Azure Security Notes

Conditional Access Policies

  • Name: Provide a descriptive name for the policy.
  • Users and Groups: Specify the users and groups to which the policy applies.
  • Cloud Apps or Actions: Define the cloud apps or user actions that trigger the policy. Policies can apply to all or specific cloud apps.
  • Conditions: Set the conditions for the policy, including user risk, sign-in risk, device platforms, locations, client apps, and device state.
  • Access Controls: Select additional controls required for access, such as MFA, compliant device, Hybrid Azure AD-joined device, approved client app, app protection policy, or password change.
  • Session: Specify behavior of cloud applications, including Conditional Access App Control, Sign-In Frequency, and Persistent Browser Session.
  • Enable Policy: Options: Report Only (to test policy impact), On (enable), or Off (disable).

Implementing MFA

  • MFA requires more than one authentication method.
  • Common methods:
    • Code from authenticator app (Microsoft Authenticator, Google Authenticator, etc.).
    • Response to Microsoft Authenticator app (on-screen code verification).
    • Phone call with PIN entry.
    • SMS message with code.
  • Ensure users have access to MFA technology (e.g., Microsoft Authenticator app installed).
  • MFA is not enabled by default; it must be enabled on the Azure AD tenancy.

Steps to Enable MFA

  1. In Azure Active Directory admin center, navigate to Users > All Users.
  2. Click More > Multi-Factor Authentication.
  3. Select users and click Enable.
  4. Confirm by clicking Enable Multi-Factor Auth in the dialog box.
  5. Users will be prompted to enroll in MFA upon next sign-in.

User Enrollment

  • Users choose between:
    • Mobile phone number
    • Office phone number
    • Configuring a mobile app
  • Mobile app configuration involves scanning a QR code and approving a sign-in.
  • Users provide additional security information (phone number).

MFA Service Settings

  • App Passwords: Allow/disallow app passwords for non-browser apps.
  • Trusted IP Addresses: Configure trusted IP addresses where MFA is skipped (e.g., intranet).
  • Verification Options: Specify available verification methods (phone call, text message, app-based verification, hardware token).
  • Remember Multi-Factor Authentication: Allow users to remember MFA on trusted devices (default: 14 days).

Example configuration for trusted IPs: Enter IP address subnets, such as 192.168.1.0/27192.168.1.0/27

Administering MFA Users

  • Force users to update contact methods.
  • Revoke all app passwords.
  • Restore MFA on remembered devices.
Steps for User Management
  1. In the Azure AD admin center, select All Users and choose a user.
  2. Select Authentication Methods.
  3. Choose the action to perform.

Bulk Reset

  1. From All Users page, click Multi-Factor Authentication.
  2. Select users and click Manage User Settings.
  3. Select tasks (require contact methods, delete app passwords, restore MFA) and click Save.

Account Lockout

  • Configure conditions for MFA lockout.
  • Set the number of MFA denials to trigger lockout.
  • Specify the time to reset the lockout counter.
  • Set the duration until the account is unblocked.
  • Example: Setting 5 denials in 10 minutes triggers lockout; 5 denials over 30 minutes do not if the lockout counter resets after 10 minutes.

Block/Unblock Users

  • Block specific users from receiving MFA requests from on-premises MFA server.
  • Blocked users are automatically denied requests.
  • Users remain blocked for 90 days before removal from the list.
  • Click Unblock to unblock a user.

Fraud Alert Settings

  • Allow users to report fraudulent verification requests.
  • Enable automatic blocking of accounts for 90 days upon fraud reports.
  • This assumes password compromise.

OATH Tokens

  • Upload a CSV file with details and keys for OATH tokens.
  • CSV file format: UPN, serial number, secret key, time interval, manufacturer, model.
  • Each file is associated with a specific user.

Phone Call Settings

  • Configure the caller ID number (U.S. number) for MFA authentication calls.
  • Configure custom voice messages (WAV or MP3, < 5 MB, < 20 seconds).

MFA Utilization Reports

  • Blocked User History: History of block/unblock requests.
  • Usage and Fraud Alerts: Information on fraud alerts and overall MFA usage.
  • Usage For On-Premises Components: Utilization data for Network Policy Server extension, Active Directory Federation Services, on-premises MFA server.
  • Bypassed User History: Requests to bypass MFA.
  • Server Status: Status data of MFA servers.

Azure AD Identity Protection

  • Automates detection and remediation of identity-based risks.
  • Requires an Azure AD P2 license.

Risk Detections

  • Atypical travel: Unusual location shifts.
    Example: User signing in from Sydney and then Los Angeles in two hours.
  • Anonymous IP address: Sign-in from anonymizing VPNs or TOR nodes.
  • Unfamiliar sign-in properties: Deviations from usual sign-in patterns.
  • Malware-linked IP address: Sign-in from IP addresses known for malware.
  • Leaked credentials: Credentials found in data breaches (e.g., haveIbeenpwned.com).
  • Azure AD threat intelligence: Correlation with known attack patterns.

