Azure Service Security Best Practice Guide Based on Azure WAF (Well-Architected Framework)

1. Azure SQL Database and reliability
• Use Active Geo-Replication to create a readable secondary in a different region.
• Use Auto Failover Groups that can include one or multiple databases, typically used by the same application.
• Use a Zone-Redundant database.
• Monitor your Azure SQL Database in near-real time to detect reliability incidents.
• Implement Retry Logic.
• Back up your keys.
2. Azure SQL Database and security
1. Understand logical servers and how you can administer logins for multiple databases when appropriate.
2. Enable Microsoft Entra authentication with Azure SQL. Microsoft Entra authentication enables simplified permission management and centralized identity management.
3. Azure SQL logical servers should have a Microsoft Entra administrator provisioned.
4. Verify contact information email address in your Azure Subscription for service administrator and co-administrators is reaching the correct parties inside your enterprise. You don't want to miss or ignore important security notifications from Azure!
5. Review the Azure SQL Database connectivity architecture. Choose the Redirect or Proxy connection policy as appropriate.
6. Review Azure SQL Database firewall rules.
7. Use virtual network rules to control communication from particular subnets in virtual networks.
8. If using the Azure Firewall, configure Azure Firewall application rules with SQL FQDNs.
3. Azure SQL Database and cost optimization
1. Optimize queries.
2. Evaluate resource usage.
3. Fine-tune backup storage consumption.
4. Evaluate Azure SQL Database serverless.
5. Consider reserved capacity for Azure SQL Database.
6. Consider elastic pools for managing and scaling multiple databases.
4. Azure SQL Database and operational excellence
1. Use Active Geo-Replication to create a readable secondary in a different region.
2. Use Auto Failover Groups that can include one or multiple databases, typically used by the same application.
3. Use a Zone-Redundant database.
4. Monitor your Azure SQL Database in near-real time to detect reliability incidents.
5. Implement retry logic.
6. Back up your keys.
5. Azure SQL Database and performance efficiency
1. Review resource limits. For specific resource limits per pricing tier (also known as service objective) for single databases, refer to either DTU-based single database resource limits or vCore-based single database resource limits. For elastic pool resource limits, refer to either DTU-based elastic pool resource limits or vCore-based elastic pool resource limits.
2. Choose the right deployment model for your workload, vCore or DTU. Compare the vCore and DTU-based purchasing models.
3. Microsoft recommends the latest vCore database standard-series or premium-series hardware. Older Gen4 hardware has been retired.
4. When using elastic pools, familiarize yourself with resource governance.
5. Review the default max degree of parallelism (MAXDOP) and configure as needed based on a migrated or expected workload.
6. Consider using read-only replicas of critical database to offload read-only query workloads.
7. Review the Performance Center for SQL Server Database Engine and Azure SQL Database.
8. Applications connecting to Azure SQL Database should use the latest connection providers, for example the latest OLE DB Driver or ODBC Driver.

Identity and access management

• Reliability
• Turn on soft delete for blob data.
• Use Microsoft Entra ID to authorize access to blob data.
• Consider the principle of least privilege when you assign permissions to a Microsoft Entra security principal through Azure RBAC.
• Use managed identities to access blob and queue data.
• Use blob versioning or immutable blobs to store business-critical data.
• Restrict default internet access for storage accounts.
• Enable firewall rules.
• Limit network access to specific networks.
• Allow trusted Microsoft services to access the storage account.
• Enable the Secure transfer required option on all your storage accounts.
• Limit shared access signature (SAS) tokens to HTTPS connections only.
• Avoid and prevent using Shared Key authorization to access storage accounts.
• Regenerate your account keys periodically.
• Create a revocation plan and have it in place for any SAS that you issue to clients.
• Use near-term expiration times on an impromptu SAS, service SAS, or account SAS.
• Security
• Enable Azure Defender for all your storage accounts.
• Turn on soft delete for blob data.
• Use Microsoft Entra ID to authorize access to blob data.
• Consider the principle of least privilege when you assign permissions to a Microsoft Entra security principal through Azure RBAC.
• Use managed identities to access blob and queue data.
• Use blob versioning or immutable blobs to store business-critical data.
• Restrict default internet access for storage accounts.
• Enable firewall rules.
• Limit network access to specific networks.
• Allow trusted Microsoft services to access the storage account.
• Enable the Secure transfer required option on all your storage accounts.
• Limit shared access signature (SAS) tokens to HTTPS connections only.
• Avoid and prevent using Shared Key authorization to access storage accounts.
• Regenerate your account keys periodically.
• Create a revocation plan and have it in place for any SAS that you issue to clients.
• Use near-term expiration times on an impromptu SAS, service SAS, or account SAS.
• Cost optimization
• Consider cost savings by reserving data capacity for block blob storage.
• Organize data into access tiers.
• Use lifecycle policy to move data between access tiers.
• Operation Excellence
• Enable Azure Defender for all your storage accounts.
• Turn on soft delete for blob data.
• Use Microsoft Entra ID to authorize access to blob data.
• Consider the principle of least privilege when you assign permissions to a Microsoft Entra security principal through Azure RBAC.
• Use managed identities to access blob and queue data.
• Use blob versioning or immutable blobs to store business-critical data.
• Restrict default internet access for storage accounts.
• Enable firewall rules.
• Limit network access to specific networks.
• Allow trusted Microsoft services to access the storage account.
• Enable the Secure transfer required option on all your storage accounts.
• Limit shared access signature (SAS) tokens to HTTPS connections only.
• Avoid and prevent using Shared Key authorization to access storage accounts.
• Regenerate your account keys periodically.
• Create a revocation plan and have it in place for any SAS that you issue to clients.
• Use near-term expiration times on an impromptu SAS, service SAS, or account SAS.

