| Azure – Always use FTPS when using FTP | App Service supports both FTP and FTPS for deploying your files. However, FTPS should be used instead of FTP, if at all possible. When one or both of these protocols are not in use, you should disable them.Steps to Implement (FTP)In the Azure portal, search for and select App Services.Select the web app you want to deploy.Select Deployment Center > FTP > Enforce FTPSIn the FTP dashboard, select Copy to copy the FTPS endpoint and app credentials. It’s recommended that you use App Credentials to deploy to your app because it’s unique to each app. However, if you click User Credentials, you can set user-level credentials that you can use for FTP/S login to all App Service apps in your subscription.From your FTP client (for example, Visual Studio, Cyberduck, or WinSCP), use the connection information you gathered to connect to your app.Copy your files and their respective directory structure to the /site/wwwroot directory in Azure (or the /site/wwwroot/App_Data/Jobs/ directory for WebJobs).Browse to your app’s URL to verify the app is running properly.Enforcing FTPSFor enhanced security, you should allow FTP over SSL only. You can also disable both FTP and FTPS if you don’t use FTP deployment.In your app’s resource page in Azure portal, select App settings in the left navigation.To disable unencrypted FTP, select FTPS Only. To disable both FTP and FTPS entirely, select Disable. When finished, click Save. If using FTPS Only you must enforce TLS 1.2 or higher by navigating to the SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp”>Deploy Apps using FTPS</a> |
| Azure – Use SSL Certificates | Use SSL Certificates. App Service Certificates can be used for any Azure or non-Azure Services and is not limited to App Services. To do so, you need to create a local PFX copy of an App Service certificate that you can use it anywhere you want.Insecure protocols (HTTP, TLS 1.0, FTP)To secure your app against all unencrypted (HTTP) connections, App Service provides one-click configuration to enforce HTTPS. Unsecured requests are turned away before they even reach your application code.TLS 1.0 is no longer considered secure by industry standards, such as PCI DSS. App Service lets you disable outdated protocols by enforcing TLS 1.1/1.2.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site?toc=%2Fazure%2Fazure-functions%2Ftoc.json”>Use SSL</a> |
| Azure – Authenticate Apps using Auth Strategies | Azure App Service provides built-in authentication and authorization support, so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions.You can customize the built-in authentication and authorization in App Service, and manage identity from your application. The portal configuration doesn’t offer a turn-key way to present multiple sign-in providers to your users (such as both Facebook and Twitter). However, it isn’t difficult to add the functionality to your app.Steps to ImplementThis example shows how to implement authorization using Active Directory. Configure Function App auth with Azure Active Directory using express settings.In the Azure portal, navigate to your App Service app. In the left navigation, select Authentication / Authorization.If Authentication / Authorization is not enabled, select On.Select Azure Active Directory, and then select Express under Management Mode.Select OK to register the App Service app in Azure Active Directory. This creates a new app registration. If you want to choose an existing app registration instead, click Select an existing app and then search for the name of a previously created app registration within your tenant. Click the app registration to select it and click OK. Then click OK on the Azure Active Directory settings page. By default, App Service provides authentication but does not restrict authorized access to your site content and APIs. You must authorize users in your app code.(Optional) To restrict access to your site to only users authenticated by Azure Active Directory, set Action to take when request is not authenticated to Log in with Azure Active Directory. This requires that all requests be authenticated, and all unauthenticated requests are redirected to Azure Active Directory for authentication.Click Save.You are now ready to use Azure Active Directory for authentication in your App Service app.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization#more-resources”>Follow the links in the documentation to implement provider specific authorization</a> |
| Azure – Ensure that all communications between Azure and your apps are SSL encrypted | Ensure that all communications between Azure and your apps are SSL encrypted at all times. Note that your apps need to explicitly request a secure connection. This must be implemented in order to avoid potential intermediary attacks If you have not used SSL certificate communication, make sure your apps do not accept other server certificates, as they may not be secure.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site”>Azure App Service SSL Certs</a> |
| Azure – Disable remote debugging for Apps | Visual Studio and the remote debugger try to open the correct ports during installation or startup.Local debugging is generally safer than remote debugging. Remote debugging increases the total surface area that can be probed.When using Windows Authentication mode, be aware that granting an untrusted user permission to connect to msvsmon is dangerous, because the user is granted all your permissions on the computer hosting msvsmon. It is therefore recommended that remote debugging is disabled if not in use.See Also:<a href=”https://docs.microsoft.com/en-us/visualstudio/debugger/configure-the-windows-firewall-for-remote-debugging?view=vs-2019″>Configure Windows Firewall for Remote Debugging</a> |
| Azure – Retry failed operations caused by transient faults | Retry failed operations caused by transient faults. Design a retry strategy for access to all services and resources where they do not inherently support automatic connection retry. Use a strategy that includes an increasing delay between retries as the number of failures increases, to prevent overloading of the resource and to allow it to gracefully recover and handle queued requests. Continual retries with very short delays are likely to exacerbate the problem. For more information, see Retry guidance for specific services.Steps to ImplementThis example in C# illustrates an implementation of the Retry pattern.private int retryCount = 3; private readonly TimeSpan delay = TimeSpan.FromSeconds(5); public async Task OperationWithBasicRetryAsync() { int currentRetry = 0; for (;;) { try { // Call external service. await TransientOperationAsync(); // Return or break. break; } catch (Exception ex) { Trace.TraceError(“Operation Exception”); currentRetry++; // Check if the exception thrown was a transient exception // based on the logic in the error detection strategy. // Determine whether to retry the operation, as well as how // long to wait, based on the retry strategy. if (currentRetry > this.retryCount || !IsTransient(ex)) { // If this isn’t a transient error or we shouldn’t retry, // rethrow the exception. throw; } } // Wait to retry the operation. // Consider calculating an exponential delay here and // using a strategy best suited for the operation and fault. await Task.Delay(delay); } } // Async method that wraps a call to a remote service (details not shown). private async Task TransientOperationAsync() { … } Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/patterns/retry” class=”” rel=”noopener noreferrer”>Retry Pattern</a> |
| Azure – Implement circuit breaking to avoid cascading failures | Implement circuit breaking to avoid cascading failures. There may be situations in which transient or other faults, ranging in severity from a partial loss of connectivity to the complete failure of a service, take much longer than expected to return to normal. , if a service is very busy, failure in one part of the system may lead to cascading failures, and result in many operations becoming blocked while holding onto critical system resources such as memory, threads, and database connections. Instead of continually retrying an operation that is unlikely to succeed, the application should quickly accept that the operation has failed, and gracefully handle this failure. Use the Circuit Breaker pattern to reject requests for specific operations for defined periods. For more information, see the Circuit Breaker pattern.Steps to ImplementThe recommended approach for circuit breakers is to take advantage of proven .NET libraries like Polly and its native integration with HttpClientFactory.Adding a circuit breaker policy into your HttpClientFactory outgoing middleware pipeline is as simple as adding a single incremental piece of code to what you already have when using HttpClientFactory.The only addition here to the code used for HTTP call retries is the code where you add the Circuit Breaker policy to the list of policies to use, as shown in the following incremental code, part of the ConfigureServices() method.//ConfigureServices() – Startup.cs services.AddHttpClient<IBasketService, BasketService>() .SetHandlerLifetime(TimeSpan.FromMinutes(5)) //Sample. Default lifetime is 2 minutes .AddHttpMessageHandler<HttpClientAuthorizationDelegatingHandler>() .AddPolicyHandler(GetRetryPolicy()) .AddPolicyHandler(GetCircuitBreakerPolicy()); The AddPolicyHandler() method is what adds policies to the HttpClient objects you’ll use. In this case, it’s adding a Polly policy for a circuit breaker.To have a more modular approach, the Circuit Breaker Policy is defined in a separate method called GetCircuitBreakerPolicy(), as shown in the following code:static IAsyncPolicy<HttpResponseMessage> GetCircuitBreakerPolicy() { return HttpPolicyExtensions .HandleTransientHttpError() .CircuitBreakerAsync(5, TimeSpan.FromSeconds(30)); } Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/patterns/circuit-breaker” class=”” rel=”noopener noreferrer”>Circuit Breaker Pattern</a> <a href=”https://docs.microsoft.com/en-us/dotnet/standard/microservices-architecture/implement-resilient-applications/implement-circuit-breaker-pattern” class=”” rel=”noopener noreferrer”>Implement Circuit Breaker</a> |
| Azure – Monitor system health by implementing checking functions | Monitor system health by implementing checking functions. The health and performance of an application can degrade over time, without being noticeable until it fails. Implement probes or check functions that are executed regularly from outside the application. These checks can be as simple as measuring response time for the application as a whole, for individual parts of the application, for individual services that the application uses, or for individual components. Check functions can execute processes to ensure they produce valid results, measure latency and check availability, and extract information from the system.Learn More<a href=”https://docs.microsoft.com/da-dk/azure/architecture/checklist/availability?view=azuremgmtwebsites-1.6.0-preview#monitoring-and-disaster-recovery” class=”” rel=”noopener noreferrer”>Monitoring and System Recovery</a> |
| Azure – Restrict IPs for Apps | IP Restrictions allow you to define a priority ordered allow/deny list of IP addresses that are allowed to access your app. The allow list can include IPv4 and IPv6 addresses. When there are one or more entries, there is then an implicit deny all that exists at the end of the list.IP addresses are associated with function apps, not with individual functions. Incoming HTTP requests can’t use the inbound IP address to call individual functions; they must use the default domain name (<a href=”http://functionappname.azurewebsites.net/”>functionappname.azurewebsites.net</a> ) or a custom domain name.Steps to ImplementTo add an IP restriction rule to your app, use the menu to open Network>IP Restrictions and click on Configure IP RestrictionsFrom the IP Restrictions UI, you can review the list of IP restriction rules defined for your app. Your app would only accept traffic from allowed IPs and would be denied from any other IP address.You can click on [+] Add to add a new IP restriction rule. Once you add a rule, it will become effective immediately. Rules are enforced in priority order starting from the lowest number and going up. There is an implicit deny all that is in effect once you add even a single rule.Each function app has a single inbound IP address. To find that IP address:Sign in to the Azure portal.Navigate to the function app.Select Platform features.Select Properties, and the inbound IP address appears under Virtual IP address.To find the outbound IP addresses available to a function app:Sign in to the Azure Resource Explorer.Select subscriptions > {your subscription} > providers > <a href=”http://microsoft.web/”>Microsoft.Web</a> > sites.In the JSON panel, find the site with an id property that ends in the name of your function app.See outboundIpAddresses and possibleOutboundIpAddresses.The set of outboundIpAddresses is currently available to the function app. The set of possibleOutboundIpAddresses includes IP addresses that will be available only if the function app scales to other pricing tiers.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions?toc=%2Fazure%2Fazure-functions%2Ftoc.json”>Restrict IPs</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-functions/ip-addresses”>IP Addresses</a> |
| Azure – Restrict access via CORS | Cross Origin Resource Sharing (CORS):Is a W3C standard that allows a server to relax the same-origin policy.Is not a security feature, CORS relaxes security. An API is not safer by allowing CORS.Allows a server to explicitly allow some cross-origin requests while rejecting others.Is safer and more flexible than earlier techniquesAllow only required domains to interact with your web application. Cross origin resource sharing (CORS) should not allow all domains to access your web application.To enable CORS, see <a href=”https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-3.1#enable-cors”>Enable Cross-Origin Requests (CORS) in ASP.NET Core</a> |
| Azure – Always Configure Autoscale for Web and API Apps | Always use a scale-out and scale-in (or scale-up and scale-down) rule combination that performs an increase and decrease.Autoscale allows you to have the right amount of resources running to handle the load on your application. It allows you to add resources to handle increases in load and also save money by removing resources that are sitting idle.There are two types of scaling, vertical and horizontal. Vertical scaling, also known as scale up and scale down, means increasing or decreasing app resource sizes in response to a workload. Compare this behavior with horizontal scaling, also referred to as scale out and scale in, where the number of app instances is altered depending on the workload.Steps to ImplementScale OutNavigate to Monitor instance in the Azure portal.Select Autoscale from the menu on the left.Locate your Azure API Management service based on the filters in dropdown menus.Select the desired Azure API Management service instance.In the newly opened section, click the Enable autoscale button.In the Rules section, click + Add a rule.Define a new scale out rule.Click Add to save the rule.Scale InClick again on + Add a rule.This time, a scale in rule needs to be defined. It will ensure resources are not being wasted, when the usage of APIs decreases.Define a new scale in rule.Click Add to save the rule.Set the maximum number of Azure API Management units.Note: Azure API Management has a limit of units an instance can scale out to. The limit depends on a service tier.Click Save. Your autoscale has been configured.Learn More<a href=”https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-autoscale” class=”” rel=”noopener noreferrer”>Automatically scale Azure resources</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-get-started” class=”” rel=”noopener noreferrer”>Azure Autoscaling</a> |
Azure Content Delivery
| Azure – Use HTTPS for CDN | The CDN can deliver content over HTTPS (SSL), by using the certificate provided by the CDN, as well as over standard HTTP. To avoid browser warnings about mixed content, you might need to use HTTPS to request static content that is displayed in pages loaded through HTTPS.Steps to ImplementIn the Azure portal, browse to your Azure CDN Standard from Microsoft, Azure CDN Standard from Akamai, Azure CDN Standard from Verizon or Azure CDN Premium from Verizon profile.In the list of CDN endpoints, select the endpoint containing your custom domain.In the list of custom domains, select the custom domain for which you want to enable HTTPS.Under Certificate management type, select CDN managed.Select On to enable HTTPS.<a href=”https://docs.microsoft.com/en-us/azure/cdn/cdn-custom-ssl?tabs=option-1-default-enable-https-with-a-cdn-managed-certificate#validate-the-domain” class=”” rel=”noopener noreferrer”>Validate the domain</a> .Learn More<a href=”https://docs.microsoft.com/en-us/azure/cdn/cdn-custom-ssl?tabs=option-1-default-enable-https-with-a-cdn-managed-certificate” class=”” rel=”noopener noreferrer”>Configure HTTPS for CDN</a> |
| Azure – Enable file compression | Consider the options for file compression, such as gzip (GNU zip). Compression may be performed on the origin server by the web application hosting or directly on the edge servers by the CDN.Steps to ImplementFrom the CDN profile page, select the CDN endpoint you want to manage.Select Compression.Select On to turn on compression.Use the default MIME types, or modify the list by adding or removing MIME types. Tip: Although it is possible, it is not recommended to apply compression to compressed formats. For example, ZIP, MP3, MP4, or JPG.After making your changes, select Save.Learn More<a href=”https://docs.microsoft.com/en-us/azure/cdn/cdn-improve-performance” class=”” rel=”noopener noreferrer”>CDN Compression</a> |
| Azure – Enable CORS for CDN | If you deliver static assets such as font files by using the CDN, you might encounter same-origin policy issues if you use an XMLHttpRequest call to request these resources from a different domain. Many web browsers prevent cross-origin resource sharing (CORS) unless the web server is configured to set the appropriate response headers. You can configure the CDN to support CORS by using one of the following methods:Configure the CDN to add CORS headers to the responses.If the origin is Azure blob storage, add CORS rules to the storage endpoint.Configure the application to set the CORS headers.Steps to ImplementFrom the CDN profile page, select Manage.Select the HTTP Large tab, then select Rules Engine.Enter a name in the Name / Description textbox.Identify the type of requests the rule applies to. Use the default match condition, Always.To add a new feature, select the + button next to Features. In the dropdown on the left, select Force Internal Max-Age. In the textbox that appears, enter 300. Do not change the remaining default values.Select Add to save the new rule. The new rule is now awaiting approval. After it has been approved, the status changes from Pending XML to Active XML.Important: Rules changes can take up to 10 minutes to propagate through Azure CDN.Learn More<a href=”https://docs.microsoft.com/en-us/azure/cdn/cdn-rules-engine” class=”” rel=”noopener noreferrer”>CDN Rules</a> |
| Azure – Enable the blob storage provider for the CDN as public | Enable Azure Content Delivery Network (CDN) to cache content from Azure storage. Azure CDN offers developers a global solution for delivering high-bandwidth content. It can cache blobs and static content of compute instances at physical nodes in the United States, Europe, Asia, Australia, and South America.Enable the blob storage provider for the CDN as public and it should consist only Public items.Steps to ImplementSelect a storage account from the dashboard, then select Azure CDN from the left pane. If the Azure CDN button is not immediately visible, you can enter CDN in the Search box of the left pane to find it. The Azure CDN page appears.Create a new endpoint by entering the required informationSelect Create. After the endpoint is created, it appears in the endpoint list.Learn More<a href=”https://docs.microsoft.com/en-us/azure/cdn/cdn-create-a-storage-account-with-cdn” class=”” rel=”noopener noreferrer”>Integrate Storage with CDN</a> |
| Azure – Routing and versioning recommendations | You may need to use different CDN instances at various times. For example, when you deploy a new version of the application you may want to use a new CDN and retain the old CDN (holding content in an older format) for previous versions. If you use Azure blob storage as the content origin, you can create a separate storage account or a separate container and point the CDN endpoint to it.Do not use the query string to denote different versions of the application in links to resources on the CDN because, when retrieving content from Azure blob storage, the query string is part of the resource name (the blob name). This approach can also affect how the client caches resources.Deploying new versions of static content when you update an application can be a challenge if the previous resources are cached on the CDN.Consider restricting the CDN content access by country. Azure CDN allows you to filter requests based on the country of origin and restrict the content delivered.Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/best-practices/cdn” class=”” rel=”noopener noreferrer”>CDN Best Practices</a> |
| Azure – Use caching rules | Consider how to manage caching within the system. For example, in Azure CDN, you can set global caching rules, and then set custom caching for particular origin endpoints. You can also control how caching is performed in a CDN by sending cache-directive headers at the origin.Steps to ImplementIn the Azure portal, select a CDN profile, then select an endpoint.In the left pane under Settings, select Caching rules.Set global caching rulesCreate a global caching rule as follows:Under Global caching rules, set Query string caching behavior to Ignore query strings.Set Caching behavior to Set if missing.For Cache expiration duration, enter 10 in the Days field.The global caching rule affects all requests to the endpoint. This rule honors the origin cache-directive headers, if they exist (Cache-Control or Expires); otherwise, if they are not specified, it sets the cache to 10 days.Set custom caching rulesCreate a custom caching rule as follows:Under Custom caching rules, set Match condition to Path and Match value to /images/*.jpg.Set Caching behavior to Override and enter 30 in the Days field.This custom caching rule sets a cache duration of 30 days on any .jpg image files in the /images folder of your endpoint. It overrides any Cache-Control or Expires HTTP headers that are sent by the origin server.Learn More<a href=”https://docs.microsoft.com/en-us/azure/cdn/cdn-caching-rules-tutorial” class=”” rel=”noopener noreferrer”>CDN Caching Rules</a> |
| Azure – Use CDN fallback strategies | Consider how your application will cope with a failure or temporary unavailability of the CDN. Client applications may be able to use copies of the resources that were cached locally (on the client) during previous requests, or you can include code that detects failure and instead requests resources from the origin (the application folder or Azure blob container that holds the resources) if the CDN is unavailable.Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/best-practices/cdn” class=”” rel=”noopener noreferrer”>CDN Best Practices</a> |
Azure- Web Apps
| Azure – Always use FTPS when using FTP | App Service supports both FTP and FTPS for deploying your files. However, FTPS should be used instead of FTP, if at all possible. When one or both of these protocols are not in use, you should disable them.Steps to Implement (FTP)In the Azure portal, search for and select App Services.Select the web app you want to deploy.Select Deployment Center > FTP > Enforce FTPSIn the FTP dashboard, select Copy to copy the FTPS endpoint and app credentials. It’s recommended that you use App Credentials to deploy to your app because it’s unique to each app. However, if you click User Credentials, you can set user-level credentials that you can use for FTP/S login to all App Service apps in your subscription.From your FTP client (for example, Visual Studio, Cyberduck, or WinSCP), use the connection information you gathered to connect to your app.Copy your files and their respective directory structure to the /site/wwwroot directory in Azure (or the /site/wwwroot/App_Data/Jobs/ directory for WebJobs).Browse to your app’s URL to verify the app is running properly.Enforcing FTPSFor enhanced security, you should allow FTP over SSL only. You can also disable both FTP and FTPS if you don’t use FTP deployment.In your app’s resource page in Azure portal, select App settings in the left navigation.To disable unencrypted FTP, select FTPS Only. To disable both FTP and FTPS entirely, select Disable. When finished, click Save. If using FTPS Only you must enforce TLS 1.2 or higher by navigating to the SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp”>Deploy Apps using FTPS</a> |
