pipeline is Defender alerts → Sentinel incidents → Sentinel automation rules → playbooks. Adopting Defender without Sentinel leaves correlation and SOAR off the table; adopting Sentinel without Defender leaves a CWPP gap. They are not substitutable.

Remediation — Azure CLI

# Azure CLI 2.x
# Audit: which plans are enabled / standard tier across the current subscription?
az security pricing list --query "value[].{name:name, tier:pricingTier}" -o table

# Enable each plan at Standard tier (subscription-scope).
for plan in VirtualMachines StorageAccounts SqlServers SqlServerVirtualMachines AppServices KeyVaults Arm Dns Containers CloudPosture; do
  az security pricing create --name "$plan" --tier Standard
done

# Defender for Servers Plan 2 (sub-plan of VirtualMachines).
az security pricing create --name VirtualMachines --tier Standard --subplan P2

# Defender for Storage v2 (malware scanning + sensitive-data discovery sub-plan).
az security pricing create --name StorageAccounts --tier Standard --subplan DefenderForStorageV2

# Enforcement: built-in initiative 'Configure Microsoft Defender for Cloud plans'
# assigned at the tenant root management group keeps new subscriptions enrolled.

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — Defender for Cloud plan configuration.

locals {
  defender_plans = {
    "VirtualMachines"          = "P2"  # Defender for Servers Plan 2
    "StorageAccounts"          = "DefenderForStorageV2"
    "SqlServers"               = "Standard"
    "SqlServerVirtualMachines" = "Standard"
    "AppServices"              = "Standard"
    "KeyVaults"                = "Standard"
    "Arm"                      = "Standard"
    "Dns"                      = "Standard"
    "Containers"               = "Standard"
    "CloudPosture"             = "Standard"
  }
}

resource "azurerm_security_center_subscription_pricing" "plans" {
  for_each      = local.defender_plans
  resource_type = each.key
  tier          = each.value == "Standard" ? "Standard" : "Standard"
  subplan       = each.value == "Standard" ? null : each.value
}

# Defender alerts → central Log Analytics workspace; required for the Defender
# for Cloud data connector in Sentinel (azure-log-08).
resource "azurerm_security_center_workspace" "this" {
  scope        = "/subscriptions/${var.subscription_id}"
  workspace_id = var.central_law_id
}

Remediation — Bicep

targetScope = 'subscription'

@description('Defender for Cloud plans to enable at Standard tier.')
var plans = [
  'VirtualMachines'
  'AppServices'
  'StorageAccounts'
  'SqlServers'
  'KeyVaults'
  'Containers'
  'CosmosDbs'
  'CloudPosture'
  'Api'
]

resource pricings 'Microsoft.Security/pricings@2024-01-01' = [for plan in plans: {
  name: plan
  properties: { pricingTier: 'Standard' }
}]

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as security from "@pulumi/azure-native/security";

const plans = [
  "VirtualMachines","AppServices","StorageAccounts","SqlServers","KeyVaults",
  "Containers","CosmosDbs","CloudPosture","Api",
];

plans.forEach((p) => {
  new security.Pricing(p, {
    pricingName: p,
    pricingTier: security.PricingTier.Standard,
  });
});

Compliance mapping

AzureActivity
          | where OperationNameValue == "Microsoft.Security/pricings/write"
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"pricingTier\":\"Free\""
          | extend plan = extract("\\\"name\\\":\\\"([^\\\"]+)\\\"", 1, ResourceId)
          | project TimeGenerated, Caller, SubscriptionId, plan, body
          | order by TimeGenerated desc
          | take 100

