XELMES 
MFA on every admin account
A stolen or guessed password should never be enough to take over your environment. Yet admin accounts without multi-factor authentication are still common, especially old accounts and shared ones.
Enforce MFA with Conditional Access on every account with an admin role. The only exception should be your emergency access accounts, which need their own protection and close monitoring. For the most sensitive roles, go for passkeys or FIDO2 security keys, which stand up to phishing.
Least privilege
The Owner role on a subscription can do anything, including granting itself even more rights. It is often handed out to unblock someone quickly, and never taken back.
Give people the role they need, where they need it: on a resource group rather than the whole subscription, and Contributor or a more specific role rather than Owner. For admin rights that are only needed now and then, Privileged Identity Management grants them on request, for a limited time.
No storage open to the internet
By default, a storage account or database can be reached from the internet until you lock it down. Add a container with anonymous access, or a key that has leaked, and your data is public.
Turn off anonymous access, restrict network access with firewall rules or private endpoints, and use Entra ID authentication rather than shared keys.
Secrets in Key Vault
Connection strings, API keys and passwords end up in code, config files and scripts, because that is the quickest way to get something working. Once committed, a secret stays in the repository history, even if the line is deleted later.
Store secrets in Key Vault and let your applications read them through a managed identity, so there is no password to manage at all. If a secret has already been committed, treat it as compromised: rotate it, rather than just deleting the line.
RDP and SSH closed
A VM with port 3389 or 22 open to the internet is quickly picked up by automated scans, and login attempts soon follow.
Close these ports to the internet. Connect through Azure Bastion from the portal, or use just-in-time access, which opens a port for a single IP address for a limited time.
Where to start
None of these fixes requires a new tool. What they do require is someone to look, decide and follow through. Start with MFA and privileged roles: they protect everything else.
If you want an outside view of your tenant, with clear priorities and an action plan, that is exactly what our security services cover.
Security & identityControlled access and protected secrets, with a zero trust and least privilege approach. 