| Azure – Use SSL Certificates | Use SSL Certificates. App Service Certificates can be used for any Azure or non-Azure Services and is not limited to App Services. To do so, you need to create a local PFX copy of an App Service certificate that you can use it anywhere you want.Insecure protocols (HTTP, TLS 1.0, FTP)To secure your app against all unencrypted (HTTP) connections, App Service provides one-click configuration to enforce HTTPS. Unsecured requests are turned away before they even reach your application code.TLS 1.0 is no longer considered secure by industry standards, such as PCI DSS. App Service lets you disable outdated protocols by enforcing TLS 1.1/1.2.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site?toc=%2Fazure%2Fazure-functions%2Ftoc.json”>Use SSL</a> |
| Azure – Authenticate Apps using Auth Strategies | Azure App Service provides built-in authentication and authorization support, so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions.You can customize the built-in authentication and authorization in App Service, and manage identity from your application. The portal configuration doesn’t offer a turn-key way to present multiple sign-in providers to your users (such as both Facebook and Twitter). However, it isn’t difficult to add the functionality to your app.Steps to ImplementThis example shows how to implement authorization using Active Directory. Configure Function App auth with Azure Active Directory using express settings.In the Azure portal, navigate to your App Service app. In the left navigation, select Authentication / Authorization.If Authentication / Authorization is not enabled, select On.Select Azure Active Directory, and then select Express under Management Mode.Select OK to register the App Service app in Azure Active Directory. This creates a new app registration. If you want to choose an existing app registration instead, click Select an existing app and then search for the name of a previously created app registration within your tenant. Click the app registration to select it and click OK. Then click OK on the Azure Active Directory settings page. By default, App Service provides authentication but does not restrict authorized access to your site content and APIs. You must authorize users in your app code.(Optional) To restrict access to your site to only users authenticated by Azure Active Directory, set Action to take when request is not authenticated to Log in with Azure Active Directory. This requires that all requests be authenticated, and all unauthenticated requests are redirected to Azure Active Directory for authentication.Click Save.You are now ready to use Azure Active Directory for authentication in your App Service app.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization#more-resources”>Follow the links in the documentation to implement provider specific authorization</a> |
| Azure – Reference Secrets from Key Vault | Reference Secrets from Key Vault. You can work with secrets from Azure Key Vault in your Azure Functions application without requiring any code changes.Steps to ImplementIn order to read secrets from Key Vault, you need to have a vault created and give your app permission to access it.Create a key vault by following the <a href=”https://docs.microsoft.com/en-us/azure/key-vault/quick-create-cli”>Key Vault quickstart</a> .Create a <a href=”https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity”>system-assigned managed identity</a> for your application. Note: Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.Create an <a href=”https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault#key-vault-access-policies”>access policy in Key Vault</a> for the application identity you created earlier. Enable the “Get” secret permission on this policy. Do not configure the “authorized application” or appliationId settings, as this is not compatible with a managed identity.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?toc=%2Fazure%2Fazure-functions%2Ftoc.json”>Reference secrets Key Vault</a> |
| Azure – Ensure that Register with Azure Active Directory is enabled on App Service | Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords.App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turn-key solution for securing access to Azure SQL Database and other Azure services.Steps to ImplementAzure Portal:Login to Azure PortalGo to App ServicesSelect the AppClick on Identity under the Settings bladeSet Status to OnClick on Save<a href=”https://docs.microsoft.com/en-gb/cli/azure/webapp/identity?view=azure-cli-latest#az_webapp_identity_assign”>Using Command Line:</a>az webapp identity assign –resource-group <RESOURCE_GROUP_NAME> –name <APP_NAME><a href=”https://docs.microsoft.com/en-gb/azure/app-service/overview-managed-identity?tabs=dotnet”>How to use managed identities for App Service</a> |
| Azure – Ensure that all communications between Azure and your apps are SSL encrypted | Ensure that all communications between Azure and your apps are SSL encrypted at all times. Note that your apps need to explicitly request a secure connection. This must be implemented in order to avoid potential intermediary attacks If you have not used SSL certificate communication, make sure your apps do not accept other server certificates, as they may not be secure.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site”>Azure App Service SSL Certs</a> |
| Azure – Disable remote debugging for Apps | Visual Studio and the remote debugger try to open the correct ports during installation or startup.Local debugging is generally safer than remote debugging. Remote debugging increases the total surface area that can be probed.When using Windows Authentication mode, be aware that granting an untrusted user permission to connect to msvsmon is dangerous, because the user is granted all your permissions on the computer hosting msvsmon. It is therefore recommended that remote debugging is disabled if not in use.See Also:<a href=”https://docs.microsoft.com/en-us/visualstudio/debugger/configure-the-windows-firewall-for-remote-debugging?view=vs-2019″>Configure Windows Firewall for Remote Debugging</a> |
| Azure – Retry failed operations caused by transient faults | Retry failed operations caused by transient faults. Design a retry strategy for access to all services and resources where they do not inherently support automatic connection retry. Use a strategy that includes an increasing delay between retries as the number of failures increases, to prevent overloading of the resource and to allow it to gracefully recover and handle queued requests. Continual retries with very short delays are likely to exacerbate the problem. For more information, see Retry guidance for specific services.Steps to ImplementThis example in C# illustrates an implementation of the Retry pattern.private int retryCount = 3; private readonly TimeSpan delay = TimeSpan.FromSeconds(5); public async Task OperationWithBasicRetryAsync() { int currentRetry = 0; for (;;) { try { // Call external service. await TransientOperationAsync(); // Return or break. break; } catch (Exception ex) { Trace.TraceError(“Operation Exception”); currentRetry++; // Check if the exception thrown was a transient exception // based on the logic in the error detection strategy. // Determine whether to retry the operation, as well as how // long to wait, based on the retry strategy. if (currentRetry > this.retryCount || !IsTransient(ex)) { // If this isn’t a transient error or we shouldn’t retry, // rethrow the exception. throw; } } // Wait to retry the operation. // Consider calculating an exponential delay here and // using a strategy best suited for the operation and fault. await Task.Delay(delay); } } // Async method that wraps a call to a remote service (details not shown). private async Task TransientOperationAsync() { … } Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/patterns/retry” class=”” rel=”noopener noreferrer”>Retry Pattern</a> |
| Azure – Implement circuit breaking to avoid cascading failures | Implement circuit breaking to avoid cascading failures. There may be situations in which transient or other faults, ranging in severity from a partial loss of connectivity to the complete failure of a service, take much longer than expected to return to normal. , if a service is very busy, failure in one part of the system may lead to cascading failures, and result in many operations becoming blocked while holding onto critical system resources such as memory, threads, and database connections. Instead of continually retrying an operation that is unlikely to succeed, the application should quickly accept that the operation has failed, and gracefully handle this failure. Use the Circuit Breaker pattern to reject requests for specific operations for defined periods. For more information, see the Circuit Breaker pattern.Steps to ImplementThe recommended approach for circuit breakers is to take advantage of proven .NET libraries like Polly and its native integration with HttpClientFactory.Adding a circuit breaker policy into your HttpClientFactory outgoing middleware pipeline is as simple as adding a single incremental piece of code to what you already have when using HttpClientFactory.The only addition here to the code used for HTTP call retries is the code where you add the Circuit Breaker policy to the list of policies to use, as shown in the following incremental code, part of the ConfigureServices() method.//ConfigureServices() – Startup.cs services.AddHttpClient<IBasketService, BasketService>() .SetHandlerLifetime(TimeSpan.FromMinutes(5)) //Sample. Default lifetime is 2 minutes .AddHttpMessageHandler<HttpClientAuthorizationDelegatingHandler>() .AddPolicyHandler(GetRetryPolicy()) .AddPolicyHandler(GetCircuitBreakerPolicy()); The AddPolicyHandler() method is what adds policies to the HttpClient objects you’ll use. In this case, it’s adding a Polly policy for a circuit breaker.To have a more modular approach, the Circuit Breaker Policy is defined in a separate method called GetCircuitBreakerPolicy(), as shown in the following code:static IAsyncPolicy<HttpResponseMessage> GetCircuitBreakerPolicy() { return HttpPolicyExtensions .HandleTransientHttpError() .CircuitBreakerAsync(5, TimeSpan.FromSeconds(30)); } Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/patterns/circuit-breaker” class=”” rel=”noopener noreferrer”>Circuit Breaker Pattern</a> <a href=”https://docs.microsoft.com/en-us/dotnet/standard/microservices-architecture/implement-resilient-applications/implement-circuit-breaker-pattern” class=”” rel=”noopener noreferrer”>Implement Circuit Breaker</a> |
| Azure – Monitor system health by implementing checking functions | Monitor system health by implementing checking functions. The health and performance of an application can degrade over time, without being noticeable until it fails. Implement probes or check functions that are executed regularly from outside the application. These checks can be as simple as measuring response time for the application as a whole, for individual parts of the application, for individual services that the application uses, or for individual components. Check functions can execute processes to ensure they produce valid results, measure latency and check availability, and extract information from the system.Learn More<a href=”https://docs.microsoft.com/da-dk/azure/architecture/checklist/availability?view=azuremgmtwebsites-1.6.0-preview#monitoring-and-disaster-recovery” class=”” rel=”noopener noreferrer”>Monitoring and System Recovery</a> |
| Azure – Restrict IPs for Apps | IP Restrictions allow you to define a priority ordered allow/deny list of IP addresses that are allowed to access your app. The allow list can include IPv4 and IPv6 addresses. When there are one or more entries, there is then an implicit deny all that exists at the end of the list.IP addresses are associated with function apps, not with individual functions. Incoming HTTP requests can’t use the inbound IP address to call individual functions; they must use the default domain name (<a href=”http://functionappname.azurewebsites.net/”>functionappname.azurewebsites.net</a> ) or a custom domain name.Steps to ImplementTo add an IP restriction rule to your app, use the menu to open Network>IP Restrictions and click on Configure IP RestrictionsFrom the IP Restrictions UI, you can review the list of IP restriction rules defined for your app. Your app would only accept traffic from allowed IPs and would be denied from any other IP address.You can click on [+] Add to add a new IP restriction rule. Once you add a rule, it will become effective immediately. Rules are enforced in priority order starting from the lowest number and going up. There is an implicit deny all that is in effect once you add even a single rule.Each function app has a single inbound IP address. To find that IP address:Sign in to the Azure portal.Navigate to the function app.Select Platform features.Select Properties, and the inbound IP address appears under Virtual IP address.To find the outbound IP addresses available to a function app:Sign in to the Azure Resource Explorer.Select subscriptions > {your subscription} > providers > <a href=”http://microsoft.web/”>Microsoft.Web</a> > sites.In the JSON panel, find the site with an id property that ends in the name of your function app.See outboundIpAddresses and possibleOutboundIpAddresses.The set of outboundIpAddresses is currently available to the function app. The set of possibleOutboundIpAddresses includes IP addresses that will be available only if the function app scales to other pricing tiers.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions?toc=%2Fazure%2Fazure-functions%2Ftoc.json”>Restrict IPs</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-functions/ip-addresses”>IP Addresses</a> |
| Azure – Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service | Azure Web Apps allows sites to run under both HTTP and HTTPS by default. Web apps can be accessed by anyone using non-secure HTTP links by default. Non-secure HTTP requests can be restricted and all HTTP requests redirected to the secure HTTPS port. It is recommended to enforce HTTPS-only traffic.Enabling HTTPS-only traffic will redirect all non-secure HTTP request to HTTPS ports. HTTPS uses the SSL/TLS protocol to provide a secure connection, which is both encrypted and authenticated. So it is important to support HTTPS for the security benefits.Steps to ImplementAzure Portal:Login to Azure PortalGo to App ServicesSelect the AppClick on TLS/SSL Settings under the Settings bladeSet HTTPS Only to On under Protocol Settings section<a href=”https://docs.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest#az_webapp_update”>Using Command Line:</a>az webapp update –resource-group <RESOURCE_GROUP_NAME> –name <APP_NAME> — set httpsOnly=falseDefaultBy default, HTTPS-only feature will be disabled when a new app is created using the command-line tool or Azure Portal console.<a href=”https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https”>Enforce HTTPS</a> |
| Azure – Restrict access via CORS | Cross Origin Resource Sharing (CORS):Is a W3C standard that allows a server to relax the same-origin policy.Is not a security feature, CORS relaxes security. An API is not safer by allowing CORS.Allows a server to explicitly allow some cross-origin requests while rejecting others.Is safer and more flexible than earlier techniquesAllow only required domains to interact with your web application. Cross origin resource sharing (CORS) should not allow all domains to access your web application.To enable CORS, see <a href=”https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-3.1#enable-cors”>Enable Cross-Origin Requests (CORS) in ASP.NET Core</a> |
| Azure – Always Configure Autoscale for Web and API Apps | Always use a scale-out and scale-in (or scale-up and scale-down) rule combination that performs an increase and decrease.Autoscale allows you to have the right amount of resources running to handle the load on your application. It allows you to add resources to handle increases in load and also save money by removing resources that are sitting idle.There are two types of scaling, vertical and horizontal. Vertical scaling, also known as scale up and scale down, means increasing or decreasing app resource sizes in response to a workload. Compare this behavior with horizontal scaling, also referred to as scale out and scale in, where the number of app instances is altered depending on the workload.Steps to ImplementScale OutNavigate to Monitor instance in the Azure portal.Select Autoscale from the menu on the left.Locate your Azure API Management service based on the filters in dropdown menus.Select the desired Azure API Management service instance.In the newly opened section, click the Enable autoscale button.In the Rules section, click + Add a rule.Define a new scale out rule.Click Add to save the rule.Scale InClick again on + Add a rule.This time, a scale in rule needs to be defined. It will ensure resources are not being wasted, when the usage of APIs decreases.Define a new scale in rule.Click Add to save the rule.Set the maximum number of Azure API Management units.Note: Azure API Management has a limit of units an instance can scale out to. The limit depends on a service tier.Click Save. Your autoscale has been configured.Learn More<a href=”https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-autoscale” class=”” rel=”noopener noreferrer”>Automatically scale Azure resources</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-get-started” class=”” rel=”noopener noreferrer”>Azure Autoscaling</a> |
| Azure – Ensure web app is using the latest version of TLS encryption | The TLS(Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards, such as PCI DSS.App service currently allows the web app to set TLS versions 1.0, 1.1 and 1.2. It is highly recommended to use the latest TLS 1.2 version for web app secure connections.Steps to ImplementAzure Portal:Login to Azure PortalGo to App ServicesSelect the AppClick on TLS/SSL Settings under the Settings bladeSet Minimum TLS Version to 1.2 under Protocol Settings section<a href=”https://docs.microsoft.com/en-us/cli/azure/webapp/config?view=azure-cli-latest#az_webapp_config_set”>Using Command Line:</a>az webapp config set –resource-group <RESOURCE_GROUP_NAME> –name <APP_NAME> –min-tls-version 1.2DefaultBy default, TLS Version feature will be set to 1.2 when a new app is created using the command-line tool or Azure Portal console.<a href=”https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-tls-versions”>Enforce TLS versions</a> |
| Azure – Ensure that the latest stack version is used as a part of the web app | Periodically, newer versions are released for .Net Framework software either due to security flaws or to include additional functionality. Using the latest .Net framework version for web apps is recommended in order to to take advantage of security fixes, if any, and/or new functionalities of the latest version.Newer versions may contain security enhancements and additional functionality. It is recommended to use the latest software version to take advantage of enhancements and new capabilities. With each software installation, organizations need to determine if a given update meets their requirements and also verify the compatibility and support provided for any additional software against the update revision that is selected.Steps to ImplementAzure Portal:Login to Azure PortalGo to App ServicesSelect the AppClick on Configuration under Settings bladeGo to General SettingsSelect the appropriate Stack and its latest available versionClick on SaveDefaultBy default, the latest version will be chosen when creating a new app using the command-line tool or Azure Portal console.<a href=”https://docs.microsoft.com/en-us/azure/app-service/configure-common#configure-general-settings”>Configure general settings</a> |
| Azure – Ensure that HTTP version is the latest, if used to run the web app | Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version.Newer versions may contain security enhancements and additional functionality. Using the latest version is recommended in order to take advantage of enhancements and new capabilities. With each software installation, organizations need to determine if a given update meets their requirements and also verify the compatibility and support provided for any additional software against the update revision that is selected.HTTP 2.0 has additional performance improvements on the head-of-line blocking problem of old HTTP version, header compression, and prioritization of requests. HTTP 2.0 no longer supports HTTP 1.1’s chunked transfer encoding mechanism, as it provides its own, more efficient, mechanisms for data streaming.Steps to ImplementAzure Portal:Login to Azure PortalGo to App ServicesSelect the AppClick on Configuration under Settings bladeGo to General SettingsSet HTTP version to 2.0Click on Save<a href=”https://docs.microsoft.com/en-us/cli/azure/webapp/config?view=azure-cli-latest#az_webapp_config_set”>Using Command Line:</a>az webapp config set –resource-group <RESOURCE_GROUP_NAME> –name <APP_NAME> –http20-enabled true<a href=”https://docs.microsoft.com/en-us/azure/app-service/configure-common#configure-general-settings”>Configure general settings</a> |
Azure Mobile Apps
| Azure – Always use FTPS when using FTP | App Service supports both FTP and FTPS for deploying your files. However, FTPS should be used instead of FTP, if at all possible. When one or both of these protocols are not in use, you should disable them.Steps to Implement (FTP)In the Azure portal, search for and select App Services.Select the web app you want to deploy.Select Deployment Center > FTP > Enforce FTPSIn the FTP dashboard, select Copy to copy the FTPS endpoint and app credentials. It’s recommended that you use App Credentials to deploy to your app because it’s unique to each app. However, if you click User Credentials, you can set user-level credentials that you can use for FTP/S login to all App Service apps in your subscription.From your FTP client (for example, Visual Studio, Cyberduck, or WinSCP), use the connection information you gathered to connect to your app.Copy your files and their respective directory structure to the /site/wwwroot directory in Azure (or the /site/wwwroot/App_Data/Jobs/ directory for WebJobs).Browse to your app’s URL to verify the app is running properly.Enforcing FTPSFor enhanced security, you should allow FTP over SSL only. You can also disable both FTP and FTPS if you don’t use FTP deployment.In your app’s resource page in Azure portal, select App settings in the left navigation.To disable unencrypted FTP, select FTPS Only. To disable both FTP and FTPS entirely, select Disable. When finished, click Save. If using FTPS Only you must enforce TLS 1.2 or higher by navigating to the SSL settings blade of your web app. TLS 1.0 and 1.1 are not supported with FTPS Only.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp”>Deploy Apps using FTPS</a> |
| Azure – Use SSL Certificates | Use SSL Certificates. App Service Certificates can be used for any Azure or non-Azure Services and is not limited to App Services. To do so, you need to create a local PFX copy of an App Service certificate that you can use it anywhere you want.Insecure protocols (HTTP, TLS 1.0, FTP)To secure your app against all unencrypted (HTTP) connections, App Service provides one-click configuration to enforce HTTPS. Unsecured requests are turned away before they even reach your application code.TLS 1.0 is no longer considered secure by industry standards, such as PCI DSS. App Service lets you disable outdated protocols by enforcing TLS 1.1/1.2.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site?toc=%2Fazure%2Fazure-functions%2Ftoc.json”>Use SSL</a> |
