Azure Network Hardening

Azure does not provision a "default VNet" the way AWS provisions a default VPC, but the equivalent failure mode is real: workload teams creating ad-hoc VNets outside the approved IP-address plan, with overlapping CIDRs, no peering to the hub, and no NSG on the subnet at all. Enforce an explicit per-workload VNet design (hub-and-spoke or Azure Virtual WAN) via Azure Policy assigned at the root management group, deny VNet creation outside the approved IP plan, and require NSG attachment on every subnet at creation time (Microsoft Learn — Azure Virtual Network overview (accessed 2026-05)). The principle is reinforced in General Network — segmentation: a network the organisation did not consciously design is a network whose blast radius the organisation cannot reason about.

Remediation — Azure CLI

# Azure CLI 2.x
# Inventory: list every VNet in every subscription of the tenant.
for sub in $(az account list --query '[].id' -o tsv); do
  az network vnet list --subscription "$sub" \
    --query "[].{sub:'$sub', name:name, rg:resourceGroup, prefixes:addressSpace.addressPrefixes}" \
    -o tsv
done

# Per workload: create an explicit VNet inside the approved IP plan.
az network vnet create \
  --resource-group rg-net-prod-westeu \
  --name vnet-app-prod-westeu \
  --address-prefixes 10.40.0.0/16 \
  --location westeurope

# Assign the built-in "Allowed locations" + a custom "denied address-space" policy
# at the root management group so future VNets cannot drift.
az policy assignment create \
  --name pa-network-ip-plan \
  --scope "/providers/Microsoft.Management/managementGroups/tenant-root" \
  --policy-set-definition "/providers/Microsoft.Authorization/policySetDefinitions/<ip-plan-initiative-id>"

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
resource "azurerm_resource_group" "net" {
  name     = "rg-net-prod-westeu"
  location = "westeurope"
}

resource "azurerm_virtual_network" "workload" {
  name                = "vnet-app-prod-westeu"
  resource_group_name = azurerm_resource_group.net.name
  location            = azurerm_resource_group.net.location
  address_space       = ["10.40.0.0/16"]
  tags                = { tier = "prod", owner = "platform-network" }
}

# Root-management-group policy assignment: deny VNet creation outside the
# approved IP plan. Custom policy definition referenced by id.
resource "azurerm_management_group_policy_assignment" "deny_unplanned_vnets" {
  name                 = "deny-unplanned-vnets"
  management_group_id  = "/providers/Microsoft.Management/managementGroups/tenant-root"
  policy_definition_id = var.ip_plan_policy_definition_id
  description          = "Deny VNet creation outside the approved IP plan"
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Hardened-by-default VNet with explicit address space, no default subnet, DDoS std off-by-default plan id.')
param vnetName string
@description('Address space CIDR.')
param addressPrefix string = '10.0.0.0/16'

param location string = resourceGroup().location

resource vnet 'Microsoft.Network/virtualNetworks@2024-03-01' = {
  name: vnetName
  location: location
  properties: {
    addressSpace: { addressPrefixes: [addressPrefix] }
    // No default subnet — explicit subnets defined per-workload module.
    encryption: { enabled: true, enforcement: 'AllowUnencrypted' }
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue in ("Microsoft.Network/virtualNetworks/write", "Microsoft.Network/virtualNetworks/subnets/write", "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write")
          | extend body = tostring(parse_json(Properties).requestbody)
          | project TimeGenerated, Caller, OperationNameValue, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

No Network Security Group in any subscription may permit ingress from the Internet service tag (or 0.0.0.0/0) on administrative ports — SSH 22, RDP 3389, SQL 1433, PostgreSQL 5432, MySQL 3306, MongoDB 27017, Redis 6379, and any other database or management port the organisation uses — at either NIC scope or subnet scope (Microsoft Learn — Network Security Groups overview (accessed 2026-05)). NSGs are stateful L4 firewalls evaluated twice on the packet path (once at the subnet NSG and once at the NIC NSG), default-deny on ingress from the internet, and the most directly enforceable per-resource boundary Azure exposes at the network layer. This is the canonical "open the internet to my database" misconfiguration; Shodan-style scanners locate exposures within minutes. Anti-conflation: NSGs are L4 only — they do not do FQDN filtering, IDPS, or TLS inspection. Those live on Azure Firewall Premium (azure-net-08), which is centralised at the hub and complements NSGs rather than replacing them. Use the Internet service tag rather than literal 0.0.0.0/0 where possible; the tag is operationally clearer and survives address-prefix expansions.

