Security and Governance in the Cloud

Security and governance in the cloud refer to the set of tools, policies, and practices that protect cloud resources, data, and applications from threats while ensuring compliance with organizational and regulatory standards. In traditional on-premises environments, you control everything—physical servers, network cables, and data center access. In the cloud, the responsibility is shared between you and Microsoft. This is called the shared responsibility model. Microsoft secures the physical infrastructure (data centers, hardware, networking), while you are responsible for securing your data, identities, and access configurations. For example, if you misconfigure a storage account to be publicly accessible, that's your fault, not Microsoft's.

Azure uses a defense-in-depth strategy, which layers multiple security controls so that if one layer fails, another protects the asset. Imagine a castle with a moat, walls, guards, and a treasure chest with a lock. The layers are: - Physical security: Guards, biometrics, and surveillance at Azure data centers. - Identity and access: Azure AD, Multi-Factor Authentication (MFA), and RBAC. - Network security: Network Security Groups (NSGs), Azure Firewall, and DDoS protection. - Data security: Encryption at rest and in transit, Azure Key Vault for secrets. - Application security: Web Application Firewall (WAF), App Service authentication. - Monitoring and alerting: Azure Security Center, Azure Sentinel, and Log Analytics.

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service. It provides authentication (verifying who you are) and authorization (what you can do). Azure AD has four editions: Free (included with Azure subscription), Office 365 Apps, Premium P1, and Premium P2. The Free edition supports up to 500,000 directory objects and includes basic MFA via conditional access. Premium editions add features like Identity Protection and Privileged Identity Management (PIM).

Role-Based Access Control (RBAC) is an authorization system built on Azure Resource Manager. You assign roles (e.g., Owner, Contributor, Reader) to users, groups, or service principals at a specific scope (management group, subscription, resource group, or resource). Roles are collections of permissions. For example, the 'Reader' role can only view resources, not modify them. RBAC is free to use.

Azure Policy is a governance tool that creates, assigns, and manages policies. Policies enforce rules (e.g., 'only allow VMs from a certain region') and can be applied at any scope. They are inherited down the hierarchy. For example, if you apply a policy at the subscription level, it applies to all resource groups and resources in that subscription. Azure Policy has a free tier and a paid tier (Azure Policy as Code) for advanced compliance reporting.

Azure Blueprints enable cloud architects to define a repeatable set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements. A blueprint is a package of artifacts (e.g., resource groups, policies, role assignments, ARM templates) that can be deployed to new subscriptions. Blueprints are free, but you pay for the resources they deploy.

Microsoft Defender for Cloud (formerly Azure Security Center) is a unified infrastructure security management system. It provides security posture management (Secure Score), threat detection, and recommendations. The free tier offers basic assessment and recommendations; the paid tier (Microsoft Defender for Cloud) adds advanced threat protection for workloads.

Azure Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. It uses AI to analyze security data across the enterprise. Pricing is based on data ingestion volume.

In an on-premises environment, you must purchase, configure, and maintain all security hardware and software (firewalls, IDS/IPS, SIEM, etc.). You are 100% responsible for security. In Azure, Microsoft handles physical security, hypervisor security, and network infrastructure. You focus on identity, data, and application security. Governance tools like Azure Policy do not exist on-premises—they are cloud-native, allowing you to enforce compliance at scale automatically.

You can manage security and governance through the Azure Portal (web interface), Azure CLI (command-line), Azure PowerShell, or ARM/Bicep templates. For example, to assign a policy via CLI:

az policy assignment create --name "audit-vm-managed-disks" --policy "e6b89c6c-3a7a-4a6c-8a1b-6e8c9a6d7e8f" --scope /subscriptions/12345678-1234-1234-1234-123456789abc

To view RBAC assignments:

az role assignment list --assignee user@contoso.com --all

To create a blueprint:

az blueprint create --name "MyBlueprint" --management-group "mg-Contoso"

Scenario 1: Healthcare Compliance (HIPAA) A hospital chain migrates patient records to Azure. They must comply with HIPAA, which requires encryption of protected health information (PHI) at rest and in transit, access controls, and audit logs. The team uses Azure Policy to enforce that all storage accounts have encryption enabled and deny public access. They assign the 'Audit' effect to detect non-compliant resources. Azure Blueprints deploy a secure environment with Azure SQL Database (transparent data encryption), Azure Key Vault for encryption keys, and diagnostic settings streaming logs to Log Analytics. Microsoft Defender for Cloud monitors for misconfigurations and provides Secure Score. The hospital also uses Azure AD Conditional Access to require MFA for all users accessing PHI. Common issues: forgetting to enable auditing on SQL databases, leading to compliance gaps; misconfigured NSGs allowing public access to databases. Cost: Azure Policy and Blueprints are free; Defender for Cloud paid tier costs ~$15 per resource/month; Log Analytics ingestion costs ~$2.30 per GB.

Scenario 2: Financial Services (PCI DSS) A bank processes credit card transactions and must comply with PCI DSS. They use Azure Policy to enforce that only approved regions (e.g., US East, US West) are used, and require encryption for all storage. RBAC ensures only a small team of administrators has 'Owner' permissions on the subscription. Azure Blueprints deploy a pre-configured network architecture with Azure Firewall and DDoS Protection. Azure Sentinel ingests logs from all resources and uses built-in analytics rules to detect suspicious activity, such as unusual login patterns. The bank also implements Privileged Identity Management (PIM) for just-in-time access to critical resources. Common mistakes: failing to restrict network access to the Azure SQL database, leaving it open to all IPs; not enabling audit logging on the database, which is required for PCI DSS. Cost: Azure Firewall ~$1.25/hour; DDoS Protection ~$2,944/month; Sentinel ~$2.30/GB ingested.

Scenario 3: Retail Startup (GDPR) A European e-commerce startup needs to comply with GDPR, which requires data protection and the right to be forgotten. They use Azure Policy to enforce tagging on all resources (e.g., 'DataClassification: Personal'). Azure AD B2C handles customer identity and allows users to delete their accounts. Azure Key Vault stores database connection strings and API keys. The startup uses RBAC to give developers 'Contributor' access to development resource groups but 'Reader' to production. They also set up Azure Policy to deny creation of resources in non-EU regions to ensure data stays within GDPR boundaries. Common issues: not enabling diagnostic logs for key services, making it hard to audit data access; forgetting to enforce encryption at rest on Azure SQL Database. Cost: Azure AD B2C is free for first 50,000 MAU; Key Vault ~$0.03 per 10,000 operations; Azure Policy free.