| Azure – Authenticate Apps using Auth Strategies | Azure App Service provides built-in authentication and authorization support, so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions.You can customize the built-in authentication and authorization in App Service, and manage identity from your application. The portal configuration doesn’t offer a turn-key way to present multiple sign-in providers to your users (such as both Facebook and Twitter). However, it isn’t difficult to add the functionality to your app.Steps to ImplementThis example shows how to implement authorization using Active Directory. Configure Function App auth with Azure Active Directory using express settings.In the Azure portal, navigate to your App Service app. In the left navigation, select Authentication / Authorization.If Authentication / Authorization is not enabled, select On.Select Azure Active Directory, and then select Express under Management Mode.Select OK to register the App Service app in Azure Active Directory. This creates a new app registration. If you want to choose an existing app registration instead, click Select an existing app and then search for the name of a previously created app registration within your tenant. Click the app registration to select it and click OK. Then click OK on the Azure Active Directory settings page. By default, App Service provides authentication but does not restrict authorized access to your site content and APIs. You must authorize users in your app code.(Optional) To restrict access to your site to only users authenticated by Azure Active Directory, set Action to take when request is not authenticated to Log in with Azure Active Directory. This requires that all requests be authenticated, and all unauthenticated requests are redirected to Azure Active Directory for authentication.Click Save.You are now ready to use Azure Active Directory for authentication in your App Service app.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization#more-resources”>Follow the links in the documentation to implement provider specific authorization</a> |
| Azure – Ensure that all communications between Azure and your apps are SSL encrypted | Ensure that all communications between Azure and your apps are SSL encrypted at all times. Note that your apps need to explicitly request a secure connection. This must be implemented in order to avoid potential intermediary attacks If you have not used SSL certificate communication, make sure your apps do not accept other server certificates, as they may not be secure.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site”>Azure App Service SSL Certs</a> |
| Azure – Retry failed operations caused by transient faults | Retry failed operations caused by transient faults. Design a retry strategy for access to all services and resources where they do not inherently support automatic connection retry. Use a strategy that includes an increasing delay between retries as the number of failures increases, to prevent overloading of the resource and to allow it to gracefully recover and handle queued requests. Continual retries with very short delays are likely to exacerbate the problem. For more information, see Retry guidance for specific services.Steps to ImplementThis example in C# illustrates an implementation of the Retry pattern.private int retryCount = 3; private readonly TimeSpan delay = TimeSpan.FromSeconds(5); public async Task OperationWithBasicRetryAsync() { int currentRetry = 0; for (;;) { try { // Call external service. await TransientOperationAsync(); // Return or break. break; } catch (Exception ex) { Trace.TraceError(“Operation Exception”); currentRetry++; // Check if the exception thrown was a transient exception // based on the logic in the error detection strategy. // Determine whether to retry the operation, as well as how // long to wait, based on the retry strategy. if (currentRetry > this.retryCount || !IsTransient(ex)) { // If this isn’t a transient error or we shouldn’t retry, // rethrow the exception. throw; } } // Wait to retry the operation. // Consider calculating an exponential delay here and // using a strategy best suited for the operation and fault. await Task.Delay(delay); } } // Async method that wraps a call to a remote service (details not shown). private async Task TransientOperationAsync() { … } Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/patterns/retry” class=”” rel=”noopener noreferrer”>Retry Pattern</a> |
Azure Storage Account
| Azure – Use SAS or AD for Storage Account Access | If storage account access needs to be given to developers or users, use SAS (Shared access signature) or AD access.A shared access signature (SAS) provides a way to grant limited access to objects in the storage account to other clients, without exposing account key.Authenticating users or applications using Azure AD credentials provides superior security and ease of use over other means of authorization. While you can continue to use Shared Key authorization with your applications, using Azure AD circumvents the need to store your account access key with your code.You can also continue to use shared access signatures (SAS) to grant fine-grained access to resources in your storage account, but Azure AD offers similar capabilities without the need to manage SAS tokens or worry about revoking a compromised SAS.Microsoft recommends using Azure AD authentication for your Azure Storage applications when possible.Steps to ImplementSign in to the Azure portal.If your account gives you access to more than one, select your account in the top right corner, and set your portal session to the desired Azure AD tenant.In the left-hand navigation pane, select the Azure Active Directory service.Select App registrations and then select New application registration.When the Create page appears, enter your application’s registration information.When finished, select Create.Learn More<a href=”https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-add-azure-ad-app”>Register an App with AD</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1″>Use SAS for Storage Access</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad”>Use AD for Storage Access</a> |
| Azure – Reference stored access policies | Reference stored access policies where possible. Stored access policies give you the option to revoke permissions without having to regenerate the storage account keys. Set the expiration on these very far in the future (or infinite) and make sure it’s regularly updated to move it farther into the future.Steps to ImplementTo create or modify a stored access policy, call the Set ACL operation for the resource (i.e., Set Container ACL, Set Queue ACL, Set Table ACL, Set Share ACL) with a request body that specifies the terms of the access policy. The body of the request includes a unique signed identifier of your choosing, up to 64 characters in length, and the optional parameters of the access policy, as follows:<?xml version=”1.0″ encoding=”utf-8″?> <SignedIdentifiers> <SignedIdentifier> <Id>unique-64-char-value</Id> <AccessPolicy> <Start>start-time</Start> <Expiry>expiry-time</Expiry> <Permission>abbreviated-permission-list</Permission> </AccessPolicy> </SignedIdentifier> </SignedIdentifiers> Note: Table entity range restrictions (startpk, startrk, endpk, and endrk) cannot be specified in a stored access policy.A maximum of five access policies may be set on a container, table, or queue at any given time. Each SignedIdentifier field, with its unique Id field, corresponds to one access policy. Attempting to set more than five access policies at one time results in the service returning status code 400 (Bad Request).Learn More<a href=”https://docs.microsoft.com/en-us/rest/api/storageservices/establishing-a-stored-access-policy”>Stored Access Policies</a> |
| Azure – Enable Secure transfer on Storage Accounts | You can configure your storage account to accept requests from secure connections only by setting the Secure transfer required property for the storage account. When you require secure transfer, any requests originating from an insecure connection are rejected. Microsoft recommends that you always require secure transfer for all of your storage accounts.When secure transfer is required, a call to an Azure Storage REST API operation must be made over HTTPS. Any request made over HTTP is rejected.You can turn on the Secure transfer required property when you create a storage account in the Azure portal. You can also enable it for existing storage accounts.For a new storage account:Open the Create storage account pane in the Azure portal.Under Secure transfer required, select EnabledFor an existing storage account:Select an existing storage account in the Azure portal.In the storage account menu pane, under SETTINGS, select Configuration.Under Secure transfer required, select EnabledTo require secure transfer programmatically, set the enableHttpsTrafficOnly property to True on the storage account. You can set this property by using the Storage Resource Provider REST API, client libraries, or tools:<a href=”https://docs.microsoft.com/en-us/rest/api/storagerp/storageaccounts”>REST API</a><a href=”https://docs.microsoft.com/en-us/powershell/module/az.storage/set-azstorageaccount”>PowerShell</a><a href=”https://docs.microsoft.com/en-us/cli/azure/storage/account”>CLI</a><a href=”https://www.npmjs.com/package/azure-arm-storage/”>NodeJS</a><a href=”https://www.nuget.org/packages/Microsoft.Azure.Management.Storage”>.NET SDK</a><a href=”https://pypi.org/project/azure-mgmt-storage”>Python SDK</a><a href=”https://rubygems.org/gems/azure_mgmt_storage”>Ruby SDK</a>More information:<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer#require-secure-transfer-with-powershell”>Require Secure transfer with Powershell</a><a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer#require-secure-transfer-with-azure-cli”>Require Secure transfer with CLI</a> |
| Azure – Be careful with SAS start time and expiry time | Be careful with SAS start time. If you set the start time for a SAS to now, then due to clock skew (differences in current time according to different machines), failures may be observed intermittently for the first few minutes. In general, set the start time to be at least 15 minutes in the past. Or, don’t set it at all, which will make it valid immediately in all cases.The same generally applies to expiry time as well. Expiry time is the time after which the SAS is no longer valid. Best practices recommend that you either specify an expiry time for a SAS, or associate it with a stored access policy. Remember that you may observe up to 15 minutes of clock skew in either direction on any request.Use near-term expiration times on an ad hoc SAS. In this way, even if a SAS is compromised, it’s valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.Steps to ImplementThe account SAS and service SAS tokens include some common parameters.Start time. This is the time at which the SAS becomes valid. The start time for a shared access signature is optional. If a start time is omitted, the SAS is effective immediately. The start time must be expressed in UTC (Coordinated Universal Time), with a special UTC designator (“Z”), for example 1994-11-05T13:15:30Z.Expiry time. This is the time after which the SAS is no longer valid. Best practices recommend that you either specify an expiry time for a SAS, or associate it with a stored access policy. The expiry time must be expressed in UTC (Coordinated Universal Time), with a special UTC designator (“Z”), for example 1994-11-05T13:15:30Z.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#parameters-common-to-account-sas-and-service-sas-tokens”>SAS Parameters</a> |
| Azure – Have clients automatically renew the SAS if necessary | Have clients automatically renew the SAS if necessary. Clients should renew the SAS well before the expiration, in order to allow time for retries if the service providing the SAS is unavailable. If your SAS is meant to be used for a small number of immediate, short-lived operations that are expected to be completed within the expiration period, then this may be unnecessary as the SAS is not expected to be renewed. However, if you have client that is routinely making requests via SAS, then the possibility of expiration comes into play. The key consideration is to balance the need for the SAS to be short-lived (as previously stated) with the need to ensure that the client is requesting renewal early enough (to avoid disruption due to the SAS expiring prior to successful renewal).Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Limit access to services using SAS | A security best practice is to provide a user with the minimum required privileges. If a user only needs read access to a single entity, then grant them read access to that single entity, and not read/write/delete access to all entities. This also helps lessen the damage if a SAS is compromised because the SAS has less power in the hands of an attacker.Understand that your account will be billed for any usage, including that done with SAS. If you provide write access to a blob, a user may choose to upload a 200GB blob. If you’ve given them read access as well, they may choose to download it 10 times, incurring 2 TB in egress costs for you. Again, provide limited permissions to help mitigate the potential actions of malicious users. Use short-lived SAS to reduce this threat (but be mindful of clock skew on the end time).Steps to implement:Navigate to Storage Accounts in the Azure PortalSelect the Storage Account.On the left side menu option select Settings > Shared Access SignatureSelect services you wish to allow access to under “Allowed Services”.Under “Allowed Permissions”, define the permissibility.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Validate data written using SAS | Validate data written using SAS. When a client application writes data to your storage account, keep in mind that there can be problems with that data. If your application requires that data be validated or authorized before it is ready to use, you should perform this validation after the data is written and before it is used by your application. This practice also protects against corrupt or malicious data being written to your account, either by a user who properly acquired the SAS, or by a user exploiting a leaked SAS.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Do not always use SAS | Don’t always use SAS. Sometimes the risks associated with a particular operation against your storage account outweigh the benefits of SAS. For such operations, create a middle-tier service that writes to your storage account after performing business rule validation, authentication, and auditing. Also, sometimes it’s simpler to manage access in other ways. For example, if you want to make all blobs in a container publicly readable, you can make the container Public, rather than providing a SAS to every client for access.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Migrate service to new ARM resources | To benefit from new capabilities in Azure Resource Manager, you can migrate existing deployments from the Classic deployment model. Resource Manager enables security enhancements such as: stronger access control (RBAC), better auditing, ARM-based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management.To migrate Storage Accounts to the new ARM resources:Go to Storage Accounts in the Azure PortalSelect the Storage Account you would like to migrateClick on Migrate to ARM and follow the instructions.To migrate Virtual Machines to the new ARM resources:Go to the Virtual machines (classic) Portal Blade.Click on Migrate to ARM.Click on Validate. If validate failed, use the suggested methods in the error messages or <a href=”https://docs.microsoft.com/azure/virtual-machines/windows/migration-classic-resource-manager-overview?WT.mc_id=Portal-Microsoft_Azure_Security#unsupported-features-and-configurations”>Migration Overview document</a> to fix the errors.Click on Prepare. If prepare failed, use the suggested methods in the error messages or <a href=”https://docs.microsoft.com/azure/virtual-machines/windows/migration-classic-resource-manager-overview?WT.mc_id=Portal-Microsoft_Azure_Security#unsupported-features-and-configurations”>Migration Overview document</a> to fix the errors.(Optional) Click on Abort to rollback migration.Click on Commit. Commit finalizes the migration and cannot be rolled back.Validation CheckEnsure that all VMs are successfully migrated to new ARM resources. |
| Azure – Enable Advanced Threat Protection | Advanced threat protection provides an additional layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit storage accounts. This layer of protection allows you to address threats without being a security expert or managing security monitoring systems. Security alerts are triggered when anomalies in activity occur. These security alerts are integrated with Azure Security Center, and are also sent via email to subscription administrators, with details of suspicious activity and recommendations on how to investigate and remediate threats. The service ingests resource logs of read, write, and delete requests to Blob storage and to Azure Files (preview) for threat detection. To investigate the alerts from advanced threat protection, you can view related storage activity using Storage Analytics Logging. Enable Advanced Threat Protection for:<a href=”https://docs.microsoft.com/en-us/azure/security-center/security-center-wdatp#enable-microsoft-defender-atp-integration”>Azure Virtual Machine</a><a href=”https://docs.microsoft.com/en-us/azure/security-center/advanced-threat-protection-key-vault”>Azure Key Vault</a><a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-advanced-threat-protection?tabs=azure-security-center”>Azure Storage Account</a><a href=”https://docs.microsoft.com/en-us/azure/security-center/defender-for-kubernetes-introduction”>Azure Kubernetes Service</a><a href=”https://docs.microsoft.com/en-us/azure/security-center/threat-protection#threat-protection-for-azure-app-service-“>Azure App Service</a>Validation CheckEnsure that Azure Defender is turned ON and the required Resources are selected. More Information<a href=”https://docs.microsoft.com/en-us/azure/security-center/enable-azure-defender”>Enable Azure Defender</a> |
| Azure – Avoid any single point of failure | Avoid any single point of failure. All components, services, resources, and compute instances should be deployed as multiple instances to prevent a single point of failure from affecting availability. This includes authentication mechanisms. Design the application to be configurable to use multiple instances, and to automatically detect failures and redirect requests to non-failed instances where the platform does not do this automatically.Steps to ImplementCreating a Resource Manager template from scratch is not an easy task, especially if you are new to Azure deployment and your are not familiar with the JSON format. Using the Azure portal, you can configure a resource, for example an Azure Storage account. Before you deploy the resource, you can export your configuration into a Resource Manager template. You can save the template and reuse it in the future.Many experienced template developers use this method to generate working templates when they try to deploy Azure resources that they are not familiar with.Generate a templateSign in to the Azure portal.Select Create a resource > Storage > Storage account – blob, file, table, queue.Enter the following information:Resource group: Select Create new, and specify a resource group name of your choice. On the screenshot, the resource group name is mystorage1016rg. Resource group is a container for Azure resources. Resource group makes it easier to manage Azure resources.Name: Give your storage account a unique name. On the screenshot, the name is mystorage1016.You can use the default values for the rest of the properties.Select Review + create on the bottom of the screen.Select Download a template for automation on the bottom of the screen. The portal shows the generated template:The main pane shows the template. It is a JSON file with six top-level elements – schema, contentVersion, parameters, variables, resources, and output.There are six parameters defined. One of them is called storageAccountName. The second highlighted part on the previous screenshot shows how to reference this parameter in the template. In the next section, you edit the template to use a generated name for the storage account.In the template, one Azure resource is defined. The type is [Microsoft.Storage/storageAccounts]. See how the resource is defined, and the definition structure.Select Download. Save template.json from the downloaded package to your computer.Select the Parameter tab to see the values you provided for the parameters. Write down these values, you need them in the next section when you deploy the template.Using both the template and the parameters files, you can create a resource, in this tutorial, an Azure storage account.Edit and Deploy a TemplateIn the Azure portal, select Create a resource.In Search the Marketplace, type template deployment, and then press ENTER.Select Template deployment.Select Create.Select Build your own template in the editor.Select Load file, and then follow the instructions to load template.json you downloaded in the last section.Add one variable as shown in the following sample:”variables” : { “storageAccountName”: “[concat(uniquestring(resourceGroup().id), ‘standardsa’)] }” Remove the storageAccountName parameter highlighted in the previous screenshot.Update the name element of the Microsoft.Storage/storageAccounts resource to use the newly defined variable instead of the parameter:”name”: “[variables(‘storageAccountName’)]”, Select Save.Configure the rest of the form settings.Select Purchase.Select the bell icon (notifications) from the top of the screen to see the deployment status. You shall see Deployment in progress. Wait until the deployment is completed.Select Go to resource group from the notification pane to see your newly created group.Learn More<a href=”https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-quickstart-create-templates-use-the-portal”>Create Resource Manager Templates – Portal</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-multiple”>Create Multiple Resources</a> |
| Azure – Monitor storage services for unexpected changes in behavior | Azure Storage Analytics performs logging and provides metrics data for an Azure storage account. We recommend that you use this data to trace requests, analyze usage trends, and diagnose issues with your storage account.You should continuously monitor the storage services that your application uses for any unexpected changes in behavior (such as slower response times). Use logging to collect more detailed data and to analyze a problem in depth. The diagnostics information that you obtain from both monitoring and logging helps you to determine the root cause of the issue that your application encountered. Then you can troubleshoot the issue and determine the appropriate steps to remediate it.Steps to ImplementIn the Azure portal, select Storage accounts, then the storage account name to open the account dashboard.Select Diagnostics in the MONITORING section of the menu blade.Select the type of metrics data for each service you wish to monitor, and the retention policy for the data. You can also disable monitoring by setting Status to Off.To set the data retention policy, move the Retention (days) slider or enter the number of days of data to retain, from 1 to 365. The default for new storage accounts is seven days. If you do not want to set a retention policy, enter zero. If there is no retention policy, it is up to you to delete the monitoring data.Warning: You are charged when you manually delete metrics data. Stale analytics data (data older than your retention policy) is deleted by the system at no cost. We recommend setting a retention policy based on how long you want to retain storage analytics data for your account.When you finish the monitoring configuration, select Save.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-monitor-storage-account”>Monitor Storage Accounts</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-metrics-in-azure-monitor”>Storage Metrics</a> |
| Azure – Always use HTTPS for SAS | Always use HTTPS to create or distribute a SAS. If a SAS is passed over HTTP and intercepted, an attacker performing a man-in-the-middle attack is able to read the SAS and then use it just as the intended user could have, potentially compromising sensitive data or allowing for data corruption by the malicious user.Steps to ImplementNavigate to Storage Accounts in the Azure PortalSelect the Storage Account you want to enable HTTPS on SAS for.On the left side menu option select Settings > Shared Access SignatureSelect “HTTPS Only” option in the Allowed Protocols sectionLearn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#parameters-common-to-account-sas-and-service-sas-tokens”>SAS Parameters</a> |