Remediation — Azure CLI

# Azure CLI 2.x
# Audit: enumerate every NSG rule allowing Internet -> admin ports across the tenant.
for sub in $(az account list --query '[].id' -o tsv); do
  az network nsg list --subscription "$sub" --query '[].id' -o tsv | while read nsg_id; do
    az network nsg rule list --ids "$nsg_id" \
      --query "[?direction=='Inbound' && access=='Allow' && (sourceAddressPrefix=='Internet' || sourceAddressPrefix=='*' || sourceAddressPrefix=='0.0.0.0/0')].{nsg:'$nsg_id', name:name, ports:destinationPortRanges}" \
      -o tsv
  done
done

# Apply the canonical deny rule at NIC + subnet scope.
az network nsg rule create \
  --resource-group rg-net-prod-westeu \
  --nsg-name nsg-app-subnet \
  --name DenyInternetToSshRdpSql \
  --priority 100 \
  --direction Inbound \
  --access Deny \
  --protocol Tcp \
  --source-address-prefixes Internet \
  --destination-port-ranges 22 3389 1433 5432 3306 27017 6379

# Continuous enforcement: built-in CIS Microsoft Azure Foundations Benchmark v3.0.0
# initiative assigned at the root management group covers 6.1 and 6.2.

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
resource "azurerm_network_security_group" "app_subnet" {
  name                = "nsg-app-subnet"
  resource_group_name = azurerm_resource_group.net.name
  location            = azurerm_resource_group.net.location
}

# Canonical CRITICAL deny: Internet service tag -> all common admin ports.
resource "azurerm_network_security_rule" "deny_internet_admin_ports" {
  name                        = "DenyInternetToSshRdpSql"
  resource_group_name         = azurerm_resource_group.net.name
  network_security_group_name = azurerm_network_security_group.app_subnet.name
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_ranges     = ["22", "3389", "1433", "5432", "3306", "27017", "6379"]
  source_address_prefix       = "Internet"
  destination_address_prefix  = "*"
}

# Allow SSH/RDP only from the bastion subnet ASG.
resource "azurerm_network_security_rule" "allow_bastion_admin" {
  name                        = "AllowBastionToAdmin"
  resource_group_name         = azurerm_resource_group.net.name
  network_security_group_name = azurerm_network_security_group.app_subnet.name
  priority                    = 200
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_ranges     = ["22", "3389"]
  source_application_security_group_ids = [azurerm_application_security_group.bastion.id]
  destination_address_prefix  = "*"
}

resource "azurerm_subnet_network_security_group_association" "app" {
  subnet_id                 = azurerm_subnet.app.id
  network_security_group_id = azurerm_network_security_group.app_subnet.id
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('NSG name applied to workload subnets to deny SSH/RDP from Internet.')
param nsgName string

param location string = resourceGroup().location

resource nsg 'Microsoft.Network/networkSecurityGroups@2024-03-01' = {
  name: nsgName
  location: location
  properties: {
    securityRules: [
      {
        name: 'deny-ssh-from-internet'
        properties: {
          priority: 100, direction: 'Inbound', access: 'Deny', protocol: 'Tcp'
          sourceAddressPrefix: 'Internet', sourcePortRange: '*'
          destinationAddressPrefix: '*',   destinationPortRange: '22'
        }
      }
      {
        name: 'deny-rdp-from-internet'
        properties: {
          priority: 110, direction: 'Inbound', access: 'Deny', protocol: 'Tcp'
          sourceAddressPrefix: 'Internet', sourcePortRange: '*'
          destinationAddressPrefix: '*',   destinationPortRange: '3389'
        }
      }
    ]
  }
}

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as network from "@pulumi/azure-native/network";

new network.NetworkSecurityGroup("workload-nsg", {
  resourceGroupName: "<rg>",
  securityRules: [
    {
      name: "deny-ssh-from-internet",
      priority: 100, direction: network.AccessRuleDirection.Inbound, access: network.SecurityRuleAccess.Deny,
      protocol: network.SecurityRuleProtocol.Tcp,
      sourceAddressPrefix: "Internet", sourcePortRange: "*",
      destinationAddressPrefix: "*", destinationPortRange: "22",
    },
    {
      name: "deny-rdp-from-internet",
      priority: 110, direction: network.AccessRuleDirection.Inbound, access: network.SecurityRuleAccess.Deny,
      protocol: network.SecurityRuleProtocol.Tcp,
      sourceAddressPrefix: "Internet", sourcePortRange: "*",
      destinationAddressPrefix: "*", destinationPortRange: "3389",
    },
  ],
});

