Edit

Get started with security architecture design

Security is one of the most important aspects of any architecture. Effective security measures protect the confidentiality, integrity, and availability of your data and systems from deliberate attacks and abuse.

Azure provides many security tools and capabilities, including the following key services:

  • Microsoft Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP). It assesses your resources for security compliance, provides a secure score to track your posture, and offers threat protection across Azure, on-premises, and multicloud workloads.

  • Microsoft Entra ID is the Microsoft cloud-based identity and access management (IAM) service. It provides single sign-on (SSO), multifactor authentication (MFA), and conditional access to guard against identity-based attacks.

  • Azure Front Door is a global entry point for web applications. It provides a built-in web application firewall (WAF) to protect against common exploits and vulnerabilities, DDoS protection, and Transport Layer Security (TLS) termination at the edge.

  • Azure Firewall is a cloud-native network firewall that supports threat intelligence-based filtering, intrusion detection and prevention (IDPS) in the Premium tier, TLS inspection, and fully qualified domain name (FQDN)-based rules.

  • Azure Key Vault provides centralized secrets management, key management, and certificate management. The Premium tier offers hardware security module (HSM)-protected keys validated to Federal Information Processing Standards (FIPS) 140-3 level 3.

  • Azure Private Link enables you to access Azure platform as a service (PaaS) solutions over a private endpoint in your virtual network. This approach keeps traffic on the Microsoft backbone network and eliminates exposure to the public internet.

  • Azure Application Gateway is a regional web traffic load balancer that includes a WAF that protects against the Open Worldwide Application Security Project (OWASP) Top 10 vulnerabilities, bot mitigation, and custom rules.

  • Azure Policy enables you to enforce organizational standards, assess compliance at scale, and apply guardrails that prevent noncompliant resource configurations.

For more information about Azure security tools and capabilities, see End-to-end security in Azure.

Architecture

Diagram that shows a baseline security implementation on Azure.

Download a Visio file of this architecture.

The previous diagram demonstrates a typical baseline security implementation. The architecture shows how Azure security services work together to protect workloads across identity, networking, data, and application layers. For real-world solutions that you can build in Azure, see Example solutions.

Learn about security on Azure

Microsoft Learn provides free online training for Azure security technologies. The platform offers videos, tutorials, and interactive labs for specific products and services, along with learning paths organized by job role.

The following resources provide foundational knowledge for security implementations on Azure.

Security fundamentals: The following learning paths cover core security concepts and Azure security features:

Network security: The following learning path covers virtual network security, network segmentation, and secure connectivity:

Data protection: The following learning path covers encryption, key management, and application security:

Threat protection: The following learning path covers threat detection, investigation, and response:

Learning paths by role

Microsoft Learn offers role-based certification paths for security professionals:

Organizational readiness

Organizations that start their cloud adoption can use the Cloud Adoption Framework for Azure to access proven guidance that accelerates cloud adoption. The Cloud Adoption Framework Secure methodology provides a structured approach for securing your Azure cloud estate. It provides security guidance across strategy, planning, readiness, adoption, governance, and operations.

Azure governance establishes the tooling needed to support cloud governance, compliance auditing, and automated guardrails. For more information, see Azure governance design area guidance.

To help ensure the quality of your security solution on Azure, follow the Azure Well-Architected Framework. The Well-Architected Framework provides prescriptive guidance for organizations that seek architectural excellence and describes how to design, provision, and monitor cost-optimized Azure solutions. For more information, see the Well-Architected Framework Security pillar.

For security-specific guidance, see the following Well-Architected Framework service guides:

Best practices

Follow these best practices to improve the security, reliability, performance, and operational quality of your security workloads on Azure:

Stay current with security

Azure security services evolve to address modern security challenges. Stay informed about the latest updates and features.

To stay current with key security services, see the following articles:

Other resources

The security category covers a range of solutions. The following resources can help you discover more about Azure.

Example solutions

The following architecture solutions demonstrate security patterns and implementations on Azure:

Product documentation

Hybrid and multicloud

Most organizations need a hybrid approach to security because their workloads, identities, and data span on-premises datacenters, Azure, and other cloud platforms. Security policies, threat detection, and compliance controls must extend across all these environments to avoid gaps that attackers can exploit. Organizations typically extend on-premises security solutions to the cloud and use Azure Arc to project non-Azure resources into the Azure control plane for centralized governance. To connect environments, organizations must choose a hybrid network architecture.