| Azure – Geo-replicate data in Azure Storage | Geo-replicate data in Azure Storage. Data in Azure Storage is automatically replicated within a datacenter. For even higher availability, use Read-access geo-redundant storage (-RAGRS), which replicates your data to a secondary region and provides read-only access to the data in the secondary location. The data is durable even in the case of a complete regional outage or a disaster. For more information, see Azure Storage replication.Steps to ImplementSelect the Create a resource button found on the upper left-hand corner of the Azure portal.Select Storage from the New page.Select Storage account – blob, file, table, queue under Featured.Fill out the storage account form and select Create.Use Replication: Read-access geo-redundant storage (RA-GRS)Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs#read-access-geo-redundant-storage”>Geo-Redundant Storage</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/blobs/storage-create-geo-redundant-storage?tabs=dotnet”>Configure Storage with RAGRS</a> |
Azure Virtual Machine
| Azure – Enable diagnostic logs | Azure Monitor maximizes the availability and performance of your applications and services by delivering a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments. It helps you understand how your applications are performing and proactively identifies issues affecting them and the resources they depend on. All data collected by Azure Monitor fits into one of two fundamental types, metrics and logs. Metrics are numerical values that describe some aspect of a system at a particular point in time. They are lightweight and capable of supporting near real-time scenarios. Logs contain different kinds of data organized into records with different sets of properties for each type. Telemetry such as events and traces are stored as logs in addition to performance data so that it can all be combined for analysis. Azure Monitor can collect data from a variety of sources. You can think of monitoring data for your applications in tiers ranging from your application, any operating system and services it relies on, down to the platform itself. Azure Monitor collects data from each of the following tiers:Application monitoring dataGuest OS monitoring dataAzure resource monitoring dataAzure subscription monitoring dataAzure tenant monitoring dataTo Enable Diagnostic Logs, see the following links:<a href=”https://docs.microsoft.com/en-us/azure/app-service/troubleshoot-diagnostic-logs”>Azure App Services</a><a href=”https://docs.microsoft.com/en-us/azure/batch/batch-diagnostics#batch-diagnostics”>Azure Batch</a><a href=”https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-diagnostic-logs”>Azure Events Hub</a><a href=”https://docs.microsoft.com/en-us/azure/logic-apps/monitor-logic-apps-log-analytics”>Azure Logic App</a><a href=”https://docs.microsoft.com/en-us/azure/search/search-monitor-logs”>Azure Cognitive Search</a><a href=”https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-metrics-azure-monitor”>Azure Service Bus</a><a href=”https://docs.microsoft.com/en-us/azure/data-lake-analytics/data-lake-analytics-diagnostic-logs”>Data Lake Analytics</a><a href=”https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-diagnostic-logs”>Azure Data Lake Store</a><a href=”https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log”>Azure NSG</a> |
| Azure – Disable RDP and SSH access to virtual machines and use JIT access | We recommend that you disable direct RDP and SSH access to your Azure virtual machines from the internet. After direct RDP and SSH access from the internet is disabled, you have other options that you can use to access these VMs for remote management.It’s possible to reach Azure virtual machines by using Remote Desktop Protocol (RDP) and the Secure Shell (SSH) protocol. These protocols enable the management VMs from remote locations and are standard in datacenter computing.The potential security problem with using these protocols over the internet is that attackers can use brute force techniques to gain access to Azure virtual machines. After the attackers gain access, they can use your VM as a launch point for compromising other machines on your virtual network or even attack networked devices outside Azure.Steps to ImplementOpen the Security Center dashboard.In the left pane, select Just-in-time VM access.Configuring a JIT access policyTo select the VMs that you want to enable:Under Just-in-time VM access, select the Recommended tab.Under VIRTUAL MACHINE, select the VMs that you want to enable. This puts a checkmark next to a VM.Select Enable JIT on VMs.This blade displays the default ports recommended by Azure Security Center.You can also configure custom ports. To do this, select Add.In Add port configuration, for each port you choose to configure, both default and custom, you can customize the settings.Select Save.Request JIT access to a VMUnder Just in time VM access, select Configured.Under VMs, check the VMs that you want to enable just-in-time access for.Select Request access.Under Request access, for each VM, configure the ports that you want to open and the source IP addresses that the port is opened on and the time window for which the port will be open. It will only be possible to request access to the ports that are configured in the just-in-time policy. Each port has a maximum allowed time derived from the just-in-time policy.Select Open ports.Validation CheckEnsure just-in-time VM access is Enabled.Learn More<a href=”https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time”>Use JIT for VMs</a> |
| Azure – Install Endpoint Protection Solution on your VM | Azure Security Center provides health assessments of <a href=”https://docs.microsoft.com/en-us/azure/security-center/security-center-services?tabs=features-windows#supported-endpoint-protection-solutions-“>supported</a> versions of Endpoint protection solutions. This article explains the scenarios that lead Security Center to generate the following two recommendations:Install endpoint protection solutions on your virtual machineResolve endpoint protection health issues on your machinesTo install endpoint protection solution for Virtual Machines:On the Azure Portal, navigate to Security CenterOn the left side menu bar, select Recommendations. This will provide a list of security recommendations.Navigate to “Enable Endpoint Protection” menu in the list and expand the options.Select “Install endpoint protection solution on virtual machines” This will open a screen listing out the VMs where Endpoint protection solution is not installed.Select the VMs that you would like to install the endpoint protection solution for and click Install on VMs.Validation CheckEnsure that the Endpoint Protection Solutions are installed on VMs as per Azure Security Center Recommendation |
| Azure – Manage VM updates using Azure Automation | Use the <a href=”https://docs.microsoft.com/en-us/azure/automation/automation-update-management”>Update Management</a> solution in Azure Automation to manage operating system updates for your Windows and Linux computers that are deployed in Azure, in on-premises environments, or in other cloud providers. You can quickly assess the status of available updates on all agent computers and manage the process of installing required updates for servers.Computers that are managed by Update Management use the following configurations to perform assessment and update deployments:Microsoft Monitoring Agent (MMA) for Windows or LinuxPowerShell Desired State Configuration (DSC) for LinuxAutomation Hybrid Runbook WorkerMicrosoft Update or Windows Server Update Services (WSUS) for Windows computersSteps to ImplementOnboard a VM for Update ManagementView an update assessmentConfigure alertingSchedule an update deploymentView the results of a deploymentValidation CheckEnsure that the VMs have latest updates installed via Update Management Solution in Azure Automation.Learn More<a href=”https://docs.microsoft.com/en-us/azure/automation/automation-tutorial-update-management”>How to Manage VM Updates</a> <a href=”https://docs.microsoft.com/en-us/azure/security/azure-security-iaas#manage-your-vm-updates”>Manage VM Updates</a> |
| Azure – Minimize service dependencies | Minimize and understand service dependencies. Minimize the number of different services used where possible, and ensure you understand all of the feature and service dependencies that exist in the system. This includes the nature of these dependencies, and the impact of failure or reduced performance in each one on the overall application.Steps to ImplementIn the Azure portal, click + Create a resource.In the search bar, type Service Map and press Enter.In the marketplace search results page, select Service Map from the list.On the Service Map overview pane, review the solution details and then click Create to begin the onboarding process to your Log Analytics workspace.In the Configure a solution pane, select an existing or create a new Log Analytics workspace. After providing the required information, click Create.Validation CheckEnsure that the Virtual Machine shows up in the Service Map list of the Workspace.Learn More<a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/insights/service-map”>Using Service Map</a> |
| Azure – Remediate vulnerabilities based on recommendations provided by Azure Security Center | The vulnerability scanner included with Azure Security Center is powered by Qualys.When Security Center identifies vulnerabilities, it presents findings and related information as recommendations. The related information includes remediation steps, related CVEs, CVSS scores, and more. You can view the identified vulnerabilities for one or more subscriptions, or for a specific VM.To see the findings and remediate the identified vulnerability:Open Azure Security Center and go to the Recommendations page.Select the recommendation named “Remediate vulnerabilities found on your virtual machines (powered by Qualys)”. Security Center shows you all the findings for all VMs in the currently selected subscriptions. The findings are ordered by severity.To filter the findings by a specific VM, open the “Affected resources” section and click the VM that interests you. Or you can select a VM from the resource health view, and view all relevant recommendations for that resource. Security Center shows the findings for that VM, ordered by severity. To learn more about a specific vulnerability, select it.The details pane that appears contains extensive information about the vulnerability, including: Links to all relevant CVEs (where available), Remediation steps, Any additional reference pages.To remediate a finding, follow the remediation steps from this details pane.Validation CheckEnsure that all the vulnerabilities discovered by a vulnerability assessment solution are remediated.<a href=”https://docs.microsoft.com/en-us/azure/security-center/built-in-vulnerability-assessment#deploying-the-qualys-built-in-vulnerability-scanner”>Deploy the built-in vulnerability scanner</a> |
| Azure – Deploy VM in a subnet, access to which is restricted via NSG | A subnet is a range of IP addresses in the VNet. You can divide a VNet into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one VNet. NICs connected to subnets (same or different) within a VNet can communicate with each other without any extra configuration.By default, there is no security boundary between subnets, so VMs in each of these subnets can talk to one another. However, you can set up Network Security Groups (NSGs), which allow you to control the traffic flow to and from subnets and to and from VMs.<a href=”https://docs.microsoft.com/en-us/azure/virtual-machines/network-overview?toc=/azure/virtual-machines/linux/toc.json&bc=/azure/virtual-machines/linux/breadcrumb/toc.json#virtual-network-and-subnets”>Create a VNet and subnets</a>A network security group (NSG) contains a list of Access Control List (ACL) rules that allow or deny network traffic to subnets, NICs, or both. NSGs can be associated with either subnets or individual NICs connected to a subnet. When an NSG is associated with a subnet, the ACL rules apply to all the VMs in that subnet.NSGs contain two sets of rules: inbound and outbound. The priority for a rule must be unique within each set. Each rule has properties of protocol, source and destination port ranges, address prefixes, direction of traffic, priority, and access type.All NSGs contain a set of default rules. The default rules cannot be deleted, but because they are assigned the lowest priority, they can be overridden by the rules that you create.<a href=”https://docs.microsoft.com/en-us/azure/virtual-machines/network-overview?toc=/azure/virtual-machines/linux/toc.json&bc=/azure/virtual-machines/linux/breadcrumb/toc.json#network-security-groups”>Create a network security group</a>Steps to associate NSG to a subnet:Login to Azure PortalNavigate to Virtual Networks and select the VNet in which your desired subnet isSelect Subnets under Settings sectionSelect the desired subnetSelect a NSG from the drop-down boxClick on Save.Validation CheckEnsure that the subnet in which VM is launched has a NSG associated.<a href=”https://docs.microsoft.com/en-us/azure/virtual-machines/network-overview?toc=/azure/virtual-machines/linux/toc.json&bc=/azure/virtual-machines/linux/breadcrumb/toc.json”>More Information</a> |
| Azure – Always isolate traffic using NSG | You can filter network traffic inbound to and outbound from a virtual network subnet with a network security group. Network security groups contain security rules that filter network traffic by IP address, port, and protocol.Always isolate traffic using NSGs and create private subnets to restrict direct access of servers.You should create your specific “Allow” rules first and then the more generic “Deny” rules last. The assigned priority dictates which rules are evaluated first. Once traffic is found to apply to a specific rule, no further rules are evaluated. NSG rules can apply in either in the inbound or outbound direction (from the perspective of the subnet).Steps to ImplementTo restrict access to your virtual machines:Select a VM to restrict access to.In the ‘Networking’ blade, click the Network Security Group with overly permissive rules.In the ‘Network security group’ blade, click on each of the rules that are overly permissive.Improve the rule by applying less permissive source IP ranges.Apply the suggested changes and click ‘Save’.Validation CheckEnsure that NSG associated with a virtual machine has a rule that restricts Source IP range. Learn More<a href=”https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group#create-a-security-rule”>Create NSG Rules</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm”>Plan Virtual Networks</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic”>Filter Network Traffic</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-dmz-nsg”>Create DMZ with NSGs</a> |
| Azure – Disable split tunneling and configure forced tunneling for VMs | Forced tunneling lets you redirect or “force” all Internet-bound traffic back to your on-premises location via a Site-to-Site VPN tunnel for inspection and auditing. This is a critical security requirement for most enterprise IT policies. Without forced tunneling, Internet-bound traffic from your VMs in Azure always traverses from Azure network infrastructure directly out to the Internet, without the option to allow you to inspect or audit the traffic. Unauthorized Internet access can potentially lead to information disclosure or other types of security breaches.Steps to ImplementCreate a resource group.Create a virtual network and specify subnets.Create the local network gateways.Create the route table and route rule.Associate the route table to the Midtier and Backend subnets.Create the virtual network gateway. This step takes some time to complete, sometimes 45 minutes or more, because you are creating and configuring the gateway. If you see ValidateSet errors regarding the GatewaySKU value, verify that you have installed the <a href=”https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm#before”>latest version of the PowerShell cmdlets</a> . The latest version of the PowerShell cmdlets contains the new validated values for the latest Gateway SKUs.Assign a default site to the virtual network gateway. The -GatewayDefaultSite is the cmdlet parameter that allows the forced routing configuration to work, so take care to configure this setting properly.Establish the Site-to-Site VPN connections.Learn More<a href=”https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm”>VPN Gateway Forced Tunneling</a> |
| Azure – Regularly test all failover and fallback systems | Best Practice RecommendationChanges to systems and operations may affect failover and fallback functions, but the impact may not be detected until the main system fails or becomes overloaded. Test it before it is required to compensate for a live problem at runtime. If you are using Azure Site Recovery to replicate VMs, run disaster recovery drills periodically by doing a test failover.Steps to ImplementIn Site Recovery in the Azure portal, click Recovery Plans > recoveryplan_name > Test Failover.Select a Recovery Point to which to fail over.Select an Azure virtual network in which test VMs will be created.Site Recovery attempts to create test VMs in a subnet with the same name and same IP address as that provided in the Compute and Network settings of the VM.If a subnet with the same name isn’t available in the Azure virtual network used for test failover, then the test VM is created in the first subnet alphabetically.If same IP address isn’t available in the subnet, then the VM receives another available IP address in the subnet.If you’re failing over to Azure and data encryption is enabled, in Encryption Key, select the certificate that was issued when you enabled encryption during Provider installation. You can ignore this step encryption isn’t enabled.Track failover progress on the Jobs tab. You should be able to see the test replica machine in the Azure portal.To initiate an RDP connection to the Azure VM, you need to add a public IP address on the network interface of the failed over VM.When everything is working as expected, click Cleanup test failover. This deletes the VMs that were created during test failover.In Notes, record and save any observations associated with the test failover.When a test failover is triggered, the following occurs:Prerequisites: A prerequisites check runs to make sure that all conditions required for failover are met.Failover: The failover processes and prepared the data, so that an Azure VM can be created from it.Latest: If you have chosen the latest recovery point, a recovery point is created from the data that’s been sent to the service.Start: This step creates an Azure virtual machine using the data processed in the previous step.Learn More<a href=”https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-test-failover-to-azure”>Disaster Recovery Drill</a> |
| Azure – Monitor VM performance | Azure Monitor for VMs includes a set of performance charts that target several key performance indicators (KPIs) to help you determine how well a virtual machine is performing. The charts show resource utilization over a period of time so you can identify bottlenecks, anomalies, or switch to a perspective listing each machine to view resource utilization based on the metric selected.Resource abuse can be a problem when VM processes consume more resources than they should. Performance issues with a VM can lead to service disruption, which violates the security principle of availability. This is particularly important for VMs that are hosting IIS or other web servers, because high CPU or memory usage might indicate a denial of service (DoS) attack.Steps to ImplementTo enable monitoring of your Azure VM in the Azure portal, do the following:Sign in to the Azure portal.Select Virtual Machines.From the list, select a VM.On the VM page, in the Monitoring section, select Insights (preview).On the Insights (preview) page, select Try now.On the Azure Monitor Insights Onboarding page, if you have an existing Log Analytics workspace in the same subscription, select it in the drop-down list. The list preselects the default workspace and location that the virtual machine is deployed to in the subscription.After you’ve enabled monitoring, it might take about 10 minutes before you can view the health metrics for the virtual machine.Monitoring VM performanceIn the Azure portal, select Monitor.Choose Virtual Machines (preview) in the Solutions section.Select the Performance tab.Validation CheckEnsure that a Log Analytic Agent extension is installed on the Virtual Machine.Learn More<a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-onboard”>Deploy Azure Monitor for VMs</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-performance”>Monitor VM performance</a> |
Azure File Storage
| Azure – Always Enable Storage account Encryption | Always Enable Storage account Encryption which keeps the data at rest Encrypted.Azure Storage Service Encryption for data at rest helps you protect your data to meet your organizational security and compliance commitments. With this feature, the Azure storage platform automatically encrypts your data before persisting it to Azure Managed Disks, Azure Blob, Queue, or Table storage, or Azure Files, and decrypts the data before retrieval. The handling of encryption, encryption at rest, decryption, and key management in Storage Service Encryption is transparent to users. All data written to the Azure storage platform is encrypted through 256-bit AES encryption, one of the strongest block ciphers available.Steps to ImplementTo view settings for Storage Service Encryption, sign in to the Azure portal and select a storage account. In the SETTINGS pane, select the Encryption setting.Storage Service EncryptionStorage Service Encryption is enabled for all new and existing storage accounts and cannot be disabled. Because your data is secured by default, you don’t need to modify your code or applications to take advantage of Storage Service Encryption.Blob and File StorageSSE for Azure Blob storage and Azure Files is integrated with Azure Key Vault, so that you can use a key vault to manage your encryption keys. You can create your own encryption keys and store them in a key vault, or you can use Azure Key Vault’s APIs to generate encryption keys. With Azure Key Vault, you can manage and control your keys and also audit your key usage.Create a storage accountEnable SSE for Blob and File storageEnable encryption with customer-managed keysSelect your keyCopy data to storage accountQuery the status of the encrypted dataLearn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption”>Storage Service Encryption</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption-customer-managed-keys”>Encryption with Customer Keys</a> |
| Azure – Reference stored access policies | Reference stored access policies where possible. Stored access policies give you the option to revoke permissions without having to regenerate the storage account keys. Set the expiration on these very far in the future (or infinite) and make sure it’s regularly updated to move it farther into the future.Steps to ImplementTo create or modify a stored access policy, call the Set ACL operation for the resource (i.e., Set Container ACL, Set Queue ACL, Set Table ACL, Set Share ACL) with a request body that specifies the terms of the access policy. The body of the request includes a unique signed identifier of your choosing, up to 64 characters in length, and the optional parameters of the access policy, as follows:<?xml version=”1.0″ encoding=”utf-8″?> <SignedIdentifiers> <SignedIdentifier> <Id>unique-64-char-value</Id> <AccessPolicy> <Start>start-time</Start> <Expiry>expiry-time</Expiry> <Permission>abbreviated-permission-list</Permission> </AccessPolicy> </SignedIdentifier> </SignedIdentifiers> Note: Table entity range restrictions (startpk, startrk, endpk, and endrk) cannot be specified in a stored access policy.A maximum of five access policies may be set on a container, table, or queue at any given time. Each SignedIdentifier field, with its unique Id field, corresponds to one access policy. Attempting to set more than five access policies at one time results in the service returning status code 400 (Bad Request).Learn More<a href=”https://docs.microsoft.com/en-us/rest/api/storageservices/establishing-a-stored-access-policy”>Stored Access Policies</a> |