Virtual Machines

1. Reliability
1. Review the SLAs for virtual machines.
2. VMs should be deployed in a scale set using the Flexible orchestration mode.
3. Deployed VMs across Availability Zones.
4. Package and publish application artifacts with VM Applications and Azure Compute Gallery.
5. Install applications on Ephemeral OS disks.
6. Use Maintenance Configurations to control and manage updates for VMs.
2. Security
1. Review the Linux security baseline.
2. Review the Windows security baseline.
3. Manage authentication and access control by ensuring strong passwords, multi-factor authentication, and role-based access control are in place for your VMs.
4. Protect against malicious actor scenarios: Implement security best practices such as firewalls, anti-virus software, and intrusion detection systems to protect against malware attacks, and DoS attacks
5. Plan and implement managed updates: Test updates in a non-production environment before deploying them to production, and consider using Azure Update Management to automate the update process.
6. Classify and configure encryption based on data sensitivity and include using Encryption at Host and SSL/TLS encryption.
3. Cost optimization
1. Shut down VM instances which aren't in use.
2. Use Spot VMs when appropriate.
3. Choose the right VM size for your workload.
4. Use Azure Bastion to secure operational access to the workload VMs.
5. Use a Premium SSD v2 disk and, based on your workload patterns, programmatically adjust its performance to account for either higher or lower demand.
6. For other disk types, size your disks to achieve your desired performance without the need for over-provisioning. Account for fluctuating workload patterns, and minimizing unused provisioned capacity.
7. Use Zone to Zone disaster recovery for virtual machines.
8. Prepay for reserved instances or an Azure savings plan for compute for significant azure-db-postgresqlvirtual-machinessavings.
9. Use hybrid benefit licensing.
10. Deploy Azure Monitor Agent (AMA) to collect monitoring data from the guest operating system.
4. Operational excellence
1. Monitor and measure health.
2. Set up Azure Monitor alerts for detecting configuration changes in your environment. > - Use the Application Insights extension to proactively understand how an application is performing and reactively review application execution data to determine the cause of an incident.
3. Automate tasks like provisioning and updating.
4. Build a robust testing environment by having a separate testing environment that closely mirrors your production environment and test updates and changes before deploying to production.
5. Manage your quota with monitoring resource usage and adjust your quota as needed to ensure that you have enough resources to meet your needs
6. Optimize with managed disks for better scalability, availability, performance.
7. Consider using Automatic VM Guest patching to keep your OS patched.
5. Performance efficiency
1. Reduce latency by deploying VMs closer together in proximity placement groups.
2. Use premium SSD to improve the performance of your virtual machines, especially for I/O-intensive workloads.
3. Utilize Premium SSD v2 effectively as it is a newer version of premium SSD that offers even better performance and scalability.
4. Optimize with managed disks to improve scalability, availability, and performance, and simplify disk management tasks such as backup and restore.
5. Consider locally attached NVMe or similar devices for high-performance use cases such as big data analytics, machine learning, and high-performance computing.
6. Enable Accelerated Networking to improve network performance and latency.
7. Right size your VMs by choosing the appropriate VM size based on your workload requirements and monitor resource utilization to ensure optimal performance and cost.
8. Autoscale your Flexible scale sets to automatically increase or decrease the number of VM instances that run your application based on demand or a set schedule.