Compliance mapping

AzureActivity
          | where OperationNameValue == "Microsoft.Network/networkSecurityGroups/securityRules/write"
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"access\":\"Allow\"" and body has "\"direction\":\"Inbound\""
          | where body has "\"sourceAddressPrefix\":\"*\"" or body has "\"sourceAddressPrefix\":\"0.0.0.0/0\"" or body has "\"sourceAddressPrefix\":\"Internet\""
          | where body has "\"22\"" or body has "\"3389\"" or body has "\"5985\"" or body has "\"5986\"" or body has "\"22-22\""
          | project TimeGenerated, Caller, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Regulated PaaS services — Storage Accounts, Key Vault, Azure SQL, Cosmos DB, App Configuration, Container Registry — must have public_network_access_enabled = false at the resource level, default network rules set to Deny, and access strictly through Private Endpoints (covered as azure-net-04). Enforce subscription-wide via Azure Policy assigned at the root management group; do not rely on per-resource diligence (Microsoft Learn — Storage Account network security (accessed 2026-05)). The principle is reinforced in General Network — private connectivity: PaaS services with a public IP are reachable from any internet host that can guess the resource name and present valid credentials, so the network perimeter must remove the public IP rather than rely on identity alone. Anti-conflation: this is the policy invariant ("public off, Private Endpoints required"); the resource-level Private Endpoint attachment is the implementation pattern covered by azure-net-04. CRITICAL because exploitation is a single misconfiguration away from internet-reachable storage or secrets.

Remediation — Azure CLI

# Azure CLI 2.x
# Storage Account: turn off all three public-access toggles + default-deny firewall.
az storage account update \
  --resource-group rg-data-prod-westeu \
  --name stappprodwesteu001 \
  --public-network-access Disabled \
  --allow-blob-public-access false \
  --default-action Deny

# Key Vault: turn off public network access; enforce RBAC.
az keyvault update \
  --resource-group rg-data-prod-westeu \
  --name kv-app-prod-westeu \
  --public-network-access Disabled \
  --default-action Deny \
  --enable-rbac-authorization true

# Audit: list every Storage Account in the tenant that still allows public access.
for sub in $(az account list --query '[].id' -o tsv); do
  az storage account list --subscription "$sub" \
    --query "[?publicNetworkAccess=='Enabled' || allowBlobPublicAccess==\`true\`].{sub:'$sub', name:name, rg:resourceGroup}" \
    -o tsv
done

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
resource "azurerm_storage_account" "app" {
  name                          = "stappprodwesteu001"
  resource_group_name           = azurerm_resource_group.data.name
  location                      = azurerm_resource_group.data.location
  account_tier                  = "Standard"
  account_replication_type      = "ZRS"
  min_tls_version               = "TLS1_2"

  # Three independent public-access toggles — all must close.
  public_network_access_enabled   = false
  allow_nested_items_to_be_public = false
  shared_access_key_enabled       = false   # force Entra ID auth where supported

  network_rules {
    default_action             = "Deny"
    bypass                     = ["AzureServices"]
    virtual_network_subnet_ids = []          # no Service Endpoints; Private Endpoints only
    ip_rules                   = []
  }
}

resource "azurerm_key_vault" "app" {
  name                          = "kv-app-prod-westeu"
  resource_group_name           = azurerm_resource_group.data.name
  location                      = azurerm_resource_group.data.location
  tenant_id                     = data.azurerm_client_config.current.tenant_id
  sku_name                      = "premium"
  public_network_access_enabled = false
  enable_rbac_authorization     = true
  purge_protection_enabled      = true
  soft_delete_retention_days    = 90

  network_acls {
    default_action = "Deny"
    bypass         = "AzureServices"
  }
}

# Root-management-group initiative: deny PaaS resources with public network access on.
resource "azurerm_management_group_policy_assignment" "deny_paas_public" {
  name                 = "deny-paas-public-network-access"
  management_group_id  = "/providers/Microsoft.Management/managementGroups/tenant-root"
  policy_definition_id = var.deny_paas_public_initiative_id
  description          = "Storage / KV / SQL / Cosmos must have public network access disabled"
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Azure Policy assignment forbidding public-access PaaS endpoints.')
param assignmentName string = 'deny-public-paas-endpoints'

// Built-in initiative: Configure Azure PaaS services to use private link
var initiativeId = '/providers/Microsoft.Authorization/policySetDefinitions/d1cb47db-b7a1-4c46-814e-aad1c0e84f3c'

resource assign 'Microsoft.Authorization/policyAssignments@2024-04-01' = {
  name: assignmentName
  properties: {
    policyDefinitionId: initiativeId
    enforcementMode: 'Default'
    displayName: 'Deny PaaS resources with public network access'
  }
}

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as authorization from "@pulumi/azure-native/authorization";

new authorization.PolicyAssignment("deny-public-paas-endpoints", {
  scope: "/subscriptions/<sub-id>",
  policyAssignmentName: "deny-public-paas-endpoints",
  policyDefinitionId: "/providers/Microsoft.Authorization/policySetDefinitions/d1cb47db-b7a1-4c46-814e-aad1c0e84f3c",
  enforcementMode: authorization.EnforcementMode.Default,
  displayName: "Deny PaaS resources with public network access",
});