| Azure – Be careful with SAS start time and expiry time | Be careful with SAS start time. If you set the start time for a SAS to now, then due to clock skew (differences in current time according to different machines), failures may be observed intermittently for the first few minutes. In general, set the start time to be at least 15 minutes in the past. Or, don’t set it at all, which will make it valid immediately in all cases.The same generally applies to expiry time as well. Expiry time is the time after which the SAS is no longer valid. Best practices recommend that you either specify an expiry time for a SAS, or associate it with a stored access policy. Remember that you may observe up to 15 minutes of clock skew in either direction on any request.Use near-term expiration times on an ad hoc SAS. In this way, even if a SAS is compromised, it’s valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.Steps to ImplementThe account SAS and service SAS tokens include some common parameters.Start time. This is the time at which the SAS becomes valid. The start time for a shared access signature is optional. If a start time is omitted, the SAS is effective immediately. The start time must be expressed in UTC (Coordinated Universal Time), with a special UTC designator (“Z”), for example 1994-11-05T13:15:30Z.Expiry time. This is the time after which the SAS is no longer valid. Best practices recommend that you either specify an expiry time for a SAS, or associate it with a stored access policy. The expiry time must be expressed in UTC (Coordinated Universal Time), with a special UTC designator (“Z”), for example 1994-11-05T13:15:30Z.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#parameters-common-to-account-sas-and-service-sas-tokens”>SAS Parameters</a> |
| Azure – Have clients automatically renew the SAS if necessary | Have clients automatically renew the SAS if necessary. Clients should renew the SAS well before the expiration, in order to allow time for retries if the service providing the SAS is unavailable. If your SAS is meant to be used for a small number of immediate, short-lived operations that are expected to be completed within the expiration period, then this may be unnecessary as the SAS is not expected to be renewed. However, if you have client that is routinely making requests via SAS, then the possibility of expiration comes into play. The key consideration is to balance the need for the SAS to be short-lived (as previously stated) with the need to ensure that the client is requesting renewal early enough (to avoid disruption due to the SAS expiring prior to successful renewal).Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Limit access to services using SAS | A security best practice is to provide a user with the minimum required privileges. If a user only needs read access to a single entity, then grant them read access to that single entity, and not read/write/delete access to all entities. This also helps lessen the damage if a SAS is compromised because the SAS has less power in the hands of an attacker.Understand that your account will be billed for any usage, including that done with SAS. If you provide write access to a blob, a user may choose to upload a 200GB blob. If you’ve given them read access as well, they may choose to download it 10 times, incurring 2 TB in egress costs for you. Again, provide limited permissions to help mitigate the potential actions of malicious users. Use short-lived SAS to reduce this threat (but be mindful of clock skew on the end time).Steps to implement:Navigate to Storage Accounts in the Azure PortalSelect the Storage Account.On the left side menu option select Settings > Shared Access SignatureSelect services you wish to allow access to under “Allowed Services”.Under “Allowed Permissions”, define the permissibility.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Validate data written using SAS | Validate data written using SAS. When a client application writes data to your storage account, keep in mind that there can be problems with that data. If your application requires that data be validated or authorized before it is ready to use, you should perform this validation after the data is written and before it is used by your application. This practice also protects against corrupt or malicious data being written to your account, either by a user who properly acquired the SAS, or by a user exploiting a leaked SAS.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Do not always use SAS | Don’t always use SAS. Sometimes the risks associated with a particular operation against your storage account outweigh the benefits of SAS. For such operations, create a middle-tier service that writes to your storage account after performing business rule validation, authentication, and auditing. Also, sometimes it’s simpler to manage access in other ways. For example, if you want to make all blobs in a container publicly readable, you can make the container Public, rather than providing a SAS to every client for access.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Avoid any single point of failure | Avoid any single point of failure. All components, services, resources, and compute instances should be deployed as multiple instances to prevent a single point of failure from affecting availability. This includes authentication mechanisms. Design the application to be configurable to use multiple instances, and to automatically detect failures and redirect requests to non-failed instances where the platform does not do this automatically.Steps to ImplementCreating a Resource Manager template from scratch is not an easy task, especially if you are new to Azure deployment and your are not familiar with the JSON format. Using the Azure portal, you can configure a resource, for example an Azure Storage account. Before you deploy the resource, you can export your configuration into a Resource Manager template. You can save the template and reuse it in the future.Many experienced template developers use this method to generate working templates when they try to deploy Azure resources that they are not familiar with.Generate a templateSign in to the Azure portal.Select Create a resource > Storage > Storage account – blob, file, table, queue.Enter the following information:Resource group: Select Create new, and specify a resource group name of your choice. On the screenshot, the resource group name is mystorage1016rg. Resource group is a container for Azure resources. Resource group makes it easier to manage Azure resources.Name: Give your storage account a unique name. On the screenshot, the name is mystorage1016.You can use the default values for the rest of the properties.Select Review + create on the bottom of the screen.Select Download a template for automation on the bottom of the screen. The portal shows the generated template:The main pane shows the template. It is a JSON file with six top-level elements – schema, contentVersion, parameters, variables, resources, and output.There are six parameters defined. One of them is called storageAccountName. The second highlighted part on the previous screenshot shows how to reference this parameter in the template. In the next section, you edit the template to use a generated name for the storage account.In the template, one Azure resource is defined. The type is [Microsoft.Storage/storageAccounts]. See how the resource is defined, and the definition structure.Select Download. Save template.json from the downloaded package to your computer.Select the Parameter tab to see the values you provided for the parameters. Write down these values, you need them in the next section when you deploy the template.Using both the template and the parameters files, you can create a resource, in this tutorial, an Azure storage account.Edit and Deploy a TemplateIn the Azure portal, select Create a resource.In Search the Marketplace, type template deployment, and then press ENTER.Select Template deployment.Select Create.Select Build your own template in the editor.Select Load file, and then follow the instructions to load template.json you downloaded in the last section.Add one variable as shown in the following sample:”variables” : { “storageAccountName”: “[concat(uniquestring(resourceGroup().id), ‘standardsa’)] }” Remove the storageAccountName parameter highlighted in the previous screenshot.Update the name element of the Microsoft.Storage/storageAccounts resource to use the newly defined variable instead of the parameter:”name”: “[variables(‘storageAccountName’)]”, Select Save.Configure the rest of the form settings.Select Purchase.Select the bell icon (notifications) from the top of the screen to see the deployment status. You shall see Deployment in progress. Wait until the deployment is completed.Select Go to resource group from the notification pane to see your newly created group.Learn More<a href=”https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-quickstart-create-templates-use-the-portal”>Create Resource Manager Templates – Portal</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-multiple”>Create Multiple Resources</a> |
| Azure – Use periodic backup and point-in-time restore | Use periodic backup and point-in-time restore. Regularly and automatically back up data that is not preserved elsewhere, and verify you can reliably restore both the data and the application itself should a failure occur. Ensure that backups meet your Recovery Point Objective (RPO). Data replication is not a backup feature, because human error or malicious operations can corrupt data across all the replicas. The backup process must be secure to protect the data in transit and in storage. Databases or parts of a data store can usually be recovered to a previous point in time by using transaction logs.Steps to ImplementVMs<a href=”https://docs.microsoft.com/en-us/azure/backup/tutorial-backup-vm-at-scale”>Backup Virtual Machines</a> Storage<a href=”https://docs.microsoft.com/en-us/rest/api/storageservices/creating-a-snapshot-of-a-blob”>Blob Storage Snapshots</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/files/storage-snapshots-files”>File Storage Snapshots</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy”>Table Storage Transfer with AzCopy</a> Databases<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-recovery-using-backups”>Restoring Database Backups</a> <a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/online-backup-and-restore”>Cosmos DB Auto Backup</a> Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/resiliency/recovery-data-corruption”>Recover from Data Corruption</a> |
| Azure – Monitor storage services for unexpected changes in behavior | Azure Storage Analytics performs logging and provides metrics data for an Azure storage account. We recommend that you use this data to trace requests, analyze usage trends, and diagnose issues with your storage account.You should continuously monitor the storage services that your application uses for any unexpected changes in behavior (such as slower response times). Use logging to collect more detailed data and to analyze a problem in depth. The diagnostics information that you obtain from both monitoring and logging helps you to determine the root cause of the issue that your application encountered. Then you can troubleshoot the issue and determine the appropriate steps to remediate it.Steps to ImplementIn the Azure portal, select Storage accounts, then the storage account name to open the account dashboard.Select Diagnostics in the MONITORING section of the menu blade.Select the type of metrics data for each service you wish to monitor, and the retention policy for the data. You can also disable monitoring by setting Status to Off.To set the data retention policy, move the Retention (days) slider or enter the number of days of data to retain, from 1 to 365. The default for new storage accounts is seven days. If you do not want to set a retention policy, enter zero. If there is no retention policy, it is up to you to delete the monitoring data.Warning: You are charged when you manually delete metrics data. Stale analytics data (data older than your retention policy) is deleted by the system at no cost. We recommend setting a retention policy based on how long you want to retain storage analytics data for your account.When you finish the monitoring configuration, select Save.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-monitor-storage-account”>Monitor Storage Accounts</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-metrics-in-azure-monitor”>Storage Metrics</a> |
| Azure – Always use HTTPS for SAS | Always use HTTPS to create or distribute a SAS. If a SAS is passed over HTTP and intercepted, an attacker performing a man-in-the-middle attack is able to read the SAS and then use it just as the intended user could have, potentially compromising sensitive data or allowing for data corruption by the malicious user.Steps to ImplementNavigate to Storage Accounts in the Azure PortalSelect the Storage Account you want to enable HTTPS on SAS for.On the left side menu option select Settings > Shared Access SignatureSelect “HTTPS Only” option in the Allowed Protocols sectionLearn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#parameters-common-to-account-sas-and-service-sas-tokens”>SAS Parameters</a> |
| Azure – Geo-replicate data in Azure Storage | Geo-replicate data in Azure Storage. Data in Azure Storage is automatically replicated within a datacenter. For even higher availability, use Read-access geo-redundant storage (-RAGRS), which replicates your data to a secondary region and provides read-only access to the data in the secondary location. The data is durable even in the case of a complete regional outage or a disaster. For more information, see Azure Storage replication.Steps to ImplementSelect the Create a resource button found on the upper left-hand corner of the Azure portal.Select Storage from the New page.Select Storage account – blob, file, table, queue under Featured.Fill out the storage account form and select Create.Use Replication: Read-access geo-redundant storage (RA-GRS)Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs#read-access-geo-redundant-storage”>Geo-Redundant Storage</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/blobs/storage-create-geo-redundant-storage?tabs=dotnet”>Configure Storage with RAGRS</a> |
Azure cosmos DB
| Azure – Use Resource Tokens for giving access to Cosmos DB Resources | Azure Cosmos DB uses two types of keys to authenticate users and provide access to its data and resources: Master Keys and Resource Tokens.Always use Resource Tokens for giving access to collections, partition keys, documents, attachments, stored procedures, triggers, and UDFs.Don’t share Master Keys for giving access because it can control all the resources for the database account.Learn More<a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/secure-access-to-data#resource-tokens-“>Cosmos DB Security</a> |
| Azure – Use Virtual Network Service Endpoints | Use virtual network service endpoints to extend your virtual network private address space, and the identity of your virtual network to the Azure services, over a direct connection. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Traffic from your virtual network to the Azure service always remains on the Microsoft Azure backbone network.The overview below is a guidance on how to enable an endpoint and restrict access to the subnet. To restrict network access to a specific resource, please follow the documentation links provided in the Resources section below.Enable a Service Endpoint:Service endpoints are enabled per service, per subnet. Create a subnet and enable a service endpoint for the subnet.In the Search resources, services, and docs box at the top of the portal, enter the name of your Virtual NetworkAdd a subnet to the virtual network. Under SETTINGS, select Subnets, and then select + SubnetUnder Add subnet, select or enter the following information, and then select OK: Name; Address; Service endpointsRestrict network access to a resourceThe steps necessary to restrict network access to resources created through Azure services enabled for service endpoints varies across services. For ComplianceAzure Virtual Network:Check if at least 1 service endpoint exists in the subnets of the virtual network.Resources:Virtual Network service endpoints are available on the following services:<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?toc=/azure/virtual-network/toc.json#grant-access-from-a-virtual-network”>Azure Storage</a><a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/virtual-network/toc.json”>Azure SQL Database</a><a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/virtual-network/toc.json”>Azure SQL Data Warehouse</a><a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-manage-vnet-using-portal?toc=/azure/virtual-network/toc.json”><b>Azure Database for PostgreSQL Server</b></a><a href=”https://docs.microsoft.com/en-us/azure/mysql/howto-manage-vnet-using-portal?toc=/azure/virtual-network/toc.json”>Azure Database for MySQL Server</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/concepts-data-access-security-vnet”>Azure Database for MariaDB</a><a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/vnet-service-endpoint?toc=/azure/virtual-network/toc.json”>Azure CosmosDB</a><a href=”https://docs.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints”>Azure Key Vault</a><a href=”https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-service-endpoints?toc=/azure/virtual-network/toc.json”>Azure Service Bus</a><a href=”https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-service-endpoints?toc=/azure/virtual-network/toc.json”>Azure Event Hubs</a><a href=”https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-network-security?toc=/azure/virtual-network/toc.json”>Azure Data Lake Storage Gen 1</a><a href=”https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions”>Azure App Service</a> |
| Azure – Geo-replicate databases | Geo-replication enables you to configure secondary database replicas in other regions. Secondary databases are available for querying and for failover in the case of a data center outage or the inability to connect to the primary database. For Azure SQL Databases:Active geo-replication is an Azure SQL Database feature that allows you to create readable secondary databases of individual databases on a server in the same or different data center (region).If geo-replication is enabled, the application can initiate failover to a secondary database in a different Azure region. Up to four secondaries are supported in the same or different regions, and the secondaries can also be used for read-only access queries. The failover must be initiated manually by the application or the user. After failover, the new primary has a different connection end point.Steps to Implement:In the Azure portal, browse to the database that you want to set up for geo-replication.On the SQL database page, select geo-replication, and then select the region to create the secondary database. You can select any region other than the region hosting the primary database, but we recommend the paired region.Select or configure the server and pricing tier for the secondary database.Optionally, you can add a secondary database to an elastic pool. To create the secondary database in a pool, click elastic pool and select a pool on the target server. A pool must already exist on the target server. This workflow does not create a pool.Click Create to add the secondary.The secondary database is created and the seeding process begins.When the seeding process is complete, the secondary database displays its status.Initiate a failoverThe secondary database can be switched to become the primary.In the Azure portal, browse to the primary database in the geo-replication partnership.On the SQL Database blade, select All settings > geo-replication.In the SECONDARIES list, select the database you want to become the new primary and click Failover.Click Yes to begin the failover.The command immediately switches the secondary database into the primary role.For Cosmos DB:Azure Cosmos DB is a globally distributed database service that’s designed to provide low latency, elastic scalability of throughput, well-defined semantics for data consistency, and high availability. In short, if your application needs guaranteed fast response time anywhere in the world, if it’s required to be always online, and needs unlimited and elastic scalability of throughput and storage, you should build your application on Azure Cosmos DB.You can configure your databases to be globally distributed and available in any of the Azure regions. To lower the latency, place the data close to where your users are. Choosing the required regions depends on the global reach of your application and where your users are located. Cosmos DB transparently replicates the data to all the regions associated with your Cosmos account. It provides a single system image of your globally distributed Azure Cosmos database and containers that your application can read and write to locally.<a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-multi-master?tabs=api-async”>CosmosDB Global Distribution</a>For PostgreSQL:Azure Database for PostgreSQL provides business continuity features that include automated backups and the ability for users to initiate geo-restore. Each has different characteristics for Estimated Recovery Time (ERT) and potential data loss. The geo-restore feature restores the server using geo-redundant backups. The backups are hosted in your server’s paired region. You can restore from these backups to any other region. The geo-restore creates a new server with the data from the backups.You can use cross region read replicas to enhance your business continuity and disaster recovery planning. Read replicas are updated asynchronously using PostgreSQL’s physical replication technology.To Create and Manage Read Replicas:<a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-read-replicas-portal#prepare-the-master-server”>Prepare the master server</a><a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-read-replicas-portal#create-a-read-replica”>Create a read replica</a><a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-read-replicas-portal#monitor-a-replica”>Monitor a replica</a>For MariaDb:The read replica feature allows you to replicate data from an Azure Database for MariaDB server to a read-only server. You can replicate from the master server to up to five replicas. Replicas are updated asynchronously using the MariaDB engine’s binary log (binlog) file position-based replication technology with global transaction ID (GTID).You can create a read replica in a different region from your master server. Cross-region replication can be helpful for scenarios like disaster recovery planning or bringing data closer to your users.You can have a master server in any Azure Database for MariaDB region. A master server can have a replica in its paired region or the universal replica regions.Configure Data-in Replication in Azure Database for MariaDB:<a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#create-a-mariadb-server-to-use-as-a-replica”>Create a MariaDB server to use as a replica</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#configure-the-master-server”>Configure the master server</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#dump-and-restore-the-master-server”>Dump and restore the master server</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#link-the-master-and-replica-servers-to-start-data-in-replication”>Link the master and replica servers to start Data-in Replication</a>Create and manage read replicas in Azure Database for MariaDB:<a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-read-replicas-portal#create-a-read-replica”>Create a read replica</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-read-replicas-portal#monitor-replication”>Monitor replication</a>Learn More<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-active-geo-replication-portal”>Geo-replicate Database</a> <a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auto-failover-group”>Auto Failover Groups</a> |
