Azure Security Fundamentals Part - 4: Storage Accounts, Firewalls, Logging, and Defender for Cloud
🛡️ Securing Azure Storage, Firewalls, Logging, and Defender for Cloud
With identities, VMs, databases, and apps hardened, this final post in our Azure Security series focuses on:
- Storage account protection
- Firewall configurations
- Cloud native logging
- Microsoft Defender for Cloud
📦 Storage Account Security
Azure Storage is one of the most widely used services and a common source of accidental data exposure. Securing it is non negotiable.
🔑 Choose Secure Authentication
You can access Azure Storage using
| Method | Description | Security Level |
|---|---|---|
| Public Access | Open to the world used for public static sites | ❌ Least secure |
| Storage Keys | Master key with full control | ⚠️ Risky |
| SAS Tokens | Time-bound, limited access URLs | 🟡 Moderate |
| Azure AD Identity | Role based, secure, auditable access | ✅ Recommended |
Use Azure AD and RBAC, combined with Managed Identity, wherever possible.
🔐 Encrypt Data
By default, Azure encrypts all data at rest using Microsoft managed keys. For more control, bring your own key (BYOK) via Key Vault.
🌐 Restrict Access
To protect against data exfiltration:
- Use Private Endpoints to limit traffic to internal networks
- If not possible, configure firewall rules for known IPs
- Avoid embedding SAS tokens in code store in Key Vault
☁️ Connecting from App Services and VMs
Same rules apply as with Azure SQL:
[App Service] ── VNet Integration ──► Private Endpoint ──► [Storage]
[VM] ───────────── VNet ───────────► Private Endpoint ──► [Storage]
✅ Use policies to block access using keys or public endpoints.
🔥 Azure Firewalls & Web Application Firewalls
🧱 Azure Firewall
- Protects non-web traffic
- Supports L3 L7 filtering
- Premium version includes IDPS (Intrusion Detection & Prevention)
| Feature | Basic | Premium |
|---|---|---|
| Layer 3-7 | ✅ | ✅ |
| TLS Inspection | ❌ | ✅ |
| Threat Intelligence | ✅ | ✅ |
Recommended for protecting internal service to service traffic.
🌐 Application Gateway + WAF
- Handles web traffic only
- Protects against OWASP Top 10 threats
- Offers SSL termination, routing, custom headers, and more
WAF runs in either
- Detection Mode (logs only)
- Prevention Mode (blocks malicious traffic)
🧠 Tip: WAF rules are based on the OWASP Core Rule Set and update automatically.
🧾 Logging with Log Analytics
Azure provides diagnostic logging for nearly all services, but logs must be explicitly enabled.
🧩 Logging Pipeline
- Enable logging per resource
- Stream logs to a Log Analytics Workspace
- Use Kusto Query Language (KQL) to query log
Logs may take ~2 minutes to stream after configuration.
🛡️ Microsoft Defender for Cloud
Microsoft Defender for Cloud is a centralized security console that
- Monitors all Azure resources
- Highlights misconfigurations and threats
- Offers one click remediation
- Integrates with Microsoft Sentinel, Microsoft Defender XDR, etc.
💰 Pricing
- Basic plan: Free
- Enhanced detection, analytics, and recommendations: Paid (per resource)
It's best practice to enable it for all subscriptions and check it weekly.
✅ Final Recap
| Area | Best Practice |
|---|---|
| Storage Accounts | Use Private Endpoints and Azure AD |
| Firewalls | Deploy both Azure Firewall and WAF |
| Logging | Send logs to Log Analytics and use KQL |
| Defender for Cloud | Enable across subscriptions and review alerts |