Compliance mapping

AzureActivity
          | where OperationNameValue endswith "/write"
          | where ResourceId has_any ("Microsoft.Storage/storageAccounts", "Microsoft.KeyVault/vaults", "Microsoft.Sql/servers", "Microsoft.DocumentDB/databaseAccounts", "Microsoft.CognitiveServices/accounts")
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"publicNetworkAccess\":\"Enabled\"" or body has "\"defaultAction\":\"Allow\""
          | project TimeGenerated, Caller, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Front PaaS services accessed from VNets with Private Endpoints, not Service Endpoints. A Private Endpoint surfaces a private IP inside a chosen workload subnet that fronts the PaaS resource via Azure Private Link, integrates with a Private DNS Zone so the public PaaS FQDN resolves to the private IP from inside the VNet, and lets the upstream policy in azure-net-03 hold (Microsoft Learn — Private Endpoint overview (accessed 2026-05)). The principle is reinforced in General Network — zero trust: never traverse a network you do not control. Anti-pattern to flag: Service Endpoints (the legacy pattern, Microsoft.Storage etc. on a subnet) keep traffic on the Azure backbone but the PaaS service still exposes a public IP, so the public attack surface remains; Private Endpoints expose a private IP inside the VNet and remove the public attack surface entirely. Service Endpoints survive only for backwards-compatibility — new code should always use Private Endpoints. HIGH PREVENTIVE because this is the implementation pattern that makes the CRITICAL policy in azure-net-03 enforceable in workload code.

Remediation — Azure CLI

# Azure CLI 2.x
# Resolve the resource id of the target Storage Account.
STORAGE_ID=$(az storage account show \
  --resource-group rg-data-prod-westeu \
  --name stappprodwesteu001 --query id -o tsv)

# Create a Private Endpoint in the workload PE subnet for the blob sub-resource.
az network private-endpoint create \
  --resource-group rg-net-prod-westeu \
  --name pe-stappprodwesteu001-blob \
  --vnet-name vnet-app-prod-westeu \
  --subnet snet-pe-data \
  --private-connection-resource-id "$STORAGE_ID" \
  --group-id blob \
  --connection-name pec-stappprodwesteu001-blob \
  --location westeurope

# Create the Private DNS Zone and link the workload VNet to it.
az network private-dns zone create \
  --resource-group rg-net-prod-westeu \
  --name privatelink.blob.core.windows.net

az network private-dns link vnet create \
  --resource-group rg-net-prod-westeu \
  --zone-name privatelink.blob.core.windows.net \
  --name pdz-link-vnet-app-prod \
  --virtual-network vnet-app-prod-westeu \
  --registration-enabled false

# Wire the Private Endpoint's A record into the zone.
az network private-endpoint dns-zone-group create \
  --resource-group rg-net-prod-westeu \
  --endpoint-name pe-stappprodwesteu001-blob \
  --name pdzg-blob \
  --private-dns-zone privatelink.blob.core.windows.net \
  --zone-name blob

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
resource "azurerm_private_dns_zone" "blob" {
  name                = "privatelink.blob.core.windows.net"
  resource_group_name = azurerm_resource_group.net.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "blob_app" {
  name                  = "pdz-link-vnet-app-prod"
  resource_group_name   = azurerm_resource_group.net.name
  private_dns_zone_name = azurerm_private_dns_zone.blob.name
  virtual_network_id    = azurerm_virtual_network.workload.id
  registration_enabled  = false
}

resource "azurerm_private_endpoint" "storage_blob" {
  name                = "pe-stappprodwesteu001-blob"
  resource_group_name = azurerm_resource_group.net.name
  location            = azurerm_resource_group.net.location
  subnet_id           = azurerm_subnet.pe_data.id

  private_service_connection {
    name                           = "pec-stappprodwesteu001-blob"
    private_connection_resource_id = azurerm_storage_account.app.id
    subresource_names              = ["blob"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "pdzg-blob"
    private_dns_zone_ids = [azurerm_private_dns_zone.blob.id]
  }
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Resource ID of the PaaS service being wrapped (e.g. Storage / KV / SQL).')
param targetResourceId string
@description('Group ID for the private endpoint (e.g. blob, vault, sqlServer).')
param groupId string
@description('Subnet ID hosting the endpoint NIC.')
param subnetId string