| Azure – Use optimistic concurrency and eventual consistency | Use optimistic concurrency and eventual consistency. Transactions that block access to resources through locking (pessimistic concurrency) can cause poor performance and considerably reduce availability. These problems can become especially acute in distributed systems. In many cases, careful design and techniques such as partitioning can minimize the chances of conflicting updates occurring. Where data is replicated, or is read from a separately updated store, the data will only be eventually consistent. But the advantages usually far outweigh the impact on availability of using transactions to ensure immediate consistency.Steps to ImplementThere are several techniques for testing for an optimistic concurrency violation.One involves including a timestamp column in the table.Using this technique, a timestamp column is included in the table definition.Whenever the record is updated, the timestamp is updated to reflect the current date and time. In a test for optimistic concurrency violations, the timestamp column is returned with any query of the contents of the table.When an update is attempted, the timestamp value in the database is compared to the original timestamp value contained in the modified row.If they match, the update is performed and the timestamp column is updated with the current time to reflect the update.If they do not match, an optimistic concurrency violation has occurred.Another technique for testing for an optimistic concurrency violation is to verify that all the original column values in a row still match those found in the database.Learn More<a href=”https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/optimistic-concurrency”>Optimistic Concurrency</a> |
Azure sql db
| Azure – Always have Row-level security | Always have Row-level security (RLS) to restrict data access for given users.Use AAD (Azure Active directory) to secure all the resources with a common set of users and groups.Row-Level Security enables customers to control access to rows in a database table based on the characteristics of the user executing a query (for example, group membership or execution context).Row-Level Security (RLS) simplifies the design and coding of security in your application. RLS helps you implement restrictions on data row access. For example, you can ensure that workers access only those data rows that are pertinent to their department, or restrict customers’ data access to only the data relevant to their company.The access restriction logic is located in the database tier rather than away from the data in another application tier. The database system applies the access restrictions every time that data access is attempted from any tier. This makes your security system more reliable and robust by reducing the surface area of your security system.Best PracticesIt is highly recommended to create a separate schema for the RLS objects (predicate function and security policy).The ALTER ANY SECURITY POLICY permission is intended for highly privileged users (such as a security policy manager). The security policy manager doesn’t require SELECT permission on the tables they protect.Avoid type conversions in predicate functions to avoid potential runtime errors.Avoid recursion in predicate functions wherever possible to avoid performance degradation. The query optimizer will try to detect direct recursions, but is not guaranteed to find indirect recursions (that is, where a second function calls the predicate function).Avoid using excessive table joins in predicate functions to maximize performance.Avoid predicate logic that depends on session-specific SET options: While unlikely to be used in practical applications, predicate functions whose logic depends on certain session-specific SET options can leak information if users are able to execute arbitrary queries. For example, a predicate function that implicitly converts a string to datetime could filter different rows based on the SET DATEFORMAT option for the current session. In general, predicate functions should abide by the following rules:Predicate functions should not implicitly convert character strings to date, smalldatetime, datetime, datetime2, or datetimeoffset, or vice versa, because these conversions are affected by the SET DATEFORMAT (Transact-SQL) and SET LANGUAGE (Transact-SQL) options. Instead, use the CONVERT function and explicitly specify the style parameter.Predicate functions should not rely on the value of the first day of the week, because this value is affected by the SET DATEFIRST (Transact-SQL) option.Predicate functions should not rely on arithmetic or aggregation expressions returning NULL in case of error (such as overflow or divide-by-zero), because this behavior is affected by the SET ANSI_WARNINGS (Transact-SQL), SET NUMERIC_ROUNDABORT (Transact-SQL), and SET ARITHABORT (Transact-SQL) options.Predicate functions should not compare concatenated strings with NULL, because this behavior is affected by the SET CONCAT_NULL_YIELDS_NULL (Transact-SQL) option.Learn More<a href=”https://docs.microsoft.com/en-us/sql/relational-databases/security/row-level-security?view=sql-server-2017″>Database Row Level Security</a> <a href=”https://docs.microsoft.com/en-us/power-bi/service-admin-rls”>Power BI Row Level Security</a> |
| Azure – Enable database auditing | Auditing an instance of the database engine or an individual database involves tracking and logging events. You can create audits that contain specifications for server-level events and specifications for database-level events. Audited events can be written to the event logs or to audit files.For SQL Servers and DatabaseThere are several levels of auditing for SQL Server, depending on government or standards requirements for your installation. SQL Server auditing provides tools and processes for enabling, storing, and viewing audits on various server and database objects.Steps to ImplementSet up auditing for your databaseGo to the Azure portal.Navigate to Auditing under the Security heading in your SQL database/server pane.If you prefer to set up a server auditing policy, you can select the View server settings link on the database auditing page. You can then view or modify the server auditing settings. Server auditing policies apply to all existing and newly created databases on this server.If you prefer to enable auditing on the database level, switch Auditing to ON.New – You now have multiple options for configuring where audit logs will be written. You can write logs to an Azure storage account, to a Log Analytics workspace for consumption by Log Analytics, or to event hub for consumption using event hub. You can configure any combination of these options, and audit logs will be written to each.To configure writing audit logs to a storage account, select Storage and open Storage details. Select the Azure storage account where logs will be saved, and then select the retention period. The old logs will be deleted. Then click OK.To configure writing audit logs to a Log Analytics workspace, select Log Analytics (Preview) and open Log Analytics details. Select or create the Log Analytics workspace where logs will be written and then click OK.To configure writing audit logs to an event hub, select Event Hub (Preview) and open Event Hub details. Select the event hub where logs will be written and then click OK. Be sure that the event hub is in the same region as your database and server.Click Save.For PostgreSQLAudit logging of database activities in Azure Database for PostgreSQL – Single Server is available through the PostgreSQL Audit Extension: <a href=”https://www.pgaudit.org/”>pgAudit</a>. pgAudit provides detailed session and/or object audit logging.To install pgAudit, you need to include it in the server’s shared preload libraries. A change to Postgres’s shared_preload_libraries parameter requires a server restart to take effect. You can change parameters using the Azure portal, Azure CLI, or REST API.Using the Azure portal:Select your Azure Database for PostgreSQL server.On the sidebar, select Server Parameters.Search for the shared_preload_libraries parameter.Select pgaudit.Restart the server to apply the change.Connect to your server using a client (like psql) and enable the pgAudit extensionCREATE EXTENSION pgaudit;Once you have installed pgAudit, you can configure its parameters to start logging. The <a href=”https://github.com/pgaudit/pgaudit/blob/master/README.md#settings”><b>pgAudit documentation</b></a> provides the definition of each parameter. Test the parameters first and confirm that you are getting the expected behavior.To view the audit logs:If you are using .log files, your audit logs will be included in the same file as your PostgreSQL error logs. You can download log files from the <a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-logs-in-portal”>Azure portal</a> or <a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-logs-using-cli”>CLI</a>; OrIf you’re using Resource Logging, depending on the endpoint you use:Send <a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/platform/resource-logs#send-to-azure-storage”>resource logs to Azure Storage</a>; Send <a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/platform/resource-logs#send-to-azure-event-hubs”>resource logs to Events Hub</a>For MariaDB/ MySQL Database:By default the audit log is disabled. To enable it, set audit_log_enabled to ON.Enable audit logs for MariaDB/ MySQL using the Azure portal:Select your Azure Database (MySQL/ MariaDB).Under the Settings section in the sidebar, select Server parameters.Update the audit_log_enabled parameter to ON.Select the event types to be logged by updating the audit_log_events parameter:<a href=”https://docs.microsoft.com/en-us/azure/mariadb/concepts-audit-logs#configure-audit-logging”>Event types for MariaDB</a><a href=”https://docs.microsoft.com/en-us/azure/mysql/concepts-audit-logs#configure-audit-logging”>Event types for MySQL</a>Add any users to be excluded from logging by updating the audit_log_exclude_users parameter. Specify users by providing their user name.Once you have changed the parameters, you can click Save.Setup Diagnostic Logs to access audit logs:Under the Monitoring section in the sidebar, select Diagnostic settings.Click on “+ Add diagnostic setting”Provide a diagnostic setting name.Specify which data sinks to send the audit logs (storage account, event hub, and/or Log Analytics workspace).Select “MySqlAuditLogs” as the log type.Once you’ve configured the data sinks to pipe the audit logs to, you can click Save.Access the audit logs by exploring them in the data sinks you configured. It may take up to 10 minutes for the logs to appear.Learn More<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing”>Database Auditing</a> |
| Azure – Use Virtual Network Service Endpoints | Use virtual network service endpoints to extend your virtual network private address space, and the identity of your virtual network to the Azure services, over a direct connection. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Traffic from your virtual network to the Azure service always remains on the Microsoft Azure backbone network.The overview below is a guidance on how to enable an endpoint and restrict access to the subnet. To restrict network access to a specific resource, please follow the documentation links provided in the Resources section below.Enable a Service Endpoint:Service endpoints are enabled per service, per subnet. Create a subnet and enable a service endpoint for the subnet.In the Search resources, services, and docs box at the top of the portal, enter the name of your Virtual NetworkAdd a subnet to the virtual network. Under SETTINGS, select Subnets, and then select + SubnetUnder Add subnet, select or enter the following information, and then select OK: Name; Address; Service endpointsRestrict network access to a resourceThe steps necessary to restrict network access to resources created through Azure services enabled for service endpoints varies across services. For ComplianceAzure Virtual Network:Check if at least 1 service endpoint exists in the subnets of the virtual network.Resources:Virtual Network service endpoints are available on the following services:<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?toc=/azure/virtual-network/toc.json#grant-access-from-a-virtual-network”>Azure Storage</a><a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/virtual-network/toc.json”>Azure SQL Database</a><a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/vnet-service-endpoint-rule-overview?toc=/azure/virtual-network/toc.json”>Azure SQL Data Warehouse</a><a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-manage-vnet-using-portal?toc=/azure/virtual-network/toc.json”><b>Azure Database for PostgreSQL Server</b></a><a href=”https://docs.microsoft.com/en-us/azure/mysql/howto-manage-vnet-using-portal?toc=/azure/virtual-network/toc.json”>Azure Database for MySQL Server</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/concepts-data-access-security-vnet”>Azure Database for MariaDB</a><a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/vnet-service-endpoint?toc=/azure/virtual-network/toc.json”>Azure CosmosDB</a><a href=”https://docs.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints”>Azure Key Vault</a><a href=”https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-service-endpoints?toc=/azure/virtual-network/toc.json”>Azure Service Bus</a><a href=”https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-service-endpoints?toc=/azure/virtual-network/toc.json”>Azure Event Hubs</a><a href=”https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-network-security?toc=/azure/virtual-network/toc.json”>Azure Data Lake Storage Gen 1</a><a href=”https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions”>Azure App Service</a> |
| Azure – Ensure that Azure Active Directory Admin is configured | Use Azure Active Directory Authentication for authentication with SQL Database.Azure Active Directory authentication is a mechanism to connect to Microsoft Azure SQL Database and SQL Data Warehouse using identities in Azure Active Directory (Azure AD). With Azure AD authentication, identities of database users and other Microsoft services can be managed in one central location. Central ID management provides a single place to manage database users and simplifies permission management.It provides an alternative to SQL Server authentication.Helps stop the proliferation of user identities across database servers.Allows password rotation in a single place.Customers can manage database permissions using external (AAD) groups.It can eliminate storing passwords by enabling integrated Windows authentication and other forms of authentication supported by Azure Active Directory.Azure AD authentication uses contained database users to authenticate identities at the database level.Azure AD supports token-based authentication for applications connecting to SQL Database.Azure AD authentication supports ADFS (domain federation) or native user/password authentication for a local Azure Active Directory without domain synchronization.Azure AD supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options — phone call, text message, smart cards with pin, or mobile app notification.Steps to ImplementAzure Portal:Go to the SQL server that hosts your SQL DatabaseClick on Active Directory admin under Settings bladeClick on Set adminSelect an adminClick Save<a href=”https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserveractivedirectoryadministrator?view=azurermps-6.13.0″>Azure PowerShell</a>Set-AzureRmSqlServerActiveDirectoryAdministrator -ResourceGroupName <resource group name> -ServerName <server name> -DisplayName “<Display name of AD account to set as DB administrator>”DefaultAzure Active Directory Authentication for SQL Database/Server is not enabled by default<a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell#provision-azure-ad-admin-sql-managed-instance”>Provision Azure AD admin (SQL Managed Instance)</a> |
| Azure – Ensure that all communications between Azure and your apps are SSL encrypted | Ensure that all communications between Azure and your apps are SSL encrypted at all times. Note that your apps need to explicitly request a secure connection. This must be implemented in order to avoid potential intermediary attacks If you have not used SSL certificate communication, make sure your apps do not accept other server certificates, as they may not be secure.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site”>Azure App Service SSL Certs</a> |
| Azure – Remediate vulnerabilities based on recommendations provided by Azure Security Center | The vulnerability scanner included with Azure Security Center is powered by Qualys.When Security Center identifies vulnerabilities, it presents findings and related information as recommendations. The related information includes remediation steps, related CVEs, CVSS scores, and more. You can view the identified vulnerabilities for one or more subscriptions, or for a specific VM.To see the findings and remediate the identified vulnerability:Open Azure Security Center and go to the Recommendations page.Select the recommendation named “Remediate vulnerabilities found on your virtual machines (powered by Qualys)”. Security Center shows you all the findings for all VMs in the currently selected subscriptions. The findings are ordered by severity.To filter the findings by a specific VM, open the “Affected resources” section and click the VM that interests you. Or you can select a VM from the resource health view, and view all relevant recommendations for that resource. Security Center shows the findings for that VM, ordered by severity. To learn more about a specific vulnerability, select it.The details pane that appears contains extensive information about the vulnerability, including: Links to all relevant CVEs (where available), Remediation steps, Any additional reference pages.To remediate a finding, follow the remediation steps from this details pane.Validation CheckEnsure that all the vulnerabilities discovered by a vulnerability assessment solution are remediated.<a href=”https://docs.microsoft.com/en-us/azure/security-center/built-in-vulnerability-assessment#deploying-the-qualys-built-in-vulnerability-scanner”>Deploy the built-in vulnerability scanner</a> |
| Azure – Use periodic backup and point-in-time restore | Use periodic backup and point-in-time restore. Regularly and automatically back up data that is not preserved elsewhere, and verify you can reliably restore both the data and the application itself should a failure occur. Ensure that backups meet your Recovery Point Objective (RPO). Data replication is not a backup feature, because human error or malicious operations can corrupt data across all the replicas. The backup process must be secure to protect the data in transit and in storage. Databases or parts of a data store can usually be recovered to a previous point in time by using transaction logs.Steps to ImplementVMs<a href=”https://docs.microsoft.com/en-us/azure/backup/tutorial-backup-vm-at-scale”>Backup Virtual Machines</a> Storage<a href=”https://docs.microsoft.com/en-us/rest/api/storageservices/creating-a-snapshot-of-a-blob”>Blob Storage Snapshots</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/files/storage-snapshots-files”>File Storage Snapshots</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy”>Table Storage Transfer with AzCopy</a> Databases<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-recovery-using-backups”>Restoring Database Backups</a> <a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/online-backup-and-restore”>Cosmos DB Auto Backup</a> Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/resiliency/recovery-data-corruption”>Recover from Data Corruption</a> |
| Azure – Restrict access to Azure SQL DB using Firewall Rules | Initially, all Transact-SQL access to your Azure SQL server is blocked by the firewall. To begin using your Azure SQL server, you must specify one or more server-level firewall rules that enable access to your Azure SQL server.Configure Azure SQL DB Firewall correctly according to the needs for your database.Server-level firewall rules: These rules enable clients to access your entire Azure SQL server, that is, all the databases within the same logical server. These rules are stored in the master database.Database-level firewall rules: These rules enable clients to access certain (secure) databases within the same logical server. You can create these rules for each database (including the master database) and they are stored in the individual databases.Microsoft recommends using database-level firewall rules whenever possible to enhance security and to make your database more portable.Use server-level firewall rules for administrators and when you have many databases that have the same access requirements and you don’t want to spend time configuring each database individually.To selectively grant access to just one of the databases in your Azure SQL server, you must create a database-level rule for the required database. Specify an IP address range for the database firewall rule that is beyond the IP address range specified in the server-level firewall rule, and ensure that the IP address of the client falls in the range specified in the database-level rule.In addition to IP rules, the firewall also manages virtual network rules. Virtual network rules are based on Virtual Network service endpoints. Virtual network rules might be preferable to IP rules in some cases.Ensure that any app that is trying to access the database is up-to-date. Cloud-based Azure database is automatically updated by Microsoft, but it is the customer’s responsibility to make sure all security updates and patches are applied to apps accessing the database.Steps to ImplementManage server-level IP firewall rulesIn Azure portal, select SQL databases from the left-hand menu, and select your database on the SQL databases page.On the Overview page, select Set server firewall. The Firewall settingspage for the database server opens.Select Add client IP on the toolbar to add your current IP address to a new firewall rule. The rule can open port 1433 for a single IP address or a range of IP addresses. Select Save.Select OK and close the Firewall settings page.You can now connect to any database in the server with the specified IP address or IP address range.Manage database-level IP firewall rulesDatabase-level firewall rules can only be configured using Transact-SQL (T-SQL) statements, and only after you’ve configured a server-level firewall rule.To setup a database-level firewall rule:Connect to the database, for example, using SQL Server Management Studio.In Object Explorer, right-click the database and select New Query.In the query window, add this statement and modify the IP address to your public IP address:EXECUTE sp_set_database_firewall_rule N’Example DB Rule’,’0.0.0.4′,’0.0.0.4′; On the toolbar, select Execute to create the firewall rule.Learn More<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-security-tutorial”>Manage IP firewall rules</a> |
| Azure – Enable Advanced Data Security | Enable Sql Advanced Data Security. Threat detection is part of the advanced data security (ADS) offering, which is a unified package for advanced SQL security capabilities.Threat detection for standalone and pooled databases detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Threat detection can identify Potential SQL injection, Access from unusual location or data center, Access from unfamiliar principal or potentially harmful application, and Brute force SQL credentials.You can receive notifications about the detected threats via email notifications or Azure portal.Steps to ImplementLaunch the Azure portal at <a href=”https://portal.azure.com/” class=”” rel=”noopener noreferrer”>https://portal.azure.com</a> .Navigate to the configuration page of the Azure SQL Database server you want to protect. In the security settings, select Advanced Data Security.On the Advanced Data Security configuration page:Enable advanced data security on the server.In Threat Detection Settings, in the Send alerts to text box, provide the list of emails to receive security alerts upon detection of anomalous database activities.Learn More<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-advanced-threat-protection” class=”” rel=”noopener noreferrer”>Enable Sql Advanced Data Security</a> <a href=”https://docs.microsoft.com/en-us/azure/sql-database/scripts/sql-database-auditing-and-threat-detection-powershell” class=”” rel=”noopener noreferrer”>Using PowerShell</a> <a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threat-detection” class=”” rel=”noopener noreferrer”>Sql Threat Detection</a> |
| Azure – Ensure that Data encryption is set to On on a SQL Database | Enable Transparent Data Encryption on every SQL server.Azure SQL Database transparent data encryption helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.Steps to ImplementAzure Portal:Go to SQL databasesSelect the DB instanceClick on Transparent data encryption under the Security bladeSet Data encryption to OnAzure Command Line Interface 2.0:az sql db tde set –resource-group <resourceGroup> –server <dbServerName> — database <dbName> –status EnabledDefaultBy default, Data encryption is set to On.<a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview?view=sql-server-ver15&tabs=azure-portal”>Transparent data encryption for SQL Database</a> |
