want to block malicious IPs in azure

Question

Hi ,

Want to block malicious IPs in azure using any automation solutions.. Please advise best ..

Answer 1

Hi,
Your question is very general so I will answer in general. There isn't a best solution. It is more of a what you are comfortable with in terms of knowledge and skills. Overall you have 3 main services you can use:

• Azure Automation account - suitable for more operations oriented engineers. As languages you can use PowerShell and Python.
• Azure Logic App - suitable for engineers that do not code much. This is a low code service. You have a pre-defined variety of actions you can use + some general actions in case you cannot find suitable in the specific ones.
• Azure Functions - suitable for more development oriented engineers. Supports vast number of languages including PowerShell, Python, c#, etc.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

A few more resource specific thoughts that would involve IPs:
VM: Access Control Lists (IP and port specific allow/block rules)
Web application: WAF
API: Defender for API

Answer 3

Hi @AVR ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are looking for best practises to block malicious IP in Azure.

Azure comprises of different range of IaaS and PaaS services, and it will be difficult to point at a single solution that could provide network security for every product.
Wrt Automation, the exact solution would depend on the PaaS service/IaaS service at hand
However, I shall share the most commonly used solutions.

Exclusively for Public IPs, we have DDoS IP Protection

Most of the PaaS services come with their own network security configuration/settings.
For e.g. Configure Azure Storage firewalls and virtual networks

Along with this, you can also consider

• Private EndPoints
• Service EndPoints

Notable Network Security features for other products include,

• Web Application Firewall for AFD and App gateway
• Azure Firewall for Traffic Routing and Inspection across Private Networks
• The above as IDPS feature
• Azure Secured Hub for vWAN scenarios
• DDoS Network Protection
• NSGs for IaaS VMs and subnets

Other documents that may come handy are as follows,

• Azure Security
• Azure network security overview
• Microsoft Defender for Cloud JIT
• Azure Bastion for fully managed RDP/SSH
• Azure security best practices and patterns

I hope this helps.

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.