Review the following key hybrid and multicloud security scenarios:

  • Implement a secure hybrid network: A reference architecture that extends an on-premises network to Azure. It uses a perimeter network (also known as DMZ, demilitarized zone, and screened subnet) and Azure Firewall to control inbound and outbound traffic between on-premises and Azure environments.

  • Connect an on-premises network to Azure: A comparison of hybrid network connectivity options, including Azure VPN Gateway, Azure ExpressRoute, and Azure ExpressRoute with VPN failover, that establish the secure network foundation for hybrid deployments.

  • Hybrid architecture design: A hub page for hybrid architectures on Azure that covers hybrid network connectivity, best practices, and reference architectures to run workloads across on-premises and Azure environments.

  • Design a hybrid DNS solution by using Azure: A reference architecture that implements a hybrid Domain Name System (DNS) solution that resolves names for workloads hosted on-premises and in Azure. This architecture uses Azure DNS Private Resolver and Azure Firewall.

  • Implement hybrid and multicloud adoption by using Azure Arc and Azure landing zones: Guidance to onboard on-premises servers, Kubernetes clusters, and multicloud services into the Azure control plane by using Azure Arc. This architecture uses Microsoft Defender for Cloud to enable centralized policy enforcement, monitoring, and threat protection.

  • Integrate Azure and Microsoft Defender XDR security services: A solution idea that integrates Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft Defender XDR to unify security monitoring and threat response across on-premises and cloud environments.

Identity and access management

Identity is the primary security perimeter in cloud environments. In Azure, IAM centers on Microsoft Entra ID as the cloud-based identity provider. Microsoft Entra Conditional Access serves as the Zero Trust policy engine. The following architectures and guides address IAM design patterns for Azure and multicloud environments:

Threat protection

Threat protection encompasses the tools, patterns, and practices that detect, prevent, and respond to security threats across Azure workloads. Azure provides layered threat protection through services such as Microsoft Defender for Cloud, Microsoft Sentinel, and Microsoft Entra ID Protection. These services use behavioral analytics, machine learning, and threat intelligence to detect threats across compute, storage, networking, identity, and application layers.

The following architectures and guides address threat protection patterns on Azure:

  • Multilayered protection for Azure virtual machine (VM) access: A defense-in-depth solution that combines Microsoft Entra Privileged Identity Management (PIM), just-in-time (JIT) VM access in Microsoft Defender for Cloud, Azure Bastion, and Azure role-based access control (Azure RBAC) custom roles to minimize the attack surface for VM management.

  • Build the first layer of defense by using Azure security services: A solution idea that maps Azure security services to resources and threat types by using the MITRE ATT&CK framework. This article organizes Azure security services by network, infrastructure, application, data, and identity layers.

  • Map threats to your IT environment: Guidance that helps you diagram your IT environment and create a threat map by using the MITRE ATT&CK framework. It covers on-premises, Azure, and Microsoft 365 environments.

  • Integrate Azure and Microsoft Defender XDR security services: A solution idea that demonstrates how to integrate Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft Defender XDR for unified security monitoring and threat response across on-premises and cloud environments.

  • Microsoft Sentinel automated responses: A solution idea that uses Microsoft Sentinel playbooks and Azure Logic Apps to automate threat response, including blocking compromised users and isolating endpoints.

  • Apply Zero Trust principles to VMs in Azure: Step-by-step guidance to apply Zero Trust principles to Azure VMs, including logical isolation, RBAC, secure boot, encryption, secure access by using Azure Bastion, and advanced threat detection by using Microsoft Defender for Servers.

  • Azure threat protection: An overview of Azure threat protection services, including Microsoft Defender for Cloud, Microsoft Sentinel, Microsoft Entra ID Protection, Microsoft Defender for Cloud Apps, and Azure Firewall.

Amazon Web Services (AWS) or Google Cloud professionals

To help you get started quickly, the following articles compare Azure security options to other cloud services.

Service comparison

Migration guidance

If you're migrating from another cloud platform, see the following articles:

  • Last updated on