| Azure – Geo-replicate databases | Geo-replication enables you to configure secondary database replicas in other regions. Secondary databases are available for querying and for failover in the case of a data center outage or the inability to connect to the primary database. For Azure SQL Databases:Active geo-replication is an Azure SQL Database feature that allows you to create readable secondary databases of individual databases on a server in the same or different data center (region).If geo-replication is enabled, the application can initiate failover to a secondary database in a different Azure region. Up to four secondaries are supported in the same or different regions, and the secondaries can also be used for read-only access queries. The failover must be initiated manually by the application or the user. After failover, the new primary has a different connection end point.Steps to Implement:In the Azure portal, browse to the database that you want to set up for geo-replication.On the SQL database page, select geo-replication, and then select the region to create the secondary database. You can select any region other than the region hosting the primary database, but we recommend the paired region.Select or configure the server and pricing tier for the secondary database.Optionally, you can add a secondary database to an elastic pool. To create the secondary database in a pool, click elastic pool and select a pool on the target server. A pool must already exist on the target server. This workflow does not create a pool.Click Create to add the secondary.The secondary database is created and the seeding process begins.When the seeding process is complete, the secondary database displays its status.Initiate a failoverThe secondary database can be switched to become the primary.In the Azure portal, browse to the primary database in the geo-replication partnership.On the SQL Database blade, select All settings > geo-replication.In the SECONDARIES list, select the database you want to become the new primary and click Failover.Click Yes to begin the failover.The command immediately switches the secondary database into the primary role.For Cosmos DB:Azure Cosmos DB is a globally distributed database service that’s designed to provide low latency, elastic scalability of throughput, well-defined semantics for data consistency, and high availability. In short, if your application needs guaranteed fast response time anywhere in the world, if it’s required to be always online, and needs unlimited and elastic scalability of throughput and storage, you should build your application on Azure Cosmos DB.You can configure your databases to be globally distributed and available in any of the Azure regions. To lower the latency, place the data close to where your users are. Choosing the required regions depends on the global reach of your application and where your users are located. Cosmos DB transparently replicates the data to all the regions associated with your Cosmos account. It provides a single system image of your globally distributed Azure Cosmos database and containers that your application can read and write to locally.<a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-multi-master?tabs=api-async”>CosmosDB Global Distribution</a>For PostgreSQL:Azure Database for PostgreSQL provides business continuity features that include automated backups and the ability for users to initiate geo-restore. Each has different characteristics for Estimated Recovery Time (ERT) and potential data loss. The geo-restore feature restores the server using geo-redundant backups. The backups are hosted in your server’s paired region. You can restore from these backups to any other region. The geo-restore creates a new server with the data from the backups.You can use cross region read replicas to enhance your business continuity and disaster recovery planning. Read replicas are updated asynchronously using PostgreSQL’s physical replication technology.To Create and Manage Read Replicas:<a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-read-replicas-portal#prepare-the-master-server”>Prepare the master server</a><a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-read-replicas-portal#create-a-read-replica”>Create a read replica</a><a href=”https://docs.microsoft.com/en-us/azure/postgresql/howto-read-replicas-portal#monitor-a-replica”>Monitor a replica</a>For MariaDb:The read replica feature allows you to replicate data from an Azure Database for MariaDB server to a read-only server. You can replicate from the master server to up to five replicas. Replicas are updated asynchronously using the MariaDB engine’s binary log (binlog) file position-based replication technology with global transaction ID (GTID).You can create a read replica in a different region from your master server. Cross-region replication can be helpful for scenarios like disaster recovery planning or bringing data closer to your users.You can have a master server in any Azure Database for MariaDB region. A master server can have a replica in its paired region or the universal replica regions.Configure Data-in Replication in Azure Database for MariaDB:<a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#create-a-mariadb-server-to-use-as-a-replica”>Create a MariaDB server to use as a replica</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#configure-the-master-server”>Configure the master server</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#dump-and-restore-the-master-server”>Dump and restore the master server</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-data-in-replication#link-the-master-and-replica-servers-to-start-data-in-replication”>Link the master and replica servers to start Data-in Replication</a>Create and manage read replicas in Azure Database for MariaDB:<a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-read-replicas-portal#create-a-read-replica”>Create a read replica</a><a href=”https://docs.microsoft.com/en-us/azure/mariadb/howto-read-replicas-portal#monitor-replication”>Monitor replication</a>Learn More<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-active-geo-replication-portal”>Geo-replicate Database</a> <a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auto-failover-group”>Auto Failover Groups</a> |
| Azure – Use optimistic concurrency and eventual consistency | Use optimistic concurrency and eventual consistency. Transactions that block access to resources through locking (pessimistic concurrency) can cause poor performance and considerably reduce availability. These problems can become especially acute in distributed systems. In many cases, careful design and techniques such as partitioning can minimize the chances of conflicting updates occurring. Where data is replicated, or is read from a separately updated store, the data will only be eventually consistent. But the advantages usually far outweigh the impact on availability of using transactions to ensure immediate consistency.Steps to ImplementThere are several techniques for testing for an optimistic concurrency violation.One involves including a timestamp column in the table.Using this technique, a timestamp column is included in the table definition.Whenever the record is updated, the timestamp is updated to reflect the current date and time. In a test for optimistic concurrency violations, the timestamp column is returned with any query of the contents of the table.When an update is attempted, the timestamp value in the database is compared to the original timestamp value contained in the modified row.If they match, the update is performed and the timestamp column is updated with the current time to reflect the update.If they do not match, an optimistic concurrency violation has occurred.Another technique for testing for an optimistic concurrency violation is to verify that all the original column values in a row still match those found in the database.Learn More<a href=”https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/optimistic-concurrency”>Optimistic Concurrency</a> |
| Azure – Ensure that AuditActionGroups in auditing policy for a SQL server is set properly | Configure the ‘AuditActionGroups’ property to appropriate groups to capture all the critical activities on the SQL Server and all the SQL databases hosted on the SQL server.To capture all critical activities done on SQL Servers and databases within sql servers, auditing should be configured to capture appropriate ‘AuditActionGroups’. Property AuditActionGroup should contains at least SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, BATCH_COMPLETED_GROUP to ensure comprehensive audit logging for SQL servers and SQL databases hosted on SQL Server.Steps to Implement<a href=”https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserverauditingpolicy?view=azurermps-6.13.0″>Azure PowerShell</a>To create Audit profile with prescribed ‘AuditActionGroup’, run the following command in Azure PowerShell:Set-AzureRmSqlServerAuditingPolicy -ResourceGroupName “<resourceGroup>” – ServerName “<serverName>” -StorageAccountName “storageAccountName” -AuditActionGroup “SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP”, “FAILED_DATABASE_AUTHENTICATION_GROUP” -RetentionInDays <number >= 90>DefaultWhen Auditing for a Sql Server is enabled using Azure Portal , AuditActionGroup property is by default set to {SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, BATCH_COMPLETED_GROUP}.<a href=”https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15″>SQL Server Audit Action Groups and Actions</a> |
| Azure – Ensure that Auditing Retention is greater than 90 days | SQL Server Audit Retention should be configured to be greater than 90 days.Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access.Steps to ImplementAzure Portal:Go to the SQL server that hosts the SQL DatabaseClick on Auditing under the Security bladeSelect Storage DetailsSet Retention (days) setting greater than 90 daysSelect OKSelect Save<a href=”https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserverauditing?view=azurermps-6.13.0″>Azure PowerShell</a>set-AzureRmSqlServerAuditing -ResourceGroupName <resource group name> – ServerName <server name> -RetentionInDays <Number of Days to retain the audit logs, should be 90days minimum>DefaultBy default, SQL Server audit storage is disabled.<a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#audit-storage-destination”>Audit to storage destination</a> |
| Azure – Ensure that alerts are configured to be sent to the appropriate personal | Provide the email address where alerts will be sent when anomalous activities are detected on SQL servers.Providing the email address to receive alerts ensures that any detection of anomalous activities is reported as soon as possible, making it more likely to mitigate any potential risk sooner.Steps to ImplementAzure Portal:Go to the SQL server that hosts your SQL DatabaseClick on Security Center under the Security bladeUnder ADVANCED THREAT PROTECTION SETTINGS Section, Enter an email or a list of emails in ‘Send alerts to’Click on Save<a href=”https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserverthreatdetectionpolicy?view=azurermps-6.13.0″>Azure PowerShell</a>Set-AzureRmSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> -ServerName <server name> -NotificationRecipientsEmails “<Recipient Email ID>”DefaultBy default, Send alerts to is not set.<a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql”>Azure Defender for SQL</a> |
| Azure – Send email notification to admins and subscription owners | Enable service and co-administrators to receive security alerts from the SQL server.Providing the email address to receive alerts ensures that any detection of anomalous activities is reported as soon as possible, making it more likely to mitigate any potential risk sooner.Steps to ImplementAzure Portal:Go to the SQL server that hosts the SQL DatabaseClick on Security Center under the Security bladeUnder ADVANCED THREAT PROTECTION SETTINGS Section, Enable ‘Also send email notification to admins and subscription owners’Click on Save<a href=”https://docs.microsoft.com/en-us/powershell/module/azurerm.sql/set-azurermsqlserverthreatdetectionpolicy?view=azurermps-6.13.0″>Azure PowerShell</a>Set-AzureRmSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> -ServerName <server name> -EmailAdmins $TrueDefaultBy default, Send email notification to admins and subscription owners is enabled.<a href=”https://docs.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview”>Advanced Threat Protection for Azure SQL Database</a> |
Azure sql db
Azure table storage
| Azure – Always Enable Storage account Encryption | Always Enable Storage account Encryption which keeps the data at rest Encrypted.Azure Storage Service Encryption for data at rest helps you protect your data to meet your organizational security and compliance commitments. With this feature, the Azure storage platform automatically encrypts your data before persisting it to Azure Managed Disks, Azure Blob, Queue, or Table storage, or Azure Files, and decrypts the data before retrieval. The handling of encryption, encryption at rest, decryption, and key management in Storage Service Encryption is transparent to users. All data written to the Azure storage platform is encrypted through 256-bit AES encryption, one of the strongest block ciphers available.Steps to ImplementTo view settings for Storage Service Encryption, sign in to the Azure portal and select a storage account. In the SETTINGS pane, select the Encryption setting.Storage Service EncryptionStorage Service Encryption is enabled for all new and existing storage accounts and cannot be disabled. Because your data is secured by default, you don’t need to modify your code or applications to take advantage of Storage Service Encryption.Blob and File StorageSSE for Azure Blob storage and Azure Files is integrated with Azure Key Vault, so that you can use a key vault to manage your encryption keys. You can create your own encryption keys and store them in a key vault, or you can use Azure Key Vault’s APIs to generate encryption keys. With Azure Key Vault, you can manage and control your keys and also audit your key usage.Create a storage accountEnable SSE for Blob and File storageEnable encryption with customer-managed keysSelect your keyCopy data to storage accountQuery the status of the encrypted dataLearn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption”>Storage Service Encryption</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption-customer-managed-keys”>Encryption with Customer Keys</a> |
| Azure – Reference stored access policies | Reference stored access policies where possible. Stored access policies give you the option to revoke permissions without having to regenerate the storage account keys. Set the expiration on these very far in the future (or infinite) and make sure it’s regularly updated to move it farther into the future.Steps to ImplementTo create or modify a stored access policy, call the Set ACL operation for the resource (i.e., Set Container ACL, Set Queue ACL, Set Table ACL, Set Share ACL) with a request body that specifies the terms of the access policy. The body of the request includes a unique signed identifier of your choosing, up to 64 characters in length, and the optional parameters of the access policy, as follows:<?xml version=”1.0″ encoding=”utf-8″?> <SignedIdentifiers> <SignedIdentifier> <Id>unique-64-char-value</Id> <AccessPolicy> <Start>start-time</Start> <Expiry>expiry-time</Expiry> <Permission>abbreviated-permission-list</Permission> </AccessPolicy> </SignedIdentifier> </SignedIdentifiers> Note: Table entity range restrictions (startpk, startrk, endpk, and endrk) cannot be specified in a stored access policy.A maximum of five access policies may be set on a container, table, or queue at any given time. Each SignedIdentifier field, with its unique Id field, corresponds to one access policy. Attempting to set more than five access policies at one time results in the service returning status code 400 (Bad Request).Learn More<a href=”https://docs.microsoft.com/en-us/rest/api/storageservices/establishing-a-stored-access-policy”>Stored Access Policies</a> |
| Azure – Be careful with SAS start time and expiry time | Be careful with SAS start time. If you set the start time for a SAS to now, then due to clock skew (differences in current time according to different machines), failures may be observed intermittently for the first few minutes. In general, set the start time to be at least 15 minutes in the past. Or, don’t set it at all, which will make it valid immediately in all cases.The same generally applies to expiry time as well. Expiry time is the time after which the SAS is no longer valid. Best practices recommend that you either specify an expiry time for a SAS, or associate it with a stored access policy. Remember that you may observe up to 15 minutes of clock skew in either direction on any request.Use near-term expiration times on an ad hoc SAS. In this way, even if a SAS is compromised, it’s valid only for a short time. This practice is especially important if you cannot reference a stored access policy. Near-term expiration times also limit the amount of data that can be written to a blob by limiting the time available to upload to it.Steps to ImplementThe account SAS and service SAS tokens include some common parameters.Start time. This is the time at which the SAS becomes valid. The start time for a shared access signature is optional. If a start time is omitted, the SAS is effective immediately. The start time must be expressed in UTC (Coordinated Universal Time), with a special UTC designator (“Z”), for example 1994-11-05T13:15:30Z.Expiry time. This is the time after which the SAS is no longer valid. Best practices recommend that you either specify an expiry time for a SAS, or associate it with a stored access policy. The expiry time must be expressed in UTC (Coordinated Universal Time), with a special UTC designator (“Z”), for example 1994-11-05T13:15:30Z.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#parameters-common-to-account-sas-and-service-sas-tokens”>SAS Parameters</a> |
| Azure – Have clients automatically renew the SAS if necessary | Have clients automatically renew the SAS if necessary. Clients should renew the SAS well before the expiration, in order to allow time for retries if the service providing the SAS is unavailable. If your SAS is meant to be used for a small number of immediate, short-lived operations that are expected to be completed within the expiration period, then this may be unnecessary as the SAS is not expected to be renewed. However, if you have client that is routinely making requests via SAS, then the possibility of expiration comes into play. The key consideration is to balance the need for the SAS to be short-lived (as previously stated) with the need to ensure that the client is requesting renewal early enough (to avoid disruption due to the SAS expiring prior to successful renewal).Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Limit access to services using SAS | A security best practice is to provide a user with the minimum required privileges. If a user only needs read access to a single entity, then grant them read access to that single entity, and not read/write/delete access to all entities. This also helps lessen the damage if a SAS is compromised because the SAS has less power in the hands of an attacker.Understand that your account will be billed for any usage, including that done with SAS. If you provide write access to a blob, a user may choose to upload a 200GB blob. If you’ve given them read access as well, they may choose to download it 10 times, incurring 2 TB in egress costs for you. Again, provide limited permissions to help mitigate the potential actions of malicious users. Use short-lived SAS to reduce this threat (but be mindful of clock skew on the end time).Steps to implement:Navigate to Storage Accounts in the Azure PortalSelect the Storage Account.On the left side menu option select Settings > Shared Access SignatureSelect services you wish to allow access to under “Allowed Services”.Under “Allowed Permissions”, define the permissibility.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Validate data written using SAS | Validate data written using SAS. When a client application writes data to your storage account, keep in mind that there can be problems with that data. If your application requires that data be validated or authorized before it is ready to use, you should perform this validation after the data is written and before it is used by your application. This practice also protects against corrupt or malicious data being written to your account, either by a user who properly acquired the SAS, or by a user exploiting a leaked SAS.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Do not always use SAS | Don’t always use SAS. Sometimes the risks associated with a particular operation against your storage account outweigh the benefits of SAS. For such operations, create a middle-tier service that writes to your storage account after performing business rule validation, authentication, and auditing. Also, sometimes it’s simpler to manage access in other ways. For example, if you want to make all blobs in a container publicly readable, you can make the container Public, rather than providing a SAS to every client for access.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1#best-practices-when-using-sas”>SAS Best Practices</a> |
| Azure – Use client-side encryption for high value data | Client-side encryption enables you to programmatically encrypt data in transit before uploading to Azure Storage, and programmatically decrypt data when retrieving it. This provides encryption of data in transit but it also provides encryption of data at rest. Client-side encryption is the most secure method of encrypting your data but it does require you to make programmatic changes to your application and put key management processes in place.Client-side encryption also enables you to have sole control over your encryption keys. You can generate and manage your own encryption keys. It uses an envelope technique where the Azure storage client library generates a content encryption key (CEK) that is then wrapped (encrypted) using the key encryption key (KEK). The KEK is identified by a key identifier and can be an asymmetric key pair or a symmetric key and can be managed locally or stored in Azure Key Vault.Steps to ImplementEncryption via the envelope techniqueThe Azure storage client library generates a content encryption key (CEK), which is a one-time-use symmetric key.User data is encrypted using this CEK.The CEK is then wrapped (encrypted) using the key encryption key (KEK). The KEK is identified by a key identifier and can be an asymmetric key pair or a symmetric key and can be managed locally or stored in Azure Key Vaults.The storage client library itself never has access to KEK. The library invokes the key wrapping algorithm that is provided by Key Vault. Users can choose to use custom providers for key wrapping/unwrapping if desired.The encrypted data is then uploaded to the Azure Storage service. The wrapped key along with some additional encryption metadata is either stored as metadata (on a blob) or interpolated with the encrypted data (queue messages and table entities).Decryption via the envelope techniqueThe client library assumes that the user is managing the key encryption key (KEK) either locally or in Azure Key Vaults. The user does not need to know the specific key that was used for encryption. Instead, a key resolver which resolves different key identifiers to keys can be set up and used.The client library downloads the encrypted data along with any encryption material that is stored on the service.The wrapped content encryption key (CEK) is then unwrapped (decrypted) using the key encryption key (KEK). Here again, the client library does not have access to KEK. It simply invokes the custom or Key Vault provider’s unwrapping algorithm.The content encryption key (CEK) is then used to decrypt the encrypted user data.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-client-side-encryption”>Storage Client-side Encryption</a> <a href=”https://docs.microsoft.com/en-us/azure/security/security-paas-applications-using-storage#use-client-side-encryption-for-high-value-data”>Client-side Encryption for High Value Data</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-client-side-encryption”>Client-side Encryption</a> |