Equivalent on: AWS · GCP · OCI

The Microsoft Defender for Cloud Secure Score is treated as the umbrella security-posture KPI: a baseline is captured at adoption, a monthly review cadence is enforced for the security team to walk every high-severity recommendation, and a Defender for Cloud workflow automation rule fires a Logic App on any new high-severity recommendation (or any new high-severity Defender alert) to open a ticket against the owning workload team and to notify the on-call channel (Microsoft Learn — Secure Score in Microsoft Defender for Cloud (accessed 2026-05)). Distinction from azure-log-03: log-03 is the regulatory compliance dashboard (CIS Microsoft Azure Foundations Benchmark v3.0.0 initiative assignment + per-sub-ID remediation queue + deployIfNotExists auto-remediation); log-05 is the cross-initiative umbrella (a single weighted score that aggregates all Defender recommendations regardless of which framework initiative they belong to, plus monthly cadence + workflow automation that fires per-event rather than per-CIS-control). Both ship; both are populated by the same Defender engine; both have distinct review rituals — the compliance dashboard answers "are we passing CIS Azure v3.0.0 right now", Secure Score answers "is our overall Defender-visible posture trending up or down this quarter". Cross-link the score to the General Logging — alerting principle: a recommendation that does not generate a ticket against an owner is a recommendation no one will action.

Remediation — Azure CLI

# Azure CLI 2.x
# Inspect the current Secure Score for the subscription.
az security secure-scores list --query "[].{name:name, score:score.current, max:score.max, percentage:score.percentage}" -o table

# Per-secure-control breakdown — find the lowest-scoring controls first.
az security secure-score-controls list --query "[?score.percentage<0.7].{control:displayName, score:score.percentage, healthy:healthyResourceCount, unhealthy:unhealthyResourceCount}" -o table

# Workflow automation: fire a Logic App on new high-severity Defender recommendation.
LOGIC_APP_ID=$(az logic workflow show -g rg-security-soar-westeu -n la-defender-high-severity --query id -o tsv)

az security workflow-automation create \
  --resource-group rg-security-soar-westeu \
  --name aut-defender-high-severity \
  --location westeurope \
  --scopes "/subscriptions/$(az account show --query id -o tsv)" \
  --sources '[{"eventSource":"Assessments","ruleSets":[{"rules":[{"propertyJPath":"properties.metadata.severity","propertyType":"String","expectedValue":"High","operator":"Equals"}]}]}]' \
  --actions "[{\"actionType\":\"LogicApp\",\"logicAppResourceId\":\"$LOGIC_APP_ID\",\"uri\":\"$(az rest --method POST --uri https://management.azure.com$LOGIC_APP_ID/listCallbackUrl?api-version=2016-06-01 --query value -o tsv)\"}]"

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — Defender for Cloud workflow automation.

# Logic App that opens a ticket + pages the on-call channel.
resource "azurerm_logic_app_workflow" "defender_high_severity" {
  name                = "la-defender-high-severity"
  resource_group_name = azurerm_resource_group.soar.name
  location            = azurerm_resource_group.soar.location
}

# Workflow automation on Microsoft.Security/assessments events with severity High.
resource "azurerm_security_center_automation" "defender_high_severity" {
  name                = "aut-defender-high-severity"
  resource_group_name = azurerm_resource_group.soar.name
  location            = azurerm_resource_group.soar.location

  scopes = ["/subscriptions/${var.subscription_id}"]

  source {
    event_source = "Assessments"
    rule_set {
      rule {
        property_path  = "properties.metadata.severity"
        operator       = "Equals"
        expected_value = "High"
        property_type  = "String"
      }
    }
  }

  action {
    type        = "LogicApp"
    resource_id = azurerm_logic_app_workflow.defender_high_severity.id
    trigger_url = "https://prod-XX.westeurope.logic.azure.com/workflows/..."  # listCallbackUrl
  }
}

Remediation — Bicep

targetScope = 'subscription'

