How to Secure an Azure Environment: 12 Controls With the Settings
Securing Azure is twelve decisions, not a product list. Microsoft now enforces MFA on every Azure sign-in and on every create, update or delete through CLI, PowerShell and the API; the rest is yours: who holds Owner and for how long, which policies deny a public IP, where management traffic enters, where the logs go and whether a backup can be deleted. This guide names the twelve controls, the setting behind each, the license it needs at October 2026 list prices, and a four-week order of work for a 10- to 500-person organization.
The short answer: the twelve controls
| # | Control | The setting | Needs |
|---|---|---|---|
| 1 | MFA for every Azure user | Conditional Access "Require MFA for Azure management"; Microsoft enforces it anyway since October 2024 (portal) and 1 October 2025 (CLI, PowerShell, API) | Entra ID P1 ($7.00; in Business Premium, E3, E5) |
| 2 | Phishing-resistant MFA for admins | Conditional Access on directory roles with the "Phishing-resistant MFA" authentication strength | Entra ID P1, FIDO2 keys or Windows Hello |
| 3 | Two emergency access accounts | Cloud-only, passkeys, excluded from Conditional Access, alert on sign-in, tested quarterly | Included |
| 4 | No standing Owner or Contributor | PIM eligible assignments, MFA on activation, four- to eight-hour maximum | Entra ID P2 ($10.00, or $3.00 as the E3 add-on) |
| 5 | Automation on workload identities | Managed identities or service principals; no user accounts in scripts | Included |
| 6 | Management groups and Azure Policy | Deny effects for allowed regions, public IPs on NICs and missing diagnostic settings | Included |
| 7 | No public RDP or SSH | NSG deny rules; Azure Bastion for admin sessions | Bastion metered; Developer SKU is Microsoft's free tier for dev/test |
| 8 | Private endpoints for PaaS | Private Link for Storage, SQL, Key Vault; public network access disabled | Metered |
| 9 | A firewall sized to the traffic | Azure Firewall Basic up to 250 Mbps, Standard up to 30 Gbps | Metered |
| 10 | Posture and server protection | Defender for Cloud on every subscription; Defender for Servers on exposed and domain-controller VMs | Metered per server |
| 11 | Logs in one workspace | Activity log and resource diagnostics to a Log Analytics workspace; Sentinel only if someone works incidents | Metered per GB |
| 12 | Backups that cannot be deleted | Azure Backup with soft delete and a locked immutable vault | Metered |
Prices are Microsoft list price, October 2026 price list, per user per month on an annual term; metered items are Azure consumption on your own bill. If you do only three things this month, do 1, 4 and 12.
Identity: MFA is mandatory, so decide the method
Microsoft's rollout of mandatory MFA is complete for planning purposes (Microsoft Learn, April 2026). Phase 1, from October 2024, covers sign-in to the Azure portal, the Microsoft Entra admin center and the Intune admin center, and from February 2025 the Microsoft 365 admin center. Phase 2, from 1 October 2025, covers any create, update or delete through Azure CLI, Azure PowerShell, infrastructure-as-code tools, the REST control plane and the SDKs; reads are exempt. Tenants could postpone Phase 2 until 1 July 2026; that option has expired.
Two consequences: scripts that sign in as a user account now fail on writes, so move every scheduled job to a managed identity or service principal, which the enforcement does not touch; and emergency access accounts must complete MFA too, with a passkey (FIDO2) or certificate.
Enforcement is the minimum; the method is your decision: Microsoft Authenticator with number matching for everyone, and the phishing-resistant authentication strength required through Conditional Access for the admin roles Microsoft lists. Conditional Access needs Entra ID P1; without it you get security defaults, which cannot be tuned. Microsoft-managed Conditional Access policies arrive in report-only mode and are switched on by Microsoft no less than 30 days later unless you act (Microsoft Learn, May 2026).
Privileged access: PIM, break-glass and no standing Owner
Azure role-based access control decides who can change what; Privileged Identity Management decides for how long. PIM needs Entra ID P2 or Entra ID Governance (Microsoft Learn, July 2026), licensed for the people who use it: a 120-person tenant with four administrators buys four P2 licenses at $10.00 per user per month, or $3.00 each as the add-on to Microsoft 365 E3.
The configuration that holds up in an audit: subscription Owner and User Access Administrator exist only as PIM-eligible assignments, activated with MFA, a justification and, for Owner, approval, for four to eight hours at most; day-to-day administrators hold Reader permanently and activate Contributor on a resource group; two or more emergency access accounts, cloud-only, with passkeys registered and Global Administrator assigned as permanent active in PIM, excluded from Conditional Access policies that block sign-in, credentials in a safe, an alert on every sign-in and a test each quarter (Microsoft Learn, June 2026); separate accounts for administration and daily work.
The Microsoft Entra PIM and Privileged Access Hardening service ($3,950 per project) implements this list; our P1 vs P2 guide covers the licensing.