| Azure – Avoid any single point of failure | Avoid any single point of failure. All components, services, resources, and compute instances should be deployed as multiple instances to prevent a single point of failure from affecting availability. This includes authentication mechanisms. Design the application to be configurable to use multiple instances, and to automatically detect failures and redirect requests to non-failed instances where the platform does not do this automatically.Steps to ImplementCreating a Resource Manager template from scratch is not an easy task, especially if you are new to Azure deployment and your are not familiar with the JSON format. Using the Azure portal, you can configure a resource, for example an Azure Storage account. Before you deploy the resource, you can export your configuration into a Resource Manager template. You can save the template and reuse it in the future.Many experienced template developers use this method to generate working templates when they try to deploy Azure resources that they are not familiar with.Generate a templateSign in to the Azure portal.Select Create a resource > Storage > Storage account – blob, file, table, queue.Enter the following information:Resource group: Select Create new, and specify a resource group name of your choice. On the screenshot, the resource group name is mystorage1016rg. Resource group is a container for Azure resources. Resource group makes it easier to manage Azure resources.Name: Give your storage account a unique name. On the screenshot, the name is mystorage1016.You can use the default values for the rest of the properties.Select Review + create on the bottom of the screen.Select Download a template for automation on the bottom of the screen. The portal shows the generated template:The main pane shows the template. It is a JSON file with six top-level elements – schema, contentVersion, parameters, variables, resources, and output.There are six parameters defined. One of them is called storageAccountName. The second highlighted part on the previous screenshot shows how to reference this parameter in the template. In the next section, you edit the template to use a generated name for the storage account.In the template, one Azure resource is defined. The type is [Microsoft.Storage/storageAccounts]. See how the resource is defined, and the definition structure.Select Download. Save template.json from the downloaded package to your computer.Select the Parameter tab to see the values you provided for the parameters. Write down these values, you need them in the next section when you deploy the template.Using both the template and the parameters files, you can create a resource, in this tutorial, an Azure storage account.Edit and Deploy a TemplateIn the Azure portal, select Create a resource.In Search the Marketplace, type template deployment, and then press ENTER.Select Template deployment.Select Create.Select Build your own template in the editor.Select Load file, and then follow the instructions to load template.json you downloaded in the last section.Add one variable as shown in the following sample:”variables” : { “storageAccountName”: “[concat(uniquestring(resourceGroup().id), ‘standardsa’)] }” Remove the storageAccountName parameter highlighted in the previous screenshot.Update the name element of the Microsoft.Storage/storageAccounts resource to use the newly defined variable instead of the parameter:”name”: “[variables(‘storageAccountName’)]”, Select Save.Configure the rest of the form settings.Select Purchase.Select the bell icon (notifications) from the top of the screen to see the deployment status. You shall see Deployment in progress. Wait until the deployment is completed.Select Go to resource group from the notification pane to see your newly created group.Learn More<a href=”https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-quickstart-create-templates-use-the-portal”>Create Resource Manager Templates – Portal</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-multiple”>Create Multiple Resources</a> |
| Azure – Use periodic backup and point-in-time restore | Use periodic backup and point-in-time restore. Regularly and automatically back up data that is not preserved elsewhere, and verify you can reliably restore both the data and the application itself should a failure occur. Ensure that backups meet your Recovery Point Objective (RPO). Data replication is not a backup feature, because human error or malicious operations can corrupt data across all the replicas. The backup process must be secure to protect the data in transit and in storage. Databases or parts of a data store can usually be recovered to a previous point in time by using transaction logs.Steps to ImplementVMs<a href=”https://docs.microsoft.com/en-us/azure/backup/tutorial-backup-vm-at-scale”>Backup Virtual Machines</a> Storage<a href=”https://docs.microsoft.com/en-us/rest/api/storageservices/creating-a-snapshot-of-a-blob”>Blob Storage Snapshots</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/files/storage-snapshots-files”>File Storage Snapshots</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy”>Table Storage Transfer with AzCopy</a> Databases<a href=”https://docs.microsoft.com/en-us/azure/sql-database/sql-database-recovery-using-backups”>Restoring Database Backups</a> <a href=”https://docs.microsoft.com/en-us/azure/cosmos-db/online-backup-and-restore”>Cosmos DB Auto Backup</a> Learn More<a href=”https://docs.microsoft.com/en-us/azure/architecture/resiliency/recovery-data-corruption”>Recover from Data Corruption</a> |
| Azure – Monitor storage services for unexpected changes in behavior | Azure Storage Analytics performs logging and provides metrics data for an Azure storage account. We recommend that you use this data to trace requests, analyze usage trends, and diagnose issues with your storage account.You should continuously monitor the storage services that your application uses for any unexpected changes in behavior (such as slower response times). Use logging to collect more detailed data and to analyze a problem in depth. The diagnostics information that you obtain from both monitoring and logging helps you to determine the root cause of the issue that your application encountered. Then you can troubleshoot the issue and determine the appropriate steps to remediate it.Steps to ImplementIn the Azure portal, select Storage accounts, then the storage account name to open the account dashboard.Select Diagnostics in the MONITORING section of the menu blade.Select the type of metrics data for each service you wish to monitor, and the retention policy for the data. You can also disable monitoring by setting Status to Off.To set the data retention policy, move the Retention (days) slider or enter the number of days of data to retain, from 1 to 365. The default for new storage accounts is seven days. If you do not want to set a retention policy, enter zero. If there is no retention policy, it is up to you to delete the monitoring data.Warning: You are charged when you manually delete metrics data. Stale analytics data (data older than your retention policy) is deleted by the system at no cost. We recommend setting a retention policy based on how long you want to retain storage analytics data for your account.When you finish the monitoring configuration, select Save.Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-monitor-storage-account”>Monitor Storage Accounts</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-metrics-in-azure-monitor”>Storage Metrics</a> |
| Azure – Geo-replicate data in Azure Storage | Geo-replicate data in Azure Storage. Data in Azure Storage is automatically replicated within a datacenter. For even higher availability, use Read-access geo-redundant storage (-RAGRS), which replicates your data to a secondary region and provides read-only access to the data in the secondary location. The data is durable even in the case of a complete regional outage or a disaster. For more information, see Azure Storage replication.Steps to ImplementSelect the Create a resource button found on the upper left-hand corner of the Azure portal.Select Storage from the New page.Select Storage account – blob, file, table, queue under Featured.Fill out the storage account form and select Create.Use Replication: Read-access geo-redundant storage (RA-GRS)Learn More<a href=”https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs#read-access-geo-redundant-storage”>Geo-Redundant Storage</a> <a href=”https://docs.microsoft.com/en-us/azure/storage/blobs/storage-create-geo-redundant-storage?tabs=dotnet”>Configure Storage with RAGRS</a> |
azure automation
Azure sql db
Azure table storage
| Azure – Rotate the Service Registration Key after each use | Rotate the Service Registration Key after each use. The rotation of these keys will not be enforcedSteps to ImplementTo allow Azure Automation to set secret values in your key vault, you must get the client ID for the connection named AzureRunAsConnection, which was created when you established your Azure Automation instance. You can find this ID by choosing Assets from your Azure Automation instance. From there, you choose Connections and then select the AzureRunAsConnection service principle. Take note of the Application ID.In Assets, choose Modules. From Modules, select Gallery, and then search for and Import updated versions of each of the following modules:Azure Azure.Storage AzureRM.Profile AzureRM.KeyVault AzureRM.Automation AzureRM.Storage After you have retrieved the application ID for your Azure Automation connection, you must tell your key vault that this application has access to update secrets in your vault. This can be accomplished with the following PowerShell command:Set-AzureRmKeyVaultAccessPolicy -VaultName <vaultName> -ServicePrincipalName <applicationIDfromAzureAutomation> -PermissionsToSecrets Set Next, select Runbooks under your Azure Automation instance, and then select Add a Runbook. Select Quick Create. Name your runbook and select PowerShell as the runbook type. You have the option to add a description. Finally, click Create.Paste the following PowerShell script in the editor pane for your new runbook:$connectionName = “AzureRunAsConnection” try { # Get the connection “AzureRunAsConnection “ $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName “Logging in to Azure…” Connect-AzureRmAccount ` -ServicePrincipal ` -TenantId $servicePrincipalConnection.TenantId ` -ApplicationId $servicePrincipalConnection.ApplicationId ` -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint “Login complete.” } catch { if (!$servicePrincipalConnection) { $ErrorMessage = “Connection $connectionName not found.” throw $ErrorMessage } else{ Write-Error -Message $_.Exception throw $_.Exception } } #Optionally you may set the following as parameters $StorageAccountName = <storageAccountName> $RGName = <storageAccountResourceGroupName> $VaultName = <keyVaultName> $SecretName = <keyVaultSecretName> #Key name. For example key1 or key2 for the storage account New-AzureRmStorageAccountKey -ResourceGroupName $RGName -Name $StorageAccountName -KeyName “key2” -Verbose $SAKeys = Get-AzureRmStorageAccountKey -ResourceGroupName $RGName -Name $StorageAccountName $secretvalue = ConvertTo-SecureString $SAKeys[1].Value -AsPlainText -Force $secret = Set-AzureKeyVaultSecret -VaultName $VaultName -Name $SecretName -SecretValue $secretvalue From the editor pane, choose Test pane to test your script. Once the script is running without error, you can select Publish, and then you can apply a schedule for the runbook back in the runbook configuration pane.Learn More<a href=”https://docs.microsoft.com/en-us/azure/key-vault/key-vault-key-rotation-log-monitoring#key-rotation-using-azure-automation” class=”” rel=”noopener noreferrer”>Key Rotation using Azure Automation</a> |
| Azure – Use PowerShell Runbooks | Powershell Automation is advised for tasks that require fast start and are not long running.Powershell Workflow Automation is advised for long running tasks where checkpointing is needed.Graphical/Graphical Powershell Workflow is advised to focus on data flow complex processes.Write simpler, modular Runbooks so that they can be reused and Set ErrorAction to stop, to make sure job status is what expected by user.Steps to ImplementYou start by creating a simple runbook that outputs the text Hello World.In the Azure portal, open your Automation account.The Automation account page gives you a quick view of the resources in this account. You should already have some assets. Most of those are the modules that are automatically included in a new Automation account. You should also have a Credential asset.Click Runbooks under Process Automation to open the list of runbooks.Create a new runbook by clicking on the + Add a runbook button and then Create a new runbook.Give the runbook the name MyFirstRunbook-Workflow.In this case select Powershell Workflow for Runbook type.Click Create to create the runbook and open the textual editor.Learn More<a href=”https://docs.microsoft.com/en-us/azure/automation/automation-first-runbook-textual” class=”” rel=”noopener noreferrer”>Create Workflow Runbook</a> |
| Azure – Debug Runbooks | Use Write-Process and Write-Verbose to help debug Runbooks, turn off unless needed to debug.Steps to ImplementYou can Test any runbook type in the Azure portal.Open the Draft version of the runbook in either the textual editor or graphical editor.Click the Test button to open the Test blade.If the runbook has parameters, they will be listed in the left pane where you can provide values to be used for the test.If you want to run the test on a Hybrid Runbook Worker, then change Run Settings to Hybrid Worker and select the name of the target group. Otherwise, keep the default Azure to run the test in the cloud.Click the Start button to start the test.If the runbook is PowerShell Workflow or Graphical, then you can stop or suspend it while it is being tested with the buttons underneath the Output Pane. When you suspend the runbook, it completes the current activity before being suspended. Once the runbook is suspended, you can stop it or restart it.Inspect the output from the runbook in the output pane.Learn More<a href=”https://docs.microsoft.com/en-us/azure/automation/automation-testing-runbook” class=”” rel=”noopener noreferrer”>Testing Runbooks</a> |
| Azure – Encrypt sensitive information at rest | Enable encryption of Automation account variable assets when storing sensitive data.Use customer-managed keys with Azure Automation. Azure Automation supports the use of customer-managed keys to encrypt all ‘Secure assets’ used such as : credentials, certificates, connections, and encrypted variables. Leverage encrypted variables with your runbooks for all of your persistent variable lookup needs to prevent unintended exposure.When using Hybrid Runbook Workers, the virtual disks on the virtual machines are encrypted at rest using either server-side encryption or Azure disk encryption (ADE). Azure disk encryption leverages the BitLocker feature of Windows to encrypt managed disks with customer-managed keys within the guest VM. Server-side encryption with customer-managed keys improves on ADE by enabling you to use any OS types and images for your VMs by encrypting data in the Storage service. |
| Azure – Always Configure Autoscale for Virtual Machines | Best Practice RecommendationAutoscale allows you to have the right amount of resources running to handle the load on your application. It allows you to add resources to handle increases in load and also save money by removing resources that are sitting idle.There are two types of scaling, vertical and horizontal. Vertical scaling, also known as scale up and scale down, means increasing or decreasing virtual machine (VM) sizes in response to a workload. Compare this behavior with horizontal scaling, also referred to as scale out and scale in, where the number of VMs is altered depending on the workload.Steps to ImplementScale OutOpen the Azure portal and select Resource groups from the menu on the left-hand side of the dashboard.Select the resource group that contains your scale set, then choose your scale set from the list of resources.Choose Scaling from the menu on the left-hand side of the scale set window. Select the button to Enable autoscale.Enter a name for your settings, such as autoscale, then select the option to Add a rule.Let’s create a rule that increases the number of VM instances in a scale set when the average CPU load is greater than 70% over a 10-minute period. When the rule triggers, the number of VM instances is increased by 20%. In scale sets with a small number of VM instances, you could set the Operation to Increase count by and then specify 1 or 2 for the Instance count. In scale sets with a large number of VM instances, an increase of 10% or 20% VM instances may be more appropriate.To create the rule, select Add.Scale InChoose to Add a rule again.Create a rule that decreases the number of VM instances in a scale set when the average CPU load then drops below 30% over a 10-minute period. When the rule triggers, the number of VM instances is decreased by 20%. Use the same approach as with the previous rule. Adjust the settings for your rule.To create the rule, select Add.Learn MoreHorizontal Scaling<a href=”https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-overview”>Horizontally Autoscale with Virtual Machine Scale Sets</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-autoscale-powershell”>Using Powershell</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-autoscale-cli”>Using CLI</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-autoscale-powershell”>Scaling virtual machine scale sets in Windows</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-autoscale-cli”>Scaling virtual machine scale sets in Linux</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-virtual-machine-scale-sets”>Advanced Autoscale configuration using Resource Manager templates for VM Scale Sets</a> Vertical Scaling<a href=”https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-vertical-scale-reprovision”>Vertically Autoscale with Virtual Machine Scale Sets</a> <a href=”https://docs.microsoft.com/en-us/azure/virtual-machines/windows/vertical-scaling-automation?toc=%2Fazure%2Fvirtual-machines%2Fwindows%2Ftoc.json”>Vertically Autoscale with Azure Automation</a> |
| Azure – Always Configure Autoscale for Web and API Apps | Always use a scale-out and scale-in (or scale-up and scale-down) rule combination that performs an increase and decrease.Autoscale allows you to have the right amount of resources running to handle the load on your application. It allows you to add resources to handle increases in load and also save money by removing resources that are sitting idle.There are two types of scaling, vertical and horizontal. Vertical scaling, also known as scale up and scale down, means increasing or decreasing app resource sizes in response to a workload. Compare this behavior with horizontal scaling, also referred to as scale out and scale in, where the number of app instances is altered depending on the workload.Steps to ImplementScale OutNavigate to Monitor instance in the Azure portal.Select Autoscale from the menu on the left.Locate your Azure API Management service based on the filters in dropdown menus.Select the desired Azure API Management service instance.In the newly opened section, click the Enable autoscale button.In the Rules section, click + Add a rule.Define a new scale out rule.Click Add to save the rule.Scale InClick again on + Add a rule.This time, a scale in rule needs to be defined. It will ensure resources are not being wasted, when the usage of APIs decreases.Define a new scale in rule.Click Add to save the rule.Set the maximum number of Azure API Management units.Note: Azure API Management has a limit of units an instance can scale out to. The limit depends on a service tier.Click Save. Your autoscale has been configured.Learn More<a href=”https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-autoscale” class=”” rel=”noopener noreferrer”>Automatically scale Azure resources</a> <a href=”https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-get-started” class=”” rel=”noopener noreferrer”>Azure Autoscaling</a> |
azure redis cache
Azure sql db
Azure table storage
| Azure – Use Redis Cache clustering | To reduce overhead that’s associated with reading and writing data, after an identity has been granted write and/or read access to the cache, that identity can use any data in the cache.If you need to restrict access to subsets of the cached data, you can do one of the following:Split the cache into partitions (by using different cache servers) and only grant access to identities for the partitions that they should be allowed to use.Encrypt the data in each subset by using different keys, and provide the encryption keys only to identities that should have access to each subset. A client application might still be able to retrieve all of the data in the cache, but it will only be able to decrypt the data for which it has the keys.Steps to ImplementClustering is enabled on the New Azure Cache for Redis blade during cache creation.To create a premium cache, sign in to the Azure portal and click Create a resource > Databases > Azure Cache for Redis.To configure premium features, first select one of the premium pricing tiers in the Pricing tier drop-down list. For more information about each pricing tier, click View full pricing details and select a pricing tier from the Choose your pricing tier blade.Clustering is configured on the Redis Cluster blade.You can have up to 10 shards in the cluster. Click Enabled and slide the slider or type a number between 1 and 10 for Shard count and click OK.Each shard is a primary/replica cache pair managed by Azure, and the total size of the cache is calculated by multiplying the number of shards by the cache size selected in the pricing tier.Once the cache is created you connect to it and use it just like a non-clustered cache, and Redis distributes the data throughout the Cache shards. If diagnostics is enabled, metrics are captured separately for each shard and can be viewed in the Azure Cache for Redis blade.Learn More<a href=”https://docs.microsoft.com/en-us/azure/azure-cache-for-redis/cache-how-to-premium-clustering” class=”” rel=”noopener noreferrer”>Redis Cache Clustering</a> |
| Azure – Ensure that all communications between Azure and your apps are SSL encrypted | Ensure that all communications between Azure and your apps are SSL encrypted at all times. Note that your apps need to explicitly request a secure connection. This must be implemented in order to avoid potential intermediary attacks If you have not used SSL certificate communication, make sure your apps do not accept other server certificates, as they may not be secure.Steps to ImplementStart an App Service certificate order in the App Service Certificate create page.Configure the certificate. When finished, click Create.Select the certificate in the App Service Certificates page, then click Certificate Configuration > Step 1: Store.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Key Vault Status page, click Key Vault Repository to create a new vault or choose an existing vault.In the Function App SSL Settings go to Private Certificates and click + Import App Service Certificate.Go back to the Certificate Configuration page and click Step 2: Verify.Learn More<a href=”https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site”>Azure App Service SSL Certs</a> |
| Azure – Redis Cache Recommendations | Configure the client library to use a “connect timeout” of at least 10 to 15 seconds, giving the system time to connect even under higher CPU conditions.Develop your system such that it can handle connection blips due to patching and failover.Configure your maxmemory-reserved setting to improve system responsiveness under memory pressure conditions.Redis works best with smaller values, so consider chopping up bigger data into multiple keys.Locate your cache instance and your application in the same region.Reuse connections – Creating new connections is expensive and increases latency, so reuse connections as much as possible.Learn More<a href=”https://docs.microsoft.com/en-us/azure/azure-cache-for-redis/cache-faq” class=”” rel=”noopener noreferrer”>Redis Cache FAQ</a> <a href=”https://docs.microsoft.com/en-us/azure/architecture/best-practices/caching#protect-cached-data” class=”” rel=”noopener noreferrer”>Protected Cached Data</a> |