param location string = resourceGroup().location

resource pe 'Microsoft.Network/privateEndpoints@2024-03-01' = {
  name: 'pe-${groupId}-${uniqueString(targetResourceId)}'
  location: location
  properties: {
    subnet: { id: subnetId }
    privateLinkServiceConnections: [
      {
        name: 'plsc'
        properties: {
          privateLinkServiceId: targetResourceId
          groupIds: [groupId]
        }
      }
    ]
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue in ("Microsoft.Network/privateLinkServices/privateEndpointConnections/write", "Microsoft.Network/privateEndpoints/privateLinkServiceConnections/write")
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "Approved" or body has "Pending"
          | project TimeGenerated, Caller, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Front internet-facing web traffic with Azure Front Door Premium and attach a WAF Premium policy carrying the Microsoft-managed Default Rule Set (DRS) 2.1 and the Bot Manager Rule Set; use custom rules only for tenant-specific exceptions (Microsoft Learn — Azure Front Door WAF overview (accessed 2026-05)). Front Door WAF is global and runs at the Microsoft edge, inspecting HTTP and HTTPS payloads — URI, headers, body, cookies, query strings — and is therefore an L7 control. Anti-conflation: Front Door WAF is not a substitute for DDoS Protection Standard (azure-net-06); WAF cannot help with a 1 Tbps volumetric SYN flood any more than DDoS Standard can stop an SQLi attempt in a well-formed HTTPS request. They are layered, not alternative. Application Gateway WAF is the regional in-VNet alternative for backends that cannot front through the public edge (mTLS-required APIs, internal landing pages) — covered in prose here, not as a separate control. HIGH PREVENTIVE because managed rules block known-exploit-pattern traffic at the edge before it ever reaches the application's parsing logic.

Remediation — Azure CLI

# Azure CLI 2.x
# Create the Front Door Premium WAF policy.
az network front-door waf-policy create \
  --resource-group rg-edge-prod \
  --name fdwaf-app-prod \
  --sku Premium_AzureFrontDoor \
  --mode Prevention

# Add the Microsoft-managed Default Rule Set 2.1 in Block mode.
az network front-door waf-policy managed-rules add \
  --resource-group rg-edge-prod \
  --policy-name fdwaf-app-prod \
  --type Microsoft_DefaultRuleSet \
  --version 2.1 \
  --action Block

# Add the Bot Manager rule set.
az network front-door waf-policy managed-rules add \
  --resource-group rg-edge-prod \
  --policy-name fdwaf-app-prod \
  --type Microsoft_BotManagerRuleSet \
  --version 1.0 \
  --action Block

# Associate the policy with the Front Door Premium security policy.
az afd security-policy create \
  --resource-group rg-edge-prod \
  --profile-name afd-app-prod \
  --security-policy-name sp-app-prod \
  --domains "/subscriptions/.../customDomains/app-example-com" \
  --waf-policy "/subscriptions/.../frontDoorWebApplicationFirewallPolicies/fdwaf-app-prod"

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
resource "azurerm_cdn_frontdoor_firewall_policy" "app" {
  name                = "fdwafappprod"
  resource_group_name = azurerm_resource_group.edge.name
  sku_name            = "Premium_AzureFrontDoor"
  enabled             = true
  mode                = "Prevention"

  managed_rule {
    type    = "Microsoft_DefaultRuleSet"
    version = "2.1"
    action  = "Block"
  }

  managed_rule {
    type    = "Microsoft_BotManagerRuleSet"
    version = "1.0"
    action  = "Block"
  }
}

resource "azurerm_cdn_frontdoor_security_policy" "app" {
  name                     = "sp-app-prod"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.app.id

  security_policies {
    firewall {
      cdn_frontdoor_firewall_policy_id = azurerm_cdn_frontdoor_firewall_policy.app.id
      association {
        domain {
          cdn_frontdoor_domain_id = azurerm_cdn_frontdoor_custom_domain.app.id
        }
        patterns_to_match = ["/*"]
      }
    }
  }
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Front Door WAF policy in Prevention mode with OWASP managed rules.')
param policyName string