Risk Policies

  • Sign-in risk policy:
    • Analyzes sign-in signals.
    • Determines the likelihood of unauthorized sign-in.
    • Options: Block access or allow access with MFA.
  • User-risk policy:
    • Identifies deviations from normal user behavior.
      Example: Unusual location or time of sign-in.
    • Options: Block access, allow access, or allow access with password change.

Configuring Risk Policies

  1. In the Azure Active Directory admin center, select Security > Identity Protection.
  2. Select User Risk Policy or Sign-In Risk Policy.
  3. Configure settings.
    • Users: All user or specific users
    • Conditions: Risk level
    • Access: Block, Allow, or Allow And Require Multi-Factor Authentication.
    • Enforce policy: On or Off.

Application Access Management

  • Registering an application with Azure AD enables Azure AD features (user identity, permissions, etc.).

Creating App Registrations

  1. In the Azure portal, open the Azure Active Directory blade.
  2. In the Manage section, click App Registrations.
  3. Click New Registration.
  4. Choose which users can use the application or access the API:
  • Accounts In This Organizational Directory Only
  • Accounts In Any Organizational Directory
    • Accounts In Any Organizational Directory And Personal Microsoft Accounts
  1. Specify the Redirect URI (Optional):
  • Web: Base URL of the app.
  • Public Client (Mobile & Desktop): URI for token responses.
  1. Click Register.
  2. The app is assigned a unique application/client ID on the App Registrations page.

Managing Access to Apps

  • Free Azure AD edition: Assign access on a per-user basis.
  • Paid Azure AD edition: Perform group-based assignment.
  • Any form of Azure AD group can be used to assign access.
  • Nested group memberships not supported.
Assigning User Access:
  1. In Azure AD admin center, select Azure Active Directory > Enterprise Applications.
  2. Select the application.
  3. Click Users And Groups.
  4. Click Add User (for both users and groups).
  5. Search for the user or group.
  6. Select a user or group and then click Select.
  7. Click Assign.

Configure App Registration Permission Scopes

  • Configuring application registration permission scopes controls what information an application has access to.
    • OpenID: Use this scope if an application performs a sign-in using OpenID Connect. Grats a unique identifier.
    • Email: The email scope gives the app access to a user’s email address associated with a user account.
    • Profile: The profile scope can be used to provide the application with information about the user. (Given name, surname, preferred username, and object ID).
    • Offline_access: Provide an app access to resources on behalf of the user for an extended period.

Managing App Registration Permission Consent

  • Allows users and administrators to control how and what data can be accessed by applications.
    Effective permissions are the least-privileged set of permissions calculated when comparing the permissions that the application has been granted directly and the permissions of the signed-in user
Types of permission

*Delegated Permissions: Use by apps that are leveraged by a signed-in user. User or administrator consents to the permissions required.
*Application Permissions: Use by apps that execute without a signed-in user. Application permissions can only be consented to by an administrator.

Configuring Static Permissions

  1. On the App Registrations blade, select the registered application.
  2. Under Manage, click API Permissions.
  3. On the API Permissions blade, configure the desired permissions. Use this page to add permissions or to grant admin consent.

Manage API Access to Azure Subscriptions and Resources

  • API management policies control API behavior through statements applied to requests/responses.
  • Can be used for format conversion (XML to JSON) or call rate limiting.
  • Policies are XML documents divided into inbound, outbound, backend, and on-error sections.
  • Policy scopes are evaluated in order: Global, Product, API, Operation.
  • View policies by clicking Recalculate Effective Policy For Selected Scope.

Setting/Editing API Management Policy

  1. In the Azure portal, select the APIM instance, then the imported API.
  2. On the Design tab, select the operation to apply the policy to.
  3. Click the </> (code editor) icon in the Inbound Processing or Outbound Processing sections.
  4. Enter the policy code into the appropriate section.

Access Control (RBAC)

  • Access control is another term for assigning permissions to resources.
  • Easily done through assigning users to roles.
Configure Subscription and Resource Permissions
  • Azure Role Based Access Control (RBAC) allows you to configure fine grained access management to Azure resources.
  • Using RBAC, you can control what a security principal can do and where the security principal can do it.

Security principals are Azure objects that represent individuals, collections of individuals, applications, or services.

  • An RBAC role is a collection of permissions

  • The scope is the boundary to which the permissions defined in the role apply.
    *Configuring the scope for a role, the role assignment will occur at the management group, subscription, resource group, or individual Azure resrouce level.