@description('Built-in initiative: Azure Security Benchmark.')
var asb = '/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8'

resource assignAsb 'Microsoft.Authorization/policyAssignments@2024-04-01' = {
  name: 'asb-defender-recommendations'
  properties: {
    policyDefinitionId: asb
    displayName: 'Azure Security Benchmark — Defender recommendations'
    enforcementMode: 'Default'
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue == "Microsoft.Security/securityStandards/write"
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"state\":\"removed\"" or body has "delete"
          | project TimeGenerated, Caller, SubscriptionId, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Every Network Security Group in every subscription has NSG Flow Logs v2 enabled (v1 was retired by Microsoft in 2024 and is no longer creatable; existing v1 deployments must migrate), with the flow logs landing in a dedicated regional Storage Account and being processed by Traffic Analytics against the central Log Analytics workspace at a 10-minute processing interval (Microsoft Learn — NSG flow logs overview (accessed 2026-05)). Minimum retention is 30 days in the Storage Account; regulated workloads target 90 days or longer. Traffic Analytics turns the raw flow records into the AzureNetworkAnalytics_CL table in the LAW where KQL queries answer "which subnets are talking to which", "which malicious IPs hit the workload last week", and "which VM made a sudden 10× egress jump in the last hour" — none of which the NSG rule definitions themselves can tell you. Cross-link to General Logging — what to log; for the network-segmentation principle this flow data evidences, see azure-net-02 (NSG no-admin-internet).

Remediation — Azure CLI

# Azure CLI 2.x
# Audit: list NSGs without flow logs.
for sub in $(az account list --query '[].id' -o tsv); do
  for region in westeurope northeurope; do
    az network watcher flow-log list --location "$region" --subscription "$sub" \
      --query "[].{nsg:targetResourceId, enabled:enabled, version:format}" -o tsv
  done
done

# Enable Flow Logs v2 + Traffic Analytics on one NSG.
NSG_ID=$(az network nsg show --resource-group rg-net-prod-westeu --name nsg-app-subnet --query id -o tsv)
SA_ID=$(az storage account show --resource-group rg-security-logging-westeu --name stflowlogswesteu --query id -o tsv)
LAW_ID=$(az monitor log-analytics workspace show \
  --resource-group rg-security-logging-westeu --workspace-name law-central-prod --query id -o tsv)
LAW_REGION=$(az monitor log-analytics workspace show \
  --resource-group rg-security-logging-westeu --workspace-name law-central-prod --query location -o tsv)

az network watcher flow-log create \
  --location westeurope \
  --name fl-nsg-app-subnet \
  --nsg "$NSG_ID" \
  --storage-account "$SA_ID" \
  --enabled true \
  --format JSON --log-version 2 \
  --retention 30 \
  --traffic-analytics true \
  --workspace "$LAW_ID" \
  --workspace-region "$LAW_REGION" \
  --interval 10

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — NSG Flow Logs v2 + Traffic Analytics.

resource "azurerm_network_watcher_flow_log" "app_subnet" {
  name                 = "fl-nsg-app-subnet"
  network_watcher_name = "NetworkWatcher_westeurope"
  resource_group_name  = "NetworkWatcherRG"
  network_security_group_id = azurerm_network_security_group.app_subnet.id

  storage_account_id = azurerm_storage_account.flow_logs.id
  enabled            = true
  version            = 2  # v1 retired in 2024; v2 only

  retention_policy {
    enabled = true
    days    = 30
  }

  traffic_analytics {
    enabled               = true
    workspace_id          = var.central_law_workspace_guid
    workspace_region      = "westeurope"
    workspace_resource_id = var.central_law_id
    interval_in_minutes   = 10
  }
}