resource waf 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2024-02-01' = {
  name: policyName
  location: 'Global'
  sku: { name: 'Premium_AzureFrontDoor' }
  properties: {
    policySettings: {
      enabledState: 'Enabled'
      mode: 'Prevention'
      requestBodyCheck: 'Enabled'
    }
    managedRules: {
      managedRuleSets: [
        { ruleSetType: 'Microsoft_DefaultRuleSet',  ruleSetVersion: '2.1', ruleSetAction: 'Block' }
        { ruleSetType: 'Microsoft_BotManagerRuleSet', ruleSetVersion: '1.1' }
      ]
    }
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue == "Microsoft.Network/frontdoorwebapplicationfirewallpolicies/write"
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"mode\":\"Detection\"" or body has "\"action\":\"Allow\"" or body has "managedRuleOverrides"
          | project TimeGenerated, Caller, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Enable Azure DDoS Protection Standard on VNets that host internet-facing public IPs (Load Balancer frontends, Application Gateway frontends, Bastion hosts, Network Virtual Appliances) and pair it with Azure Monitor metrics + alerts for traffic spikes and mitigation events (Microsoft Learn — Azure DDoS Protection Standard overview (accessed 2026-05)). DDoS Protection Basic is automatic and free at the Azure platform level — it protects every public IP against the largest volumetric attacks Microsoft sees on the global network. DDoS Protection Standard is the per-VNet paid tier (flat per-tenant per-month price plus per-resource overage) that adds tunable mitigation policies, attack analytics, cost-protection (DDoS-related scale-out is credited back), and rapid-response engagement with the Microsoft DDoS Rapid Response team. Anti-conflation: Standard plan is L3/L4 volumetric mitigation attached to VNets — the network-layer inverse of Front Door WAF (azure-net-05), which is L7 and edge-deployed. They are layered, not substitutes. MEDIUM RESPONSIVE because Standard's value-add over Basic is in the mitigation feedback loop during a sustained attack, not in preventing volumetric traffic from ever arriving — and most workloads have viable cheaper alternatives (Front Door + DDoS Basic suffices for the L3/L4 attacks mid-sized workloads see).

Remediation — Azure CLI

# Azure CLI 2.x
# Create the DDoS Protection Plan (one per tenant typically; reference from many VNets).
az network ddos-protection create \
  --resource-group rg-edge-prod \
  --name ddosplan-prod \
  --location westeurope

# Attach the plan to a VNet (must be done at VNet level; subnet attachment is implicit).
az network vnet update \
  --resource-group rg-net-prod-westeu \
  --name vnet-app-prod-westeu \
  --ddos-protection-plan ddosplan-prod \
  --ddos-protection true

# Verify the plan is active.
az network ddos-protection show \
  --resource-group rg-edge-prod \
  --name ddosplan-prod \
  --query '{name:name, vnets:virtualNetworks[].id}' -o table

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
resource "azurerm_network_ddos_protection_plan" "prod" {
  name                = "ddosplan-prod"
  resource_group_name = azurerm_resource_group.edge.name
  location            = azurerm_resource_group.edge.location
  tags                = { tier = "revenue-bearing" }
}

# Wire the plan into the workload VNet via the ddos_protection_plan block.
resource "azurerm_virtual_network" "workload_ddos" {
  name                = "vnet-app-prod-westeu"
  resource_group_name = azurerm_resource_group.net.name
  location            = azurerm_resource_group.net.location
  address_space       = ["10.40.0.0/16"]

  ddos_protection_plan {
    id     = azurerm_network_ddos_protection_plan.prod.id
    enable = true
  }
}

# Azure Monitor alert on the DDoS mitigation-triggered metric.
resource "azurerm_monitor_metric_alert" "ddos_mitigation" {
  name                = "ddos-mitigation-triggered"
  resource_group_name = azurerm_resource_group.edge.name
  scopes              = [azurerm_public_ip.app.id]
  description         = "DDoS mitigation engaged on app public IP"

  criteria {
    metric_namespace = "Microsoft.Network/publicIPAddresses"
    metric_name      = "IfUnderDDoSAttack"
    aggregation      = "Maximum"
    operator         = "GreaterThan"
    threshold        = 0
  }

  action {
    action_group_id = azurerm_monitor_action_group.security_oncall.id
  }
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('DDoS Network Protection plan name.')
param planName string

param location string = resourceGroup().location

resource ddos 'Microsoft.Network/ddosProtectionPlans@2024-03-01' = {
  name: planName
  location: location
}

@description('Attach plan to an existing VNet.')
param vnetName string

resource vnet 'Microsoft.Network/virtualNetworks@2024-03-01' = {
  name: vnetName
  location: location
  properties: {
    addressSpace: { addressPrefixes: ['10.0.0.0/16'] }
    enableDdosProtection: true
    ddosProtectionPlan: { id: ddos.id }
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue in ("Microsoft.Network/ddosProtectionPlans/delete", "Microsoft.Network/virtualNetworks/write")
          | extend body = tostring(parse_json(Properties).requestbody)
          | where OperationNameValue endswith "ddosProtectionPlans/delete" or body has "\"enableDdosProtection\":false"
          | project TimeGenerated, Caller, ResourceId, OperationNameValue, body
          | order by TimeGenerated desc
          | take 100