Governance: management groups and Azure Policy with deny effects
A policy or role assigned at a management group is inherited by every subscription beneath it, and a subscription owner cannot remove it (Microsoft Learn, July 2024). One group for production and one for everything else is enough. Azure Policy evaluates resources on create, on update, on assignment and every 24 hours; Audit records, Deny blocks, DeployIfNotExists fixes (Microsoft Learn, March 2025). Six assignments pay for themselves:
| Policy | Effect |
|---|---|
| Allowed locations | Deny |
| Network interfaces should not have public IPs | Deny, exempting the one ingress resource group |
| Virtual networks should have DDoS Network Protection (our DDoS guide) | Audit, then DeployIfNotExists if you buy the plan |
| Resources should send diagnostic logs to the workspace | DeployIfNotExists |
| Require a cost-center and owner tag | Deny |
| MFA self-enforcement for resource operations | Audit for two weeks, then Deny |
Run every new policy in Audit first and read the compliance report before switching to Deny. The Azure Policy as Code and Cloud Governance Guardrails service ($3,950 per project) builds the hierarchy and assignments as code so they survive staff changes.
Network: no public management ports, private endpoints, the right firewall
Network security groups. Default-deny inbound on every subnet, allow only application ports from the load balancer or gateway, and delete every rule that opens 3389 or 22 to the internet.
Azure Bastion instead of public RDP and SSH. Bastion brokers the session over port 443, so the virtual machine never needs a public IP. Microsoft's SKU table (Microsoft Learn, November 2025): Developer has no hourly charge, is Microsoft's free tier for dev/test, and allows one VM at a time with no peering; Basic is metered, dedicated, and fixed at two instances for 40 RDP or 80 SSH sessions; Standard adds the native client, custom ports, file transfer and scaling to 50 instances; Premium adds session recording and private-only deployment. Basic in production and Developer in test covers most organizations of this size.
Private Link. A private endpoint maps one storage account, SQL database or key vault into your virtual network over the Microsoft backbone; you then disable public network access on the resource (Microsoft Learn, July 2026).
Azure Firewall. Choose by throughput and inspection need (Microsoft Learn, July 2026): Basic up to 250 Mbps with threat-intelligence alerts only; Standard up to 30 Gbps with threat-intelligence filtering, DNS proxy and web categories; Premium with TLS inspection, IDPS and URL filtering. Each SKU carries a per-hour deployment charge and a per-gigabyte processing charge. A single-region environment with a dozen VMs is usually Basic, or an NSG-only design with Bastion; buy Premium only when someone can name the regulation that requires TLS inspection.
Posture, threat detection and where the logs go
Turn on Microsoft Defender for Cloud on every subscription and treat the secure score as the backlog it is. The paid plans (Defender CSPM, Defender for Servers Plan 1 and Plan 2, and the plans for Storage, SQL, Key Vault and Containers) are metered on your Azure bill at the rates on the Azure pricing page; enable Defender for Servers first on internet-facing VMs and domain controllers. Defender for Cloud vs Defender for Endpoint explains the overlap; the license alternative, Microsoft Defender for Endpoint Server, is $5.20 per server per month on the October 2026 price list.
Logging is a policy decision, not a per-resource chore: send the subscription Activity log to one Log Analytics workspace, let the DeployIfNotExists policy above route every resource's diagnostics there, and set retention per table. Microsoft Sentinel belongs above that workspace only when someone will close incidents every day; our Sentinel cost guide has the ingestion math and the managed alternative.
Data and backup: Key Vault, soft delete and an immutable vault
Secrets, certificates and keys go in Azure Key Vault with Azure RBAC, diagnostic logging and a private endpoint; applications reach it through managed identities, never through a connection string in a config file. Azure encrypts storage and disks at rest by default; customer-managed keys are worth the operational work only when a contract or regulator names the requirement.
The control that decides whether a ransomware incident is a bad week or the end of the company is the backup vault. Soft delete keeps deleted VM backups recoverable for 14 days (Microsoft Learn, September 2025), and enhanced soft delete lets you lengthen and enforce the period. The immutable vault setting blocks every operation that could remove a recovery point; once "enabled and locked" it is irreversible and backups move to write-once storage, with immutability tied to the policy retention or to a fixed period such as 30 days (Microsoft Learn, September 2026). Lock it after a restore test has passed and add multi-user authorization with a Resource Guard. The Azure Backup Immutable Vault and Ransomware Hardening service ($2,950 per project) configures all of it; our disaster recovery guide covers the recovery side.
Four weeks, in order
- Week 1, identity. Confirm both MFA phases show as enforced in the Azure portal. Create the two emergency accounts with passkeys and test them. Put the phishing-resistant admin policy in report-only, then on. Move standing Owner assignments to PIM. Replace every user account in a script with a managed identity.
- Week 2, governance and logging. Create the management groups, assign the six policies in Audit, create the workspace and the diagnostics policy, and read the first compliance report.
- Week 3, network. Delete inbound 3389 and 22 rules, deploy Bastion, add private endpoints to storage, SQL and Key Vault and disable their public access, then switch the public-IP and location policies to Deny.
- Week 4, posture and backup. Enable Defender for Cloud and Defender for Servers on the exposed machines, enable soft delete and immutability on the vault, run a restore, then lock the vault.