# Dedicated Storage Account for flow logs — separate from regulated-data SA.
resource "azurerm_storage_account" "flow_logs" {
  name                          = "stflowlogswesteu"
  resource_group_name           = "rg-security-logging-westeu"
  location                      = "westeurope"
  account_tier                  = "Standard"
  account_replication_type      = "LRS"
  public_network_access_enabled = false
  min_tls_version               = "TLS1_2"
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('NSG resource ID being monitored.')
param nsgResourceId string
@description('Storage account ID receiving the raw flow logs (lifecycle-policied to expire).')
param storageAccountId string
@description('Log Analytics workspace ID for Traffic Analytics.')
param workspaceId string

param location string = resourceGroup().location

resource flowLog 'Microsoft.Network/networkWatchers/flowLogs@2024-03-01' = {
  name: 'NetworkWatcher_${location}/flowlog-${uniqueString(nsgResourceId)}'
  location: location
  properties: {
    targetResourceId: nsgResourceId
    storageId: storageAccountId
    enabled: true
    format: { type: 'JSON', version: 2 }
    retentionPolicy: { days: 90, enabled: true }
    flowAnalyticsConfiguration: {
      networkWatcherFlowAnalyticsConfiguration: {
        enabled: true
        workspaceResourceId: workspaceId
        trafficAnalyticsInterval: 10
      }
    }
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue startswith "Microsoft.Network/networkWatchers/flowLogs/"
          | extend body = tostring(parse_json(Properties).requestbody)
          | project TimeGenerated, Caller, OperationNameValue, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

A canonical set of Activity Log alerts fires per-subscription on the operations whose execution is, by themselves, the indicator of compromise or the indicator of a high-risk human action: Microsoft.Authorization/roleAssignments/write (any role assignment change), Microsoft.Network/networkSecurityGroups/securityRules/write + .../delete (NSG rule changes), Microsoft.KeyVault/vaults/delete + Microsoft.KeyVault/vaults/keys/delete (Key Vault and key deletes), Microsoft.Authorization/policyAssignments/write (policy assignment writes), Microsoft.Resources/subscriptions/delete, Microsoft.Resources/subscriptions/providers/Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action (JIT-initiate, attacker mis-use indicator), and tenant-level operations such as directory-tenant change (Microsoft Learn — Activity Log alerts (accessed 2026-05)). Each alert routes to an Action Group whose receivers include the on-call channel, a Sentinel incident-creator (so the alert correlates with concurrent Defender alerts and sign-in anomalies for the same actor), and an ITSM ticket creator. This control is the Azure analog of the Phase 4 four-eyes-on-critical-events principle in General Logging — alerting; for the underlying detection-engineering principle see SIEM / detection engineering.

Remediation — Azure CLI

# Azure CLI 2.x
# Create an Action Group that fans out to email + Sentinel incident + ITSM.
az monitor action-group create \
  --resource-group rg-security-alerts-westeu \
  --name ag-soc-oncall \
  --short-name sococ \
  --action email soc-oncall soc-oncall@example.com \
  --action webhook sentinel-incident https://prod-XX.westeurope.logic.azure.com/workflows/.../triggers/manual/paths/invoke

AG_ID=$(az monitor action-group show \
  --resource-group rg-security-alerts-westeu --name ag-soc-oncall --query id -o tsv)

# Activity Log alert: any role-assignment write at the subscription scope.
az monitor activity-log alert create \
  --resource-group rg-security-alerts-westeu \
  --name alert-role-assignment-write \
  --scope "/subscriptions/$(az account show --query id -o tsv)" \
  --condition category=Administrative \
  --condition operationName=Microsoft.Authorization/roleAssignments/write \
  --action-group "$AG_ID"

# Repeat for: NSG rule write/delete, Key Vault delete, key delete, policy assignment write,
# subscription delete, JIT-initiate, etc.