Equivalent on: AWS · GCP · OCI

Enable DNSSEC signing on every Azure DNS public zone the organisation owns. DNSSEC binds each DNS record to a cryptographic signature that validating resolvers (and intermediate caches) check, defeating cache-poisoning and on-path response-rewrite attacks (Microsoft Learn — Azure DNS DNSSEC overview (accessed 2026-05)). The principle is reinforced in General Network — DNS security. DNSSEC for Azure DNS public zones went GA in 2024; the per-zone setting is exposed by the az network dns dnssec-config command group, and the upstream DS record must be lodged at the parent registrar. Two Azure-specific constraints to flag in advance: (1) DNSSEC applies to public zones only — Azure DNS private zones do not support DNSSEC and never will, because the validation chain assumes a public root and key signing key tied to ICANN's root trust anchor; (2) the AzureRM provider's first-class DNSSEC resource (azurerm_dns_dnssec_config) shipped in the 4.x line; on the Phase 5/6-pinned 3.x line we drive DNSSEC enablement through the az CLI as the primary remediation and document a 4.x convergence path. CIS Microsoft Azure Foundations Benchmark v3.0.0 (Feb 2025) predates the feature; re-verify at writing time in case a benchmark patch has added a sub-ID.

Remediation — Azure CLI

# Azure CLI 2.x
# Enable DNSSEC on a public zone (creates the KSK + ZSK and signs records).
az network dns dnssec-config create \
  --resource-group rg-dns-prod \
  --zone-name example.com

# Read back the DS record values to lodge at the parent registrar.
az network dns dnssec-config show \
  --resource-group rg-dns-prod \
  --zone-name example.com \
  --query '{algorithm:signingKeys[].algorithm, digests:signingKeys[].digestValue, keyTag:signingKeys[].keyTag}' \
  -o json

# Audit: list every public zone in the tenant that does NOT have DNSSEC enabled.
for sub in $(az account list --query '[].id' -o tsv); do
  az network dns zone list --subscription "$sub" \
    --query "[?zoneType=='Public'].{sub:'$sub', name:name, rg:resourceGroup}" -o tsv
done
# Cross-reference each zone with `az network dns dnssec-config show` to find gaps.

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
# Note: the first-class azurerm_dns_dnssec_config resource shipped in AzureRM 4.x.
# On the 3.x pin used by this corpus the canonical remediation is the az CLI
# block above; the public-zone resource is declared here and the DNSSEC config
# is reconciled via an azapi_resource block until corpus-wide 4.x lift.
resource "azurerm_dns_zone" "example_com" {
  name                = "example.com"
  resource_group_name = azurerm_resource_group.dns.name
  tags                = { tier = "prod", "dnssec-required" = "true" }
}

# AzAPI bridge for DNSSEC config on AzureRM 3.x.
resource "azapi_resource" "dnssec_example_com" {
  type      = "Microsoft.Network/dnsZones/dnssecConfigs@2023-07-01-preview"
  name      = "default"
  parent_id = azurerm_dns_zone.example_com.id
  body      = jsonencode({ properties = {} })
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Public DNS zone with DNSSEC enabled (GA Azure DNS).')
param zoneName string

resource zone 'Microsoft.Network/dnsZones@2023-07-01-preview' = {
  name: zoneName
  location: 'global'
  properties: {
    zoneType: 'Public'
  }
}

resource dnssec 'Microsoft.Network/dnsZones/dnssecConfigs@2023-07-01-preview' = {
  parent: zone
  name: 'default'
}

Compliance mapping

AzureActivity
          | where OperationNameValue startswith "Microsoft.Network/dnszones/" and OperationNameValue endswith "/write"
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"A\"" or body has "\"MX\"" or body has "\"NS\"" or body has "\"TXT\""
          | project TimeGenerated, Caller, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI

Deploy Azure Firewall Premium in the hub VNet of a hub-and-spoke (or in a Virtual WAN hub), front it with a Firewall Policy hierarchy (root → tenant → workload), default-deny egress, and use forced tunneling so spoke workloads cannot bypass the firewall for direct internet egress (Microsoft Learn — Azure Firewall Premium features (accessed 2026-05)). Premium adds the features that distinguish Azure Firewall from an NSG: FQDN filtering on TLS SNI (without TLS inspection), full TLS inspection (with a customer-managed CA in Key Vault), IDPS with Microsoft-managed signature sets, and URL filtering with web-category lists. The general principle — workloads talk only to destinations they need — is documented at General Network — egress control. Anti-conflation (three-way distinction): Azure Firewall is the centralised L4/L7 hub control; NSGs (azure-net-02) are L4-only and scoped at the subnet/NIC; Front Door WAF (azure-net-05) is the global edge L7 ingress filter; Application Gateway WAF is the regional in-VNet alternative for backends that cannot front through the public edge. Different scopes, different traffic directions, complementary not alternative. HIGH PREVENTIVE because egress filtering is the single largest exfiltration-path mitigation Azure exposes once east-west is constrained — it is the missing complement to Private Endpoints, which only covers Azure-service traffic.

