Azure operational security checklist

Deploying a cloud application on Azure is fast, easy, and cost-effective. Before deploying an application, use a checklist to evaluate your application against a list of essential and recommended security actions.

Introduction

Azure provides a suite of infrastructure services that you can use to deploy your applications. Azure operational security refers to the services, controls, and features available to users for protecting their data, applications, and other assets in Microsoft Azure.

To get the maximum benefit from the cloud platform, use Azure services and follow the checklist. Organizations that invest time and resources assessing the operational readiness of their applications before launch have a higher rate of satisfaction than those that don't. When you perform this work, checklists can help ensure that applications are evaluated consistently and holistically.

Checklist

This checklist helps enterprises think through various operational security considerations as they deploy sophisticated enterprise applications on Azure. You can also use it to help build a secure cloud migration and operation strategy for your organization.

Checklist Category	Description
Security roles and access controls	Use Azure role-based access control (Azure RBAC) to assign permissions to users, groups, and applications at a specific scope.
Data protection and storage	Use management plane security to secure your storage account by using Azure role-based access control (Azure RBAC). Use data plane security to secure access to your data by using Shared Access Signatures (SAS) and stored access policies. Use transport-level encryption by using HTTPS and the encryption provided by Server Message Block (SMB) 3.0 for Azure file shares. Use Client-side encryption to secure data that you send to storage accounts when you require sole control of encryption keys. Use Storage Service Encryption (SSE) to automatically encrypt data in Azure Storage, and Azure Disk Encryption for Linux VMs and Azure Disk Encryption for Windows VMs to encrypt virtual machine disk files for the OS and data disks. Use Azure Storage Analytics to monitor authorization type. As with Blob Storage, you can see whether users used a shared access signature or the storage account keys. Use Cross-Origin Resource Sharing (CORS) to access storage resources from different domains.
Security policies and recommendations	Use Microsoft Defender for Cloud to deploy endpoint solutions. Add a web application firewall (WAF) to secure web applications. Use Azure Firewall to increase your security protections. Apply security contact details for your Azure subscription. The Microsoft Security Response Center (MSRC) contacts you if it discovers that an unlawful or unauthorized party accessed your customer data.
Identity and access management	Synchronize your on-premises directory with your cloud directory by using Microsoft Entra ID. Use single sign-on to enable users to access their SaaS applications based on their organizational account in Microsoft Entra ID. Use the password reset registration activity report to monitor the users who are registering. Enable multifactor authentication (MFA) for users. Use secure identity capabilities for apps, such as Microsoft Security Development Lifecycle (SDL). Actively monitor for suspicious activities by using Microsoft Entra ID P1 or P2 anomaly reports and Microsoft Entra ID Protection capability.
Ongoing security monitoring	Use the Malware Assessment Solution in Azure Monitor logs to report on the status of antimalware protection in your infrastructure. Use Update Management to determine the overall exposure to potential security problems, and whether or how critical these updates are for your environment. The Microsoft Entra admin center provides visibility into the integrity and security of your organization's directory.
Microsoft Defender for Cloud detection capabilities	Use Cloud Security Posture Management (CSPM) for hardening guidance that helps you efficiently and effectively improve your security. Use alerts to be notified when threats are identified in your cloud, hybrid, or on-premises environment. Use security policies, initiatives, and recommendations to improve your security posture.

Conclusion

Many organizations have successfully deployed and operated their cloud applications on Azure. These checklists highlight essential actions that help increase the likelihood of successful deployments and frustration-free operations. Review these operational and strategic considerations for your existing and new application deployments on Azure.

Next steps

To learn more about security in Azure, see the following articles:

Feedback

Was this page helpful?

Last updated on 2026-07-21