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — Activity Log alerts via Terraform.

locals {
  canonical_critical_operations = {
    "role-assignment-write"       = "Microsoft.Authorization/roleAssignments/write"
    "role-assignment-delete"      = "Microsoft.Authorization/roleAssignments/delete"
    "nsg-rule-write"              = "Microsoft.Network/networkSecurityGroups/securityRules/write"
    "nsg-rule-delete"             = "Microsoft.Network/networkSecurityGroups/securityRules/delete"
    "keyvault-delete"             = "Microsoft.KeyVault/vaults/delete"
    "keyvault-key-delete"         = "Microsoft.KeyVault/vaults/keys/delete"
    "policy-assignment-write"     = "Microsoft.Authorization/policyAssignments/write"
    "policy-assignment-delete"    = "Microsoft.Authorization/policyAssignments/delete"
    "subscription-delete"         = "Microsoft.Resources/subscriptions/delete"
  }
}

resource "azurerm_monitor_action_group" "soc_oncall" {
  name                = "ag-soc-oncall"
  resource_group_name = "rg-security-alerts-westeu"
  short_name          = "sococ"

  email_receiver {
    name          = "soc-oncall"
    email_address = "soc-oncall@example.com"
  }

  webhook_receiver {
    name        = "sentinel-incident"
    service_uri = var.sentinel_incident_logic_app_callback_url
  }
}

resource "azurerm_monitor_activity_log_alert" "critical_ops" {
  for_each            = local.canonical_critical_operations
  name                = "alert-${each.key}"
  resource_group_name = "rg-security-alerts-westeu"
  location            = "global"
  scopes              = ["/subscriptions/${var.subscription_id}"]

  criteria {
    category       = "Administrative"
    operation_name = each.value
  }

  action {
    action_group_id = azurerm_monitor_action_group.soc_oncall.id
  }
}

Remediation — Bicep

targetScope = 'subscription'

resource contact 'Microsoft.Security/securityContacts@2023-12-01-preview' = {
  name: 'default'
  properties: {
    emails: 'soc@example.org;ir-oncall@example.org'
    notificationsByRole: {
      state: 'On'
      roles: ['Owner', 'ServiceAdmin', 'AccountAdmin']
    }
    alertNotifications: {
      state: 'On'
      minimalSeverity: 'Medium'
    }
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue in ("Microsoft.Insights/activityLogAlerts/delete", "Microsoft.Insights/activityLogAlerts/write", "Microsoft.Insights/actionGroups/write", "Microsoft.Insights/actionGroups/delete")
          | extend body = tostring(parse_json(Properties).requestbody)
          | project TimeGenerated, Caller, OperationNameValue, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Microsoft Sentinel is onboarded to the central Log Analytics workspace with data connectors enabled for Microsoft Entra ID (Audit + Sign-in logs), Azure Activity Log (from azure-log-01), Microsoft Defender for Cloud (from azure-log-04), Office 365, Microsoft Defender XDR (formerly Microsoft 365 Defender), Azure DNS, and any third-party syslog / CEF sources the tenant runs. Built-in analytics rules from the Microsoft Sentinel content hub cover the canonical detection set; custom KQL hunting queries cover the organisation-specific scenarios. SOAR closes the loop: automation rules trigger Logic App playbooks on incident severity High (isolate VM via quarantine NSG, disable identity via Microsoft Graph, snapshot affected managed disks, notify the on-call channel). Retention strategy: 2 years total — 90 days hot in the LAW, 21 months in the Sentinel archive tier (and/or Sentinel auxiliary-logs tier for high-volume low-touch sources such as firewall logs), with rehydration on demand for forensic investigations (Microsoft Learn — What is Microsoft Sentinel (accessed 2026-05)). Note on pricing tiers: Sentinel pricing across the hot / archive / auxiliary tiers, and the relationship between Sentinel commitment tiers and Log Analytics commitment tiers, has changed multiple times since 2023 — re-verify current pricing at writing time before sizing the workspace. Anti-conflation with azure-log-04 (Defender for Cloud): repeating the boundary called out in the Overview: Microsoft Sentinel is the SIEM + SOAR plane — data ingestion, KQL analytics, automation rules, Logic App playbooks; Microsoft Defender for Cloud is the CSPM + CWPP plane — posture management, regulatory compliance scoring, workload-protection plans. The Defender for Cloud data connector pipes Defender alerts into Sentinel where they become correlated incidents alongside Entra sign-in anomalies and third-party EDR alerts. They are not the same product, not licensed together, not substitutable. The canonical Microsoft-recommended pipeline is Defender alerts → Sentinel incidents → Sentinel automation rules → Logic App playbooks → containment + notification. Adopting one and skipping the other leaves a gap; adopting both and connecting them is the design intent.