Manage Admin Roles
  • Azure Active Directory includes many roles that provide a variety of permissions to different aspects of Azure AD and Microsoft 365 workloads. (Review Table 1-2 in the transcript for specific role descriptions)
Configure RBAC within Azure AD

RBAC(Role Based Access Control) allows you to configure fine- grained access control to Azure resources, such as virtual machines and storage accounts.

4 Fundamental Roles:
*Owner (Full Access)
*Contributor (Manage Resources)
*Reader (View Resources)
*User Access Administrator (Manage User Access)

Delegate Admin Rights

1.In the Azure AD admin center, select Roles And Administrators

  1. To see the membership information of a role, click the role you want.

Get-AzureADDirectoryRole View a list of Azure AD Directory roles
Get-AzureADDirectoryRoleMember View the users assigned membership in an Azure AD Directory role

Manage role allocations by using Azure AD

1.In the Azure AD admin center, select Roles And Administrators
2.Select the role to which you want to add a user. This will open the role’s properties

  1. On the Role Properties page, click Add Members.

Add-AzureADDirectoryRoleMember Adds a user to an Azure AD Directory Role.
Remove-AzureADDirectoryRoleMember Removes a user from an Azure AD Directory Role.

Configure resource group permissions

Any permission assigned at the resource group level will apply to all resources stored within that resource group. For example, the virtual machine administrator role, all those users will have that role for all virtual machines stored within the resource group.

To assign permissions at the resource group level, assign a specific role to a user, group, service principal, or managed identity.

  1. On the Resource Groups blade in the Azure portal, select the resource group for which you want to configure the permission
  2. On the Resource Groups blade, click Access Control (IAM)
  3. On the Access control (IAM) page, choose Add > Role Assignment.
  4. On the Add Role Assignment page, which is shown in Figure 1-82, select the role that you want to assign, specify which user, group, service principal, or system managed identity you want the role to apply to, and then specify the identity of that security principal.
Apply the principle of least privilege

When configuring Azure RBAC, make sure that you follow the principal of least privilege. This means that you should only grant the access required to perform specific tasks.

Configure custom RBAC roles

If one of the many existing RBAC roles doesn’t meet your organization’s requirements, you can create a custom RBAC role.

  1. Determine which method you will use to create the custom role. Determine what permissions the role requires. You can learn what operations are available to define your permission by viewing the Azure Resource Manager resource provider operations. For management operations, these will be Actions or NotActions. For data operations, these will be DataActions or NotDataActions.

  2. Create the role. You can do this by cloning an existing role and then making modifications or by creating a new role from scratch. The most straightforward method of doing this is through the Azure portal.

  3. Test the custom role. Make sure that you test the role thoroughly to determine that it only allows what you want it to allow and doesn’t have some unexpected permissions, such as allowing Wally the VM operator to type something in Cloud Shell that locks out every other user in the Azure AD tenancy.
    To clone and then modify a role in the Azure portal, perform the following steps:

  4. In the Azure portal, open the Access Control (IAM) blade at the subscription level or resource group level where you want the custom role to be assignable.

  5. Select the Roles tab to see the list of all available built-in and custom roles.

  6. Select the role that you want to clone and then modify. Figure 1-83 shows the Virtual Machine Contributor role being selected for cloning.

  7. On the Basics tab of the Create A Custom Role page shown in Figure 1-84, provide a Custom Role Name.

  8. On the Permissions tab shown in Figure 1-85, you can delete existing permissions or add new permissions.

  9. On the Assignable Scopes tab, you can specify where the role can be assigned. You can select subscriptions associated with the Azure AD tenancy, as well as resource groups that are contained within those subscriptions.

  10. On the JSON tab, you can view the custom role formatted in JSON. This tab gives you the opportunity to edit the role in JSON. If you want to add a wildcard permission, you do so on this tab because this is not possible at other points during the creation of a custom role.

  11. Once you have reviewed the JSON code, click Review And Create to create the custom role.

Interpret permissions

There are permissions related to management operations and permissions related to data operations.

Check access

To view the access that a user has to a specific resource, perform the following steps:

  1. In the Azure portal, select the specific resource for which you want to check access.
  2. Select Access control (IAM) to open the Access Control (IAM) blade.
  3. Click the Check Access tab.
  4. In the Check Access section, use the Find drop-down menu to select the Azure AD user, group, or service principal option and type the name of the user whose access you want to check, as shown in Figure 1-86. Select the user.
  5. On the Assignments tab shown in Figure 1-87, review the user’s role assignments and deny assignments to the resource.

Azure Network Components Overview

  • Provide connectivity between Azure resources.
  • Provide on-premises networks connectivity to Azure resources, and branch office connectivity in Azure.
  • Azure VNet is scoped to a single region.

