Azure security baseline for Azure Machine Learning

This security baseline applies guidance from the Azure Security Benchmark version 2.0 to Microsoft Azure Machine Learning. The Azure Security Benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Azure Security Benchmark and the related guidance applicable to Azure Machine Learning.

You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions will be listed in the Regulatory Compliance section of the Microsoft Defender for Cloud dashboard.

When a section has relevant Azure Policy Definitions, they are listed in this baseline to help you measure compliance to the Azure Security Benchmark controls and recommendations. Some recommendations may require a paid Microsoft Defender plan to enable certain security scenarios.

Note

Controls not applicable to Azure Machine Learning, and those for which the global guidance is recommended verbatim, have been excluded. To see how Azure Machine Learning completely maps to the Azure Security Benchmark, see the full Azure Machine Learning security baseline mapping file.

Network Security

For more information, see the Azure Security Benchmark: Network Security.

NS-1: Implement security for internal traffic

Guidance: When you deploy Azure Machine Learning resources, create or use an existing virtual network. Ensure that all Azure virtual networks follow an enterprise segmentation principle that aligns to the business risks. Isolate any system that could incur higher risk for the organization within its own virtual network. Secure the system sufficiently with either a network security group (NSG) or Azure Firewall.

• How to create a network security group with security rules

• How to deploy and configure Azure Firewall

Responsibility: Customer

NS-2: Connect private networks together

Guidance: Use Azure ExpressRoute or Azure virtual private network (VPN) to create private connections between Azure datacenters and on-premises infrastructure in a colocation environment.

ExpressRoute connections don't go over the public internet, and offer more reliability, faster speeds, and lower latencies than typical internet connections. For point-to-site and site-to-site VPN, you can connect on-premises devices or networks to a virtual network. Use any combination of these VPN options and Azure ExpressRoute.

To connect two or more Azure virtual networks, use virtual network peering. Traffic between peered virtual networks is private and remains on the Azure backbone network.

• What are the ExpressRoute connectivity models

• Azure VPN overview

• Virtual network peering

Responsibility: Customer

Microsoft Defender for Cloud monitoring: The Azure Security Benchmark is the default policy initiative for Microsoft Defender for Cloud and is the foundation for Microsoft Defender for Cloud's recommendations. The Azure Policy definitions related to this control are enabled automatically by Microsoft Defender for Cloud. Alerts related to this control may require an Microsoft Defender plan for the related services.

Azure Policy built-in definitions - Microsoft.MachineLearningServices:

Name (Azure portal)	Description	Effect(s)	Version (GitHub)
Azure Machine Learning workspaces should use private link	Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to Azure Machine Learning workspaces, data leakage risks are reduced. Learn more about private links at: https://docs.microsoft.com/azure/machine-learning/how-to-configure-private-link.	Audit, Deny, Disabled	1.1.0

NS-3: Establish private network access to Azure services

Guidance: Use Azure Private Link to enable private access to Azure Machine Learning from virtual networks without crossing the internet. Private access adds a defense-in-depth measure to Azure authentication and traffic security.

Azure Machine Learning doesn't provide a service endpoint.

• Understand Azure Private Link

• Configure a private endpoint for an Azure Machine Learning workspace

Responsibility: Customer

Microsoft Defender for Cloud monitoring: The Azure Security Benchmark is the default policy initiative for Microsoft Defender for Cloud and is the foundation for Microsoft Defender for Cloud's recommendations. The Azure Policy definitions related to this control are enabled automatically by Microsoft Defender for Cloud. Alerts related to this control may require an Microsoft Defender plan for the related services.

Azure Policy built-in definitions - Microsoft.MachineLearningServices:

Name (Azure portal)	Description	Effect(s)	Version (GitHub)
Azure Machine Learning workspaces should use private link	Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to Azure Machine Learning workspaces, data leakage risks are reduced. Learn more about private links at: https://docs.microsoft.com/azure/machine-learning/how-to-configure-private-link.	Audit, Deny, Disabled	1.1.0

NS-4: Protect applications and services from external network attacks

Guidance: Protect Azure Machine Learning resources against attacks from external networks. Attacks can include:

• Distributed denial of service (DDoS) attacks
• Application-specific attacks
• Unsolicited and potentially malicious internet traffic

Use Azure Firewall to protect applications and services against potentially malicious traffic from the internet and other external locations. Protect assets against DDoS attacks by enabling DDoS Protection Standard on Azure virtual networks. Use Microsoft Defender for Cloud to detect misconfiguration risks in network-related resources.

Use Web Application Firewall (WAF) capabilities in Azure Application Gateway, Azure Front Door, and Azure Content Delivery Network (CDN). These capabilities protect your applications that run on Azure Machine Learning from application-layer attacks.

• Azure Firewall Documentation

• Manage Azure DDoS Protection Standard using the Azure portal

• Microsoft Defender for Cloud recommendations

• Use workspace behind a Firewall for Azure Machine Learning

• How to deploy Azure WAF

Responsibility: Customer

NS-6: Simplify network security rules

Guidance: Use Azure Virtual Network service tags to define network access controls for Azure Machine Learning resources in network security groups or Azure Firewall. You can use service tags in place of specific IP addresses when creating security rules. Specify a service tag name like "azuremachinelearning" in the appropriate rule source or destination field to allow or deny traffic for the service. Microsoft manages the address prefixes the service tag encompasses, and automatically updates the service tag as addresses change.

Note: The regional tag "azuremachinelearning" isn't currently supported.

• Understand and use service tags

Responsibility: Customer

NS-7: Secure Domain Name Service (DNS)

Guidance: Follow best practices for DNS configurations for Azure Machine Learning. For more information, see How to use your workspace with a custom DNS server.

Follow the best practices for DNS security to mitigate against common attacks like:

• Dangling DNS
• DNS amplification attacks
• DNS poisoning and spoofing

When you use Azure DNS as your DNS service, make sure to protect DNS zones and records from accidental or malicious changes by using Azure Role-Based Access Control (RBAC) and resource locks.

• Azure DNS overview

• Secure Domain Name System (DNS) Deployment Guide

• Prevent dangling DNS entries and avoid subdomain takeover

Responsibility: Customer

Identity Management

For more information, see the Azure Security Benchmark: Identity Management.

IM-1: Standardize Azure Active Directory as the central identity and authentication system

Guidance: Azure Machine Learning uses Azure AD as its default identity and access management service. Standardize Azure AD to govern your organization's identity and access management in:

• Microsoft Cloud resources. Resources include:

  • The Azure portal

  • Azure Storage

  • Azure Linux and Windows virtual machines

  • Azure Key Vault

  • Platform-as-a-service (PaaS)

  • Software-as-a-service (SaaS) applications

• Your organization's resources, such as applications on Azure or your corporate network resources.

Securing Azure AD should be a high priority for your organization's cloud security practice. Azure AD provides an identity secure score to help you compare your identity security posture to Microsoft's best practice recommendations. Use the score to gauge how closely your configuration matches best practice recommendations, and to make improvements in your security posture.

Note: Azure AD supports external identities that allow users without Microsoft accounts to sign in to their applications and resources.

• Tenancy in Azure Active Directory

• How to create and configure an Azure AD instance

• Use external identity providers for application

• What is the identity secure score in Azure Active Directory

• Azure Machine Learning built-in role details

Responsibility: Customer

IM-2: Manage application identities securely and automatically

Guidance: For Azure Machine Learning, use Azure AD to create a service principal with restricted permissions at the resource level. Configure service principals with certificate credentials, and fall back to client secrets.

You can use Azure Key Vault with Azure-managed identities, so a runtime environment like Azure Functions can get credentials from the key vault.

• Azure service principal

• Create a service principal with certificates

• Use Azure Key Vault for security principal registration

Responsibility: Customer

IM-3: Use Azure AD single sign-on (SSO) for application access

Guidance: Azure Machine Learning uses Azure AD identity and access management for Azure resources, cloud applications, and on-premises applications. Identities include enterprise identities like employees, and external identities like partners, vendors, and suppliers.

Azure AD provides single sign-on (SSO) to manage and secure access to your organization's on-premises and cloud data and resources.

Connect all your users, applications, and devices to Azure AD. Azure AD offers seamless, secure access, and greater visibility and control.

• Understand application SSO with Azure AD

Responsibility: Customer

IM-7: Eliminate unintended credential exposure

Guidance: Azure Machine Learning lets customers deploy and run code or configurations or persist data that potentially contains identities or secrets. Use Credential Scanner to discover these credentials in code, configurations, or data. Credential Scanner encourages moving discovered credentials to secure locations like Azure Key Vault.

For GitHub, you can use the native secret scanning feature to identify credentials or other secrets in code.

• How to set up Credential Scanner

• GitHub secret scanning

Responsibility: Customer

Privileged Access

For more information, see the Azure Security Benchmark: Privileged Access.

PA-1: Protect and limit highly privileged users

Guidance: The most critical built-in Azure AD roles are the Global Administrator and the Privileged Role Administrator. Users with these two roles can delegate administrator roles.

• The Global Administrator or Company Administrator has access to all Azure AD administrative features, and services that use Azure AD identities.

• The Privileged Role Administrator can manage role assignments in Azure AD and Azure AD Privileged Identity Management (PIM). This role can manage all aspects of PIM and administrative units.

Limit the number of highly privileged accounts or roles, and protect these accounts at an elevated level. Highly privileged users can directly or indirectly read and modify all your Azure resources.

You can enable just-in-time (JIT) privileged access to Azure resources and Azure AD using Azure AD PIM. JIT grants temporary permissions to perform privileged tasks only when users need it. PIM can also generate security alerts for suspicious or unsafe activity in your Azure AD organization.

Azure Machine Learning comes with three default roles when a new workspace is created. Create standard operating procedures for using owner accounts.

• Learn more about Azure Machine Learning default roles

Responsibility: Customer

PA-3: Review and reconcile user access regularly

Guidance: Azure Machine Learning uses Azure AD accounts to manage its resources. Review user accounts and access assignments regularly to ensure the accounts and their access are valid. You can use Azure AD access reviews to review group memberships, enterprise application access, and role assignments.

Azure AD reporting can provide logs to help discover stale accounts. You can also create access review report workflows in Azure AD PIM to ease the review process.

You can configure Azure AD PIM to alert you when there are too many administrator accounts. PIM can identify administrator accounts that are stale or improperly configured.

Azure Machine Learning offers built-in roles for data scientist and UX service users.

Note: Some Azure services support local users and roles that aren't managed through Azure AD. Manage these users separately.

• Create an access review of Azure resource roles in Privileged Identity Management (PIM)

• How to use Azure AD identity and access reviews

• Manage access to an Azure Machine Learning workspace

Responsibility: Customer

PA-6: Use privileged access workstations

Guidance: Secured, isolated workstations are critical for the security of sensitive roles like administrators, developers, and critical service operators. Use highly secured user workstations and Azure Bastion for administrative tasks.

Use Azure AD, Microsoft Defender ATP, or Microsoft Intune to deploy a secure and managed user workstation for administrative tasks. You can centrally manage secured workstations to enforce a security configuration that includes:

• Strong authentication

• Software and hardware baselines

• Restricted logical and network access

For more information, see the following references:

• Understand privileged access workstations

• Deploy a privileged access workstation

Responsibility: Customer

PA-7: Follow the least privilege principle of just enough administration

Guidance: Azure Machine Learning integrates with Azure RBAC to manage its resources. With RBAC, you manage Azure resource access through role assignments. You can assign roles to users, groups, service principals, and managed identities. Certain resources have pre-defined, built-in roles. You can inventory or query these roles through tools like Azure CLI, Azure PowerShell, or the Azure portal.

Limit the privileges you assign to resources through Azure RBAC to what the roles require. This practice complements the just-in-time (JIT) approach of Azure AD PIM. Review roles and assignments periodically.

Use built-in roles to allocate permissions, and only create custom roles when required.

Azure Machine Learning offers built-in roles for data scientist and UX service users.

• What is Azure Role-Based Access Control (Azure RBAC)

• How to configure RBAC in Azure

• How to use Azure AD identity and access reviews

• Manage access to an Azure Machine Learning workspace

Responsibility: Customer

Data Protection

For more information, see the Azure Security Benchmark: Data Protection.

DP-1: Discover, classify, and label sensitive data

Guidance: Discover, classify, and label your sensitive data. Design the appropriate controls for the organization's technology systems to securely store, process, and transmit sensitive information.

Use Azure Information Protection (AIP) and its associated scanning tool for sensitive information in Office documents. You can use AIP on Azure, Office 365, on-premises, or in other locations.

You can use Azure SQL Information Protection to help classify and label information stored in Azure SQL Database.

• Tag sensitive information using Azure Information Protection

• How to implement Azure SQL Data Discovery

Responsibility: Customer

DP-2: Protect sensitive data

Guidance: Protect sensitive data by restricting access with Azure RBAC, network-based access controls, and specific controls in Azure services. For example, use encryption in SQL and other databases.

For consistency, align all types of access control with your enterprise segmentation strategy. Inform your enterprise segmentation strategy by the location of sensitive or business-critical data and systems.

Microsoft treats all customer content in the underlying Microsoft-managed platform as sensitive. Microsoft guards against customer data loss and exposure. Microsoft has default data protection controls and capabilities to ensure that Azure customer data remains secure.

• Azure Role Based Access Control (RBAC)

• Understand customer data protection in Azure

Responsibility: Customer

DP-3: Monitor for unauthorized transfer of sensitive data

Guidance: Monitor for unauthorized transfer of data to locations outside enterprise visibility and control. Monitor for anomalous activities like large or unusual transfers that could indicate unauthorized data exfiltration.

Azure Storage ATP and Azure SQL ATP can alert on anomalous information transfers that might indicate unauthorized transfers of sensitive information.

AIP provides monitoring capabilities for classified and labeled information.

If necessary for DLP compliance, you can use a host-based DLP solution to enforce detection and prevention controls and prevent data exfiltration.

• Enable Azure SQL ATP

• Enable Azure Storage ATP

Responsibility: Customer

DP-4: Encrypt sensitive information in transit

Guidance: To complement access controls, protect data in transit against out-of-band attacks like traffic capture. Use encryption to ensure that attackers can't easily read or modify the data. Azure Machine Learning supports data encryption in transit with Transport Layer Security (TLS) v1.2.

This requirement is optional for traffic on private networks, but is critical for traffic on external and public networks. For HTTP traffic, make sure any clients that connect to your Azure resources can use TLS v1.2 or greater.

For remote management, use secure shell (SSH) for Linux or remote desktop protocol (RDP) and TLS for Windows. Don't use an unencrypted protocol. Disable weak ciphers and obsolete SSL, TLS, and SSH versions and protocols.

Azure encrypts data in transit between Azure data centers by default.

• Understand encryption in transit with Azure

• Information on TLS security

• Double encryption for Azure data in transit

Responsibility: Microsoft

DP-5: Encrypt sensitive data at rest

Guidance: To complement access controls, Azure Machine Learning protects data at rest against out-of-band attacks, such as accessing underlying storage, by using encryption. Encryption helps ensure that attackers can't easily read or modify the data.

Azure provides encryption for data at rest by default. For highly sensitive data, you can implement extra encryption at rest on Azure resources where available. Azure manages your encryption keys by default, but certain Azure services provide options for customer-managed keys.

• Understand encryption at rest in Azure

• Data at rest double encryption in Azure

• How to configure customer-managed encryption keys

• Encryption model and key management table

• Data encryption with Azure Machine Learning

Responsibility: Customer

Microsoft Defender for Cloud monitoring: The Azure Security Benchmark is the default policy initiative for Microsoft Defender for Cloud and is the foundation for Microsoft Defender for Cloud's recommendations. The Azure Policy definitions related to this control are enabled automatically by Microsoft Defender for Cloud. Alerts related to this control may require an Microsoft Defender plan for the related services.

Azure Policy built-in definitions - Microsoft.MachineLearningServices:

Name (Azure portal)	Description	Effect(s)	Version (GitHub)
Azure Machine Learning workspaces should be encrypted with a customer-managed key	Manage encryption at rest of Azure Machine Learning workspace data with customer-managed keys. By default, customer data is encrypted with service-managed keys, but customer-managed keys are commonly required to meet regulatory compliance standards. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you. You have full control and responsibility for the key lifecycle, including rotation and management. Learn more at https://aka.ms/azureml-workspaces-cmk.	Audit, Deny, Disabled	1.0.3

Asset Management

For more information, see the Azure Security Benchmark: Asset Management.

AM-1: Ensure security team has visibility into risks for assets

Guidance: Make sure to grant security teams Security Reader permissions in your Azure tenant and subscriptions, so they can monitor for security risks by using Microsoft Defender for Cloud.

Monitoring for security risks could be the responsibility of a central security team or a local team, depending on how you structure responsibilities. Always aggregate security insights and risks centrally within an organization.

You can apply Security Reader permissions broadly to an entire tenant's Root Management Group, or scope permissions to specific management groups or subscriptions.

Note: Visibility into workloads and services might require more permissions.

• Overview of Security Reader role

• Overview of Azure Management Groups

Responsibility: Customer

AM-2: Ensure security team has access to asset inventory and metadata

Guidance: Apply tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and value pair. For example, you can apply the name "Environment" and the value "Production" to all the resources in production.

Use Azure Virtual Machine Inventory to automate collecting information about software on virtual machines (VMs). Software Name, Version, Publisher, and Refresh Time are available from the Azure portal. To access install dates and other information, enable guest-level diagnostics and import the Windows Event Logs into a Log Analytics workspace.

Use Microsoft Defender for Cloud Adaptive Application Controls to specify which file types a rule applies to.

• How to create queries with Azure Resource Graph Explorer

• Microsoft Defender for Cloud asset inventory management

• Resource naming and tagging decision guide

• How to enable Azure virtual machine inventory

• How to use Microsoft Defender for Cloud Adaptive Application Controls

Responsibility: Customer

AM-3: Use only approved Azure services

Guidance: Use Azure Policy to audit and restrict which services users can provision in your environment. Use Azure Resource Graph to query for and discover resources within subscriptions. You can also use Azure Monitor to create rules to trigger alerts when they detect an unapproved service.

• How to configure and manage Azure Policy

• How to deny a specific resource type with Azure Policy

• How to create queries with Azure Resource Graph Explorer

Responsibility: Customer

AM-6: Use only approved applications in compute resources

Guidance: Use Azure Virtual Machine Inventory to automate collecting information about all software on VMs. Software Name, Version, Publisher, and Refresh time are available from the Azure portal. To access install dates and other information, enable guest-level diagnostics and bring the Windows event logs into a Log Analytics workspace.

• How to enable Azure virtual machine inventory

Responsibility: Customer

Logging and Threat Detection

For more information, see the Azure Security Benchmark: Logging and Threat Detection.

LT-1: Enable threat detection for Azure resources

Guidance: Use the Microsoft Defender for Cloud built-in threat detection capability. Enable Microsoft Defender for your Azure Machine Learning resources. Microsoft Defender for Azure Machine Learning provides an extra layer of security intelligence. Microsoft Defender detects unusual and potentially harmful attempts to access or exploit your Azure Machine Learning resources.

• Threat protection in Microsoft Defender for Cloud

• Microsoft Defender for Cloud security alerts reference guide

• Enable logging in Azure Machine Learning

Responsibility: Customer

LT-2: Enable threat detection for Azure identity and access management

Guidance: Azure AD provides the following user logs. You can view the logs in Azure AD reporting. You can integrate the logs with Azure Monitor, Microsoft Sentinel, or other SIEM and monitoring tools for more sophisticated monitoring and analytics use cases.

• Sign-ins - Information about managed application usage and user sign-in activities.

• Audit logs - Traceability through logs for all changes made by various Azure AD features. Audit logs include changes made to any resource within Azure AD. Changes include adding or removing users, apps, groups, roles, and policies.

• Risky sign-ins - An indicator for sign-in attempts by someone who might not be the legitimate owner of a user account.

• Users flagged for risk - An indicator for a user account that might have been compromised.

Microsoft Defender for Cloud can also alert you about certain suspicious activities like an excessive number of failed authentication attempts. Deprecated accounts in the subscription can also trigger alerts.

Microsoft Defender for Cloud can also alert you about suspicious activities like an excessive number of failed authentication attempts, or about deprecated accounts.

In addition to basic security hygiene monitoring, Microsoft Defender for Cloud's Threat Protection module can collect more in-depth security alerts from:

• Individual Azure compute resources like VMs, containers, and app service

• Data resources like Azure SQL Database and Azure Storage

• Azure service layers

This capability gives you visibility into account anomalies in individual resources.

• Audit activity reports in the Azure Active Directory

• Enable Azure Identity Protection

• Threat protection in Microsoft Defender for Cloud

• For more information on Azure Machine Learning alerts

Responsibility: Customer

LT-3: Enable logging for Azure network activities

Guidance: Enable and collect network security group (NSG) resource logs, NSG flow logs, Azure Firewall logs, and Web Application Firewall (WAF) logs for security analysis. Logs support incident investigations, threat hunting, and security alert generation. You can send the flow logs to an Azure Monitor Log Analytics workspace and use Traffic Analytics to provide insights.

Make sure to collect DNS query logs to help correlate other network data. You can implement a third-party DNS logging solution from Azure Marketplace as your organization needs.

• How to enable network security group flow logs

• Azure Firewall logs and metrics

• How to enable and use Traffic Analytics

• Monitoring with Network Watcher

• Azure networking monitoring solutions in Azure Monitor

• Gather insights about your DNS infrastructure with the DNS Analytics solution

Responsibility: Customer

LT-4: Enable logging for Azure resources

Guidance: Activity logs are available automatically. The logs contain all PUT, POST, and DELETE, but not GET, operations for your Azure Machine Learning resources. You can use activity logs to find errors when troubleshooting, or to monitor how users in your organization modified resources.

Enable Azure resource logs for Azure Machine Learning. You can use Microsoft Defender for Cloud and Azure Policy to enable resource logs and log data collecting. These logs can be critical for investigating security incidents and doing forensic exercises.

Azure Machine Learning also produces security audit logs for the local administrator accounts. Enable these local admin audit logs. Configure the logs to be sent to a central Log Analytics workspace or storage account for long-term retention and auditing.

• How to collect platform logs and metrics with Azure Monitor

• Understand logging and different log types in Azure

• Understand Microsoft Defender for Cloud data collection

• Monitor Azure Machine Learning

Responsibility: Customer

LT-5: Centralize security log management and analysis

Guidance: Centralize logging storage and analysis to enable correlation. For each log source, ensure you have:

• An assigned data owner
• Access guidance
• Storage location
• What tools you use to process and access the data
• Data retention requirements

Make sure to integrate Azure activity logs into your central logging.

Ingest logs via Azure Monitor to aggregate security data that endpoint devices, network resources, and other security systems generate. In Azure Monitor, use Log Analytics workspaces to query and do analytics.

Use Azure Storage accounts for long-term and archival storage.

Enable and onboard data to Microsoft Sentinel or a third-party SIEM. Many organizations use Microsoft Sentinel for “hot” data they use frequently and Azure Storage for “cold” data they use less frequently.

For applications that run on Azure Machine Learning, forward all security-related logs to your SIEM for centralized management.

• How to collect platform logs and metrics with Azure Monitor

• How to onboard Microsoft Sentinel

• Monitor Azure Machine Learning

Responsibility: Customer

LT-6: Configure log storage retention

Guidance: Make sure that any storage accounts or Log Analytics workspaces you use to store Azure Machine Learning logs have log retention periods set according to your organization's compliance regulations.

In Azure Monitor, you can set your Log Analytics workspace retention period according to your organization's compliance regulations. Use Azure Storage, Azure Data Lake, or Log Analytics workspace accounts for long-term and archival storage.

• How to configure Log Analytics workspace retention period

• Storing resource logs in an Azure Storage Account

Responsibility: Customer

LT-7: Use approved time synchronization sources

Guidance: Azure Machine Learning doesn't support configuring your own time synchronization sources. The Azure Machine Learning service relies on Microsoft time synchronization sources that aren't exposed to customers for configuration.

Responsibility: Microsoft

Posture and Vulnerability Management

For more information, see the Azure Security Benchmark: Posture and Vulnerability Management.

PV-1: Establish secure configurations for Azure services

Guidance: Azure Machine Learning supports service-specific policies that are available in Microsoft Defender for Cloud to audit and enforce Azure resource configurations. You can configure the policies in Microsoft Defender for Cloud or Azure Policy.

Use Azure Blueprints to automate deployment and configuration of services and application environments. A single blueprint definition can include Azure Resource Manager templates, RBAC controls, and policies.

• Policies supported by Azure Machine Learning

• Working with security policies in Microsoft Defender for Cloud

• Illustration of Guardrails implementation in Enterprise Scale Landing Zone

• Tutorial: Create and manage policies to enforce compliance

• Azure Blueprints

Responsibility: Customer

PV-2: Sustain secure configurations for Azure services

Guidance: Use Microsoft Defender for Cloud to monitor your configuration baseline. Use Azure Policy [deny] and [deploy if not exist] to enforce secure configuration across Azure compute resources including VMs and containers.

• Understand Azure Policy effects

• Create and manage policies to enforce compliance

Responsibility: Customer

PV-3: Establish secure configurations for compute resources

Guidance: Azure Machine Learning has varying support across different compute resources, including your own compute resources. For compute resources that your organization owns, use Microsoft Defender for Cloud recommendations to maintain security configurations. You can also use custom operating system images or Azure Automation State Configuration to set the operating system security configuration your organization requires.

Use Microsoft Defender for Cloud and Azure Policy to establish secure configurations on all compute resources, including VMs and containers.

• How to monitor Microsoft Defender for Cloud recommendations

• Security recommendations - a reference guide

Responsibility: Customer

PV-4: Sustain secure configurations for compute resources

Guidance: Use Microsoft Defender for Cloud and Azure Policy to regularly assess and remediate configuration risks on Azure compute resources, including VMs and containers. You can also use Azure Resource Manager (ARM) templates, custom operating system images, or Azure Automation state configuration to maintain the operating system security configuration your organization requires.

Microsoft VM templates combined with Azure Automation State Configuration can help meet and maintain security requirements.
Microsoft manages and maintains the VM images they publish on Azure Marketplace.

Microsoft Defender for Cloud can scan vulnerabilities in container images and continuously monitor your Docker container configurations against CIS Docker Benchmarks. You can use the Microsoft Defender for Cloud Recommendations page to view recommendations and remediate issues.

• How to implement Microsoft Defender for Cloud vulnerability assessment recommendations

• How to create an Azure Virtual Machine from an ARM template

• Azure Automation State Configuration Overview

• Create a Windows virtual machine in the Azure portal

• Information on how to download the VM template

• Sample script to upload a VHD to Azure and create a new VM

• Container security in Microsoft Defender for Cloud

Responsibility: Customer

PV-5: Securely store custom operating system and container images

Guidance: Azure Machine Learning lets customers manage container images. Use Azure RBAC to ensure that only authorized users can access your custom images. Use an Azure Shared Image Gallery to share your images to different users, service principals, or Azure AD groups in your organization. Store container images in Azure Container Registry, and use RBAC to ensure that only authorized users have access.

• Understand Azure RBAC

• Understand Azure RBAC for Container Registry

• How to configure Azure RBAC

• Shared Image Gallery overview

Responsibility: Customer

PV-6: Perform software vulnerability assessments

Guidance: Azure Machine Learning allows service deployment through container registries in its environment.

Follow recommendations from Microsoft Defender for Cloud for performing vulnerability assessments on your container images. Microsoft Defender for Cloud has a built-in vulnerability scanner for container images.

Export scan results at consistent intervals as needed. Compare the results with previous scans to verify that vulnerabilities have been remediated. When using vulnerability management recommendations suggested by Microsoft Defender for Cloud, you can pivot into the selected solution's portal to view historical scan data.

Azure Machine Learning can use a third-party solution for performing vulnerability assessments on network devices and web applications. When conducting remote scans, don't use a single, perpetual, administrative account. Consider implementing JIT provisioning methodology for the scan account. Protect and monitor credentials for the scan account, and use the account only for vulnerability scanning.

• How to implement Microsoft Defender for Cloud vulnerability assessment recommendations

Responsibility: Customer

PV-7: Rapidly and automatically remediate software vulnerabilities

Guidance: Azure Machine Learning uses open-source software as part of the Azure Machine Learning service.

For third-party software, use a third-party patch management solution or System Center Updates Publisher for Configuration Manager.

Responsibility: Customer

PV-8: Conduct regular attack simulation

Guidance: Conduct penetration testing or red team activities on your Azure resources as needed, and ensure remediation of all critical security findings.

Follow the Microsoft Cloud Penetration Testing Rules of Engagement to ensure your penetration tests don't violate Microsoft policies. Use Microsoft's Red Teaming strategy and execution. Do live site penetration testing against Microsoft-managed cloud infrastructure, services, and applications.

• Penetration testing in Azure

• Penetration Testing Rules of Engagement

• Microsoft Cloud Red Teaming

Responsibility: Shared

Endpoint Security

For more information, see the Azure Security Benchmark: Endpoint Security.