Remediation — Azure CLI

# Azure CLI 2.x  (with the 'sentinel' extension installed: az extension add --name sentinel)
# Onboard Sentinel to the central LAW.
az sentinel onboarding-state create \
  --resource-group rg-security-logging-westeu \
  --workspace-name law-central-prod \
  --name default \
  --customer-managed-key false

# Enable the Microsoft Entra ID data connector (Audit + Sign-in logs).
az sentinel data-connector create \
  --resource-group rg-security-logging-westeu \
  --workspace-name law-central-prod \
  --data-connector-id aad-id \
  --kind AzureActiveDirectory \
  --tenant-id "$(az account show --query tenantId -o tsv)" \
  --data-types '{"signInLogs":{"state":"Enabled"},"auditLogs":{"state":"Enabled"}}'

# Enable the Defender for Cloud data connector for the current subscription.
az sentinel data-connector create \
  --resource-group rg-security-logging-westeu \
  --workspace-name law-central-prod \
  --data-connector-id mdc-sub \
  --kind AzureSecurityCenter \
  --subscription-id "$(az account show --query id -o tsv)" \
  --data-types '{"alerts":{"state":"Enabled"}}'

# Verify connectors.
az sentinel data-connector list \
  --resource-group rg-security-logging-westeu \
  --workspace-name law-central-prod -o table

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn — Microsoft Sentinel onboarding + automation rules.

resource "azurerm_sentinel_log_analytics_workspace_onboarding" "this" {
  workspace_id                 = azurerm_log_analytics_workspace.central.id
  customer_managed_key_enabled = false
}

# Entra ID Audit + Sign-in data connector.
resource "azurerm_sentinel_data_connector_azure_active_directory" "entra" {
  name                       = "entra-id"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.central.id
  tenant_id                  = var.tenant_id
}

# Defender for Cloud (subscription-scoped) data connector.
resource "azurerm_sentinel_data_connector_azure_security_center" "mdc" {
  name                       = "mdc-sub"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.central.id
  subscription_id            = var.subscription_id
}

# SOAR: automation rule that fires a Logic App playbook on High-severity incidents.
resource "azurerm_sentinel_automation_rule" "high_severity_isolate" {
  name                       = "isolate-vm-on-high-severity"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.central.id
  display_name               = "Isolate VM on high-severity incident"
  order                      = 1
  enabled                    = true

  condition_json = jsonencode([
    {
      property = "IncidentSeverity"
      operator = "Equals"
      values   = ["High"]
    }
  ])

  action_playbook {
    logic_app_id = azurerm_logic_app_workflow.isolate_vm.id
    order        = 1
  }
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Sentinel-onboarded workspace name.')
param workspaceName string

resource workspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: workspaceName
  location: resourceGroup().location
  properties: {
    sku: { name: 'PerGB2018' }
    retentionInDays: 730    // 24-month retention to keep audit trail
    features: { enableLogAccessUsingOnlyResourcePermissions: true }
  }
}

resource onboard 'Microsoft.SecurityInsights/onboardingStates@2024-09-01' = {
  scope: workspace
  name: 'default'
  properties: {}
}

Compliance mapping

AzureActivity
          | where OperationNameValue == "Microsoft.SecurityInsights/dataConnectors/delete" or (OperationNameValue == "Microsoft.OperationalInsights/workspaces/write" and tostring(parse_json(Properties).requestbody) has "retentionInDays")
          | extend body = tostring(parse_json(Properties).requestbody)
          | project TimeGenerated, Caller, ResourceId, OperationNameValue, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI