Azure security fundamentals for small teams

Azure security basics come down to a handful of building blocks: who can sign in (Microsoft Entra ID), what they can touch (subscriptions and role-based access control), how the platform tells you about risky settings (Microsoft Defender for Cloud), what is reachable from the internet (network controls), and whether you can recover (backups). This guide explains each one for small teams, using Microsoft’s documentation and the ACSC’s cloud guidance, and links to our deeper Microsoft 365 and Entra guides where they overlap.

Why it matters

Microsoft’s shared responsibility documentation says: “For all cloud deployment types, you own your data and identities.” Microsoft runs the datacentres and physical hosts; the customer decides who has access, how resources are configured and what is exposed. Our explainer on the shared responsibility model has Microsoft’s full responsibility table.

Microsoft’s Azure security documentation groups its best practices into areas including identity management and access control, network security, data security and encryption, operational security, and IaaS and PaaS workloads. This page covers the starting points.

How sign-ins work: Microsoft Entra ID

Azure sign-ins go through Microsoft Entra ID, the identity service also used by Microsoft 365. Microsoft describes managed identities, for example, as workload identities in Microsoft Entra ID. Our guide to Microsoft Entra ID basics explains the directory itself.

What mandatory MFA for Azure covers

Microsoft’s documentation describes enforcing MFA in two phases:

• Phase 1 (from October 2024): MFA for accounts signing in to the Azure portal, Microsoft Entra admin center and Microsoft Intune admin center.
• Phase 2 (rolling out gradually from 1 October 2025): MFA for create, update and delete operations through Azure CLI, Azure PowerShell, the Azure mobile app, infrastructure-as-code tools, REST API endpoints and the Azure SDK. Microsoft says “Read operations won’t require MFA.”

Microsoft’s page says Phase 2 could be postponed until 1 July 2026; that date has now passed. It also says that once enforcement has started, a Global Administrator can ask Microsoft support to lift it temporarily.

Microsoft says there is no way to opt out, that break-glass accounts are included (it recommends passkeys or certificate-based authentication for them), and that managed identities and service principals aren’t affected, while user accounts used as service accounts are. To prepare, Microsoft describes a Conditional Access policy requiring MFA (which needs Entra ID P1 or P2) or, otherwise, security defaults. See security defaults vs Conditional Access.

How to limit access with subscriptions and RBAC

Azure organises resources in layers: management groups, subscriptions, resource groups and individual resources. Role-based access control (RBAC) grants a role to an identity at one of those scopes, and the permission flows down to everything beneath it.

Microsoft’s Azure RBAC best practices describe:

• granting “the least privilege to get their work done” and avoiding “broader roles at broader scopes even if it initially seems more convenient”
• a maximum of three subscription owners “to reduce the potential for breach by a compromised owner”
• using a job-function role instead of a privileged administrator role where possible, and a narrow scope such as a resource group when a privileged role is needed
• assigning roles to groups rather than directly to users
• Privileged Identity Management (PIM) for just-in-time privileged access that is time-bound and revoked automatically.

Separate subscriptions or resource groups for production and testing are one way to apply Microsoft’s narrow-scope guidance, so broad test permissions don’t reach live systems. For the cross-platform view, see cloud identity and access management, and for Entra admin roles, Microsoft 365 admin roles and least privilege.

Managed identities instead of stored credentials

Microsoft describes managed identities as letting applications obtain Entra tokens “without having to manage any credentials”, at “no extra cost”. An Azure web app or virtual machine can be given a managed identity and an RBAC role on, say, a storage account or Key Vault, so no password or key sits in its configuration. See secrets and API keys.

What Defender for Cloud includes for free

Microsoft says Defender for Cloud “includes foundational CSPM capabilities and access to Microsoft Defender XDR for free.” CSPM stands for cloud security posture management: checking configurations against a benchmark and recommending fixes.

According to Microsoft, the free Foundational CSPM includes:

• security recommendations based on the Microsoft cloud security benchmark
• a secure score
• asset inventory, workbooks and data export
• remediation tools and workflow automation.

Microsoft says the paid Defender CSPM plan adds features such as attack path analysis, agentless vulnerability scanning and regulatory compliance assessments, and that its billing “is based on specific resources enabled in your subscriptions or connectors.” Microsoft’s get-started guide says paid plans are free for the first 30 days, or until a plan’s usage limit is reached, whichever comes first.

How to open Defender for Cloud on a subscription

Based on Microsoft’s instructions (checked October 2026). Portal menus can change; Microsoft’s Defender for Cloud get-started guide has the latest steps.

1. Sign in to the Azure portal.
2. Search for and select Microsoft Defender for Cloud. The overview page opens.
3. Microsoft says Defender for Cloud is then enabled with its basic features, including foundational CSPM, recommendations, asset inventory and secure score.
4. Review Recommendations and the secure score.
5. Paid plans are turned on separately: in the Defender for Cloud menu, select Environment settings, select the subscription, switch individual plans to On (or select Enable all), then select Save. Microsoft says charges begin once the trial ends.

Microsoft says viewing a resource’s information requires the Owner, Contributor or Reader role for its subscription or resource group.

How to limit what’s reachable from the internet

The ACSC’s Cloud computing security for tenants guidance includes IaaS mitigations relevant to Azure virtual machines:

• administering virtual machines from “a corporately approved and secured computer”, and protecting SSH and RDP keys with a strong passphrase
• limiting virtual machine network connectivity to only the ports and protocols required, using host firewalls and the provider’s access controls.

In practice that means knowing which resources have a public IP address and which ports are open to the internet, especially remote administration ports. Microsoft’s guide Secure your Azure Virtual Network deployment describes several Azure features for this:

• Network security groups (NSGs): Microsoft describes applying