Subnets

  • Segment the virtual network into one or more subnetworks and allocate a portion of the virtual network’s address space to each subnet.
NSG
  • Each one of these subnets has a network security group (NSG) bound to it.
  • Each is identified with a number between 100 and 4096, where the lowest number are processed first.
  • The connectivity provider use redundant devices to ensure that your connections are handed off to Microsoft in a redundant manner.

Azure Bastion

  • Provide secure and seamless RDP/SSH connectivity to its virtual machines directly from the Azure portal over TLS.
  • Is a platform-managed PaaS service that can be provisioned in a VNet.
VPN Gateway
  • When planning your VNets, consider that each VNet may only have one virtual network gateway of each type, and the gateway type may only be VPN or ExpressRoute.
    *Use VPN when you need to send encrypted traffic across the public Internet to your on-premises resources.

ExpressRoute

  • Allows extends its on-premises networks into the Microsoft cloud (Azure or Office 365) over a private connection because ExpressRoute does not go over the public Internet.
Create a Virtual Network using the Azure portal:
  1. On the Basics tab, select the Subscription for the VNet and the Resource Group.
  2. In the Name field, type a comprehensive name for the VNet, and in the Region field, select the Azure region in which the VNet is going to reside. Finally, click the IP Addresses tab.
  3. On the IP Addresses page, in the IPv4 field, type the address space in classless inter-domain routing (CIRD) format; for example, you could enter 10.3.0.0/16.
  4. Click the Add Subnet button. The Add Subnet blade appears, as shown in Figure 2-4.
  5. In the Subnet Name field, type a name for this subnet.
  6. In the Subnet Address Range, type the IP range for this subnet in CIDR format, such as 10.3.0.0/16. Keep in mind that the smallest supported IPv4 subnet is /29, and the largest is /8.
  7. Click the Add button; the subnet that you just created appears under the Subnet Name section.
  8. Leave the default selections for now and click the Review + Create button. The validation result appears, which is similar to the one shown in Figure 2-5.
  9. Click the Create button.
  10. The Overview page appears with the deployment final status. On this page, click the Go To Resource button and review these options on the left navigation pane: Overview, Address Space, and Subnets. Notice that the parameters you configured during the creation of your VNet will be distributed among the different options on the VNet page.
Azure Routing table:

It contains an address prefix and the next hop.

  • Source default
  • Address prefix unique to the virtual network
  • Next hop type virtual network
Virtual Network Peering:
  1. Navigate to the Azure portal at https://portal.azure.com.
  2. In the search bar type virtual networks traffic and under Services, click Virtual Networks.
  3. Click the VNet that you want to peer, and on the left navigation pane, click Peerings (see Figure 2-6).
  4. Click the Add button, and the Add Peering page appears, as shown in Figure 2-7.
  5. In the Name field, type a name for this peering.
  6. In the Subscription field, select the subscription that has the VNet to which you want to connect.
  7. In the Virtual Network field, click the drop-down menu and select the VNet that you want to peer.
  8. In the Name Of The Peering From Remote Virtual Network field, type the name that you want this peering connection to appear on the other VNet.
  9. The next two options—Allow Virtual Network Access From [VNet name] To Remote Virtual Network and Allow Virtual Network Access From Remote Virtual To [VNet name]—are used to control the communication between those VNets. If you want full connectivity from both directions, make sure to leave the Enabled option selected (default selection) for both. Enabling communication between virtual networks allows resources connected to either virtual network to communicate with each other with the same bandwidth and latency as if they were connected to the same virtual network.
  10. The next two options—Allow Forwarded Traffic From Remote Virtual Network To [VNet name] and Allow Forwarded Traffic From [VNet name] To Remote Virtual Network—are related to allowing forwarded traffic. You should select Enable for both settings only when you need allow traffic that didn’t originate from the VNet
NAT Gateway

Enables outbound-only Internet connectivity for virtual networks. A common scenario is when you want that outbound connectivity to use a specified static public IP address (static NAT) or you want to use a pool of public IP addresses (Dynamic NAT).

  • A NAT gateway is billed with two separate meters; resource hours and data processed.
Virtual Private Networks(VPNs)
  • Azure natively offers a service called VPN gateway, which is a specific type of virtual network gateway that is used to send encrypted traffic between an Azure virtual network and on-premises resources.
  • Each virtual network can only have one VPN gateway.
  • It is able to create multiple connections to the same VPN gateway.

The available options are:
Site-to-Site (S2S) VPN:

  • This type of VPN is used in scenarios where you need to connect on-premises resources to Azure. The encrypted connection tunnel uses IPsec/IKE (IKEv1 or IKEv2).
    Point-to-Site (P2S) VPN:
  • This type of VPN is used in scenarios where you need to connect to your Azure VNet from a remote location.