ES-1: Use Endpoint Detection and Response (EDR)

Guidance: Enable Endpoint Detection and Response (EDR) capabilities for servers and clients. Integrate with SIEM and security operations processes.

Microsoft Defender Advanced Threat Protection provides EDR capability as part of an enterprise endpoint security platform to prevent, detect, investigate, and respond to advanced threats.

• Microsoft Defender Advanced Threat Protection Overview

• Microsoft Defender ATP service for Windows servers

• Microsoft Defender ATP service for non-Windows servers

Responsibility: Customer

ES-2: Use centrally managed, modern antimalware software

Guidance: Protect your Azure Machine Learning and its resources with centrally managed, modern antimalware software. Use a centrally managed endpoint antimalware solution that can do real-time and periodic scanning.

• Microsoft Antimalware for Azure Cloud Services is the default antimalware solution for Windows VMs.

• For Linux VMs, use a third-party antimalware solution.

• Use Microsoft Defender for Cloud threat detection for data services to detect malware uploaded to Azure Storage accounts.

• Use Microsoft Defender for Cloud to automatically:

  • Identify several popular antimalware solutions for your VMs

  • Report endpoint protection running status

  • Make recommendations

For more information, see the following references:

• How to configure Microsoft Antimalware for Cloud Services and Virtual Machines

• Supported endpoint protection solutions

Responsibility: Customer

ES-3: Be sure to update antimalware software and signatures

Guidance: Make sure to update antimalware signatures rapidly and consistently.

Follow recommendations in Microsoft Defender for Cloud "Compute & Apps" to ensure all VMs and containers are up to date with the latest signatures.

For Windows, Microsoft Antimalware automatically installs the latest signatures and engine updates by default. For Linux, use third-party antimalware solution.

• How to deploy Microsoft Antimalware for Azure Cloud Services and Virtual Machines

• Endpoint protection assessment and recommendations in Microsoft Defender for Cloud

Responsibility: Customer

Backup and Recovery

For more information, see the Azure Security Benchmark: Backup and Recovery.

BR-1: Make sure to run regular automated backups

Guidance: Make sure you back up systems and data to maintain business continuity after an unexpected event. Use guidance for any recovery time objective (RTO) and recovery point objective (RPO)s.

Enable Azure Backup. Configure the backup sources, like Azure VMs, SQL Server, HANA databases, or file shares. Configure the frequency and retention period you want.

For higher redundancy, enable geo-redundant storage options to replicate backup data to a secondary region and recover using cross-region restore.

• Enterprise-scale business continuity and disaster recovery

• How to enable Azure Backup

• How to recover files from Azure Virtual Machine backup

• How to enable cross region restore

• Failover for business continuity and disaster recovery of Azure Machine Learning

Responsibility: Customer

BR-2: Encrypt backup data

Guidance: Make sure to protect your backups are against attacks. Backup protection should include encryption to protect against loss of confidentiality.

On-premises backup using Azure Backup provides encryption at rest using the passphrase you provide. Regular Azure service backup automatically encrypts backup data using Azure platform-managed keys. You can choose to encrypt the backup using a customer-managed key. In this case, make sure this customer-managed key in the key vault is also in the backup scope.

Use RBAC in Azure Backup, Azure Key Vault, and other resources to protect backups and customer-managed keys. You can also enable advanced security features to require MFA before backups can be altered or deleted.

• Overview of security features in Azure Backup

• Encryption of backup data using customer-managed keys

• How to back up Key Vault keys in Azure

• Security features to help protect hybrid backups from attacks

Responsibility: Customer

BR-3: Validate all backups, including customer-managed keys

Guidance: Periodically do data restorations of your backups, and ensure that you can restore backed-up customer-managed keys.

• How to recover files from Azure Virtual Machine backup

• How to restore Key Vault keys in Azure

Responsibility: Customer

BR-4: Mitigate risk of lost keys

Guidance: Ensure you have measures in place to prevent and recover from loss of keys. Enable soft delete and purge protection in Azure Key Vault to protect keys against accidental or malicious deletion.

• How to enable soft delete and purge protection in Key Vault

Responsibility: Customer

Next steps

• See the Azure Security Benchmark V2 overview
• Learn more about Azure security baselines