The added spend is P2 for the administrators plus Bastion, private endpoints, Defender for Servers and the workspace, all metered on the Azure bill.
Frequently asked questions
Is MFA mandatory for Azure now?
Yes. Microsoft has required MFA for the Azure portal since October 2024, for the Microsoft 365 admin center since February 2025, and for create, update and delete operations through Azure CLI, PowerShell, the REST API and the SDKs since 1 October 2025. The Phase 2 postponement option ended on 1 July 2026. Managed identities and service principals are exempt.
Do I need Microsoft Entra ID P2 to secure Azure?
Only for Privileged Identity Management and risk-based Conditional Access, for the people in scope. P2 is $10.00 per user per month on an annual term, or $3.00 as the add-on to Microsoft 365 E3, on the October 2026 price list. Conditional Access itself needs P1, which Business Premium, E3 and E5 include.
What is the cheapest way to stop RDP exposure in Azure?
Delete the inbound 3389 and 22 rules in the network security group and deploy Azure Bastion. The Developer SKU is Microsoft's free tier for dev and test with one connection at a time; Basic is the production choice and is metered by the hour.
Does Defender for Cloud replace Defender for Endpoint on servers?
No. Defender for Cloud manages cloud posture and workload risk; Defender for Servers adds runtime protection for the VM, metered per server, or a per-server license such as Microsoft Defender for Endpoint Server at $5.20 per server per month covers it.
How do I protect Azure backups from ransomware?
Enable soft delete and the immutable vault setting on the vault, test a restore, then lock immutability so it cannot be disabled; add multi-user authorization with a Resource Guard so vault changes need a second administrator.
Sources
- Mandatory multifactor authentication for Azure and admin portals — Microsoft Learn, ms.date 04/03/2026, checked 2026-10-11
- Microsoft-managed Conditional Access policies — Microsoft Learn, ms.date 05/28/2026, checked 2026-10-11
- Require phishing-resistant multifactor authentication for administrators — Microsoft Learn, ms.date 03/24/2026, checked 2026-10-11
- Manage emergency access accounts in Microsoft Entra ID — Microsoft Learn, ms.date 06/04/2026, checked 2026-10-11
- Microsoft Entra ID Governance licensing fundamentals — Microsoft Learn, ms.date 07/29/2026, checked 2026-10-11 (PIM requires P2 or Entra ID Governance)
- What is Azure Policy? and What are Azure management groups? — Microsoft Learn, ms.date 03/04/2025 and 07/18/2024, checked 2026-10-11
- Choose the right Azure Bastion SKU — Microsoft Learn, ms.date 11/24/2025, checked 2026-10-11
- Choose the right Azure Firewall SKU — Microsoft Learn, ms.date 07/17/2026, checked 2026-10-11
- What is Azure Private Link? — Microsoft Learn, ms.date 07/08/2026, checked 2026-10-11
- Soft delete for virtual machines in Azure Backup and Immutable vault for Azure Backup — Microsoft Learn, ms.date 09/24/2025 and 09/09/2026, checked 2026-10-11
- Microsoft Defender for Cloud pricing — Microsoft; plan names confirmed through search excerpts on 2026-10-11, page not opened
- Microsoft commercial price list, October 2026: Microsoft Entra ID P1 and P2, Entra P2 add-on for Microsoft 365 E3, Microsoft Defender for Endpoint Server, Microsoft Defender for Business servers
Key takeaways
- Microsoft enforces MFA for the Azure portal since October 2024 and for create, update and delete through CLI, PowerShell and the API since 1 October 2025; the postponement window closed on 1 July 2026, and scripts on user accounts now fail.
- Conditional Access needs Entra ID P1 ($7.00, included in Business Premium, E3 and E5); PIM needs P2 ($10.00, or $3.00 as the E3 add-on) only for the administrators who use it.
- Two cloud-only emergency access accounts with passkeys, excluded from Conditional Access and tested quarterly, are Microsoft's stated requirement, not an option.
- Management groups plus six Azure Policy assignments in Deny or DeployIfNotExists remove the dependence on every subscription being configured by hand.
- Bastion Basic, private endpoints and default-deny NSGs close most network exposure; Azure Firewall Basic covers up to 250 Mbps and Premium is for TLS inspection a regulation requires.
- Soft delete plus an immutable vault that you lock after a successful restore test is the backup control that decides the outcome of a ransomware incident.
- The four-week order is identity, governance and logging, network, then posture and backup, and it needs no license a Business Premium, E3 or E5 tenant lacks beyond P2 for the admins.
If you want the twelve controls assessed against your subscriptions and the gaps closed in order, the Azure Well-Architected Review with Remediation Sprint is $4,950 per project, quoted in writing before work begins; the Azure Policy as Code and Cloud Governance Guardrails ($3,950 per project) and Microsoft Entra PIM and Privileged Access Hardening ($3,950 per project) services take weeks 1 and 2 on their own, and hourly work is available through Securing your Azure Environment and Applications at $175 per hour. Entra licenses are at Microsoft's list price and Azure consumption stays on your own bill. Book a 30-minute call with your subscription count and admin list.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.