Remediation — Azure CLI

# Azure CLI 2.x
# Create the Firewall Policy (Premium tier) at tenant level.
az network firewall policy create \
  --resource-group rg-hub-prod \
  --name fwpol-tenant-prod \
  --tier Premium \
  --threat-intel-mode Deny \
  --location westeurope

# Application rule collection group — FQDN allowlist for build-time traffic.
az network firewall policy rule-collection-group create \
  --resource-group rg-hub-prod \
  --policy-name fwpol-tenant-prod \
  --name rcg-egress-allowlist \
  --priority 200

az network firewall policy rule-collection-group collection add-filter-collection \
  --resource-group rg-hub-prod \
  --policy-name fwpol-tenant-prod \
  --rule-collection-group-name rcg-egress-allowlist \
  --name allow-build-fqdns \
  --collection-priority 100 \
  --action Allow \
  --rule-type ApplicationRule \
  --rule-name allow-build \
  --source-addresses 10.40.0.0/16 \
  --protocols Http=80 Https=443 \
  --target-fqdns registry.npmjs.org pypi.org updates.example.com

# Deploy the firewall in the hub VNet.
az network firewall create \
  --resource-group rg-hub-prod \
  --name afw-hub-prod \
  --sku AZFW_VNet \
  --tier Premium \
  --firewall-policy fwpol-tenant-prod \
  --location westeurope

Remediation — Terraform

# Terraform AzureRM provider ~> 3.0
# Source: Microsoft Learn (accessed 2026-05)
resource "azurerm_firewall_policy" "tenant" {
  name                     = "fwpol-tenant-prod"
  resource_group_name      = azurerm_resource_group.hub.name
  location                 = azurerm_resource_group.hub.location
  sku                      = "Premium"
  threat_intelligence_mode = "Deny"

  intrusion_detection {
    mode = "Deny"
  }
}

resource "azurerm_firewall_policy_rule_collection_group" "egress_allowlist" {
  name               = "rcg-egress-allowlist"
  firewall_policy_id = azurerm_firewall_policy.tenant.id
  priority           = 200

  application_rule_collection {
    name     = "allow-build-fqdns"
    priority = 100
    action   = "Allow"

    rule {
      name              = "allow-build"
      source_addresses  = ["10.40.0.0/16"]
      destination_fqdns = ["registry.npmjs.org", "pypi.org", "updates.example.com"]
      protocols {
        type = "Https"
        port = 443
      }
      protocols {
        type = "Http"
        port = 80
      }
    }
  }
}

resource "azurerm_firewall" "hub" {
  name                = "afw-hub-prod"
  resource_group_name = azurerm_resource_group.hub.name
  location            = azurerm_resource_group.hub.location
  sku_name            = "AZFW_VNet"
  sku_tier            = "Premium"
  firewall_policy_id  = azurerm_firewall_policy.tenant.id

  ip_configuration {
    name                 = "ipcfg"
    subnet_id            = azurerm_subnet.afw.id
    public_ip_address_id = azurerm_public_ip.afw.id
  }
}

Remediation — Bicep

targetScope = 'resourceGroup'

@description('Azure Firewall Premium with TLS inspection + IDPS.')
param firewallName string
@description('Subnet ID named AzureFirewallSubnet (/26 minimum).')
param firewallSubnetId string
@description('Public IP resource ID attached to the firewall.')
param publicIpId string

param location string = resourceGroup().location

resource policy 'Microsoft.Network/firewallPolicies@2024-03-01' = {
  name: '${firewallName}-policy'
  location: location
  properties: {
    sku: { tier: 'Premium' }
    threatIntelMode: 'Deny'
    intrusionDetection: { mode: 'Deny' }
    dnsSettings: { enableProxy: true }
  }
}

resource fw 'Microsoft.Network/azureFirewalls@2024-03-01' = {
  name: firewallName
  location: location
  properties: {
    sku: { name: 'AZFW_VNet', tier: 'Premium' }
    firewallPolicy: { id: policy.id }
    ipConfigurations: [
      {
        name: 'fw-ipconfig'
        properties: {
          subnet: { id: firewallSubnetId }
          publicIPAddress: { id: publicIpId }
        }
      }
    ]
  }
}

Compliance mapping

AzureActivity
          | where OperationNameValue in ("Microsoft.Network/azureFirewalls/write", "Microsoft.Network/firewallPolicies/ruleCollectionGroups/write", "Microsoft.Network/routeTables/routes/write")
          | extend body = tostring(parse_json(Properties).requestbody)
          | where body has "\"action\":\"Allow\"" and (body has "\"targetFqdns\":[\"*\"]" or body has "\"destinationAddresses\":[\"*\"]" or body has "\"nextHopType\":\"Internet\"")
          | project TimeGenerated, Caller, ResourceId, body
          | order by TimeGenerated desc
          | take 200

Equivalent on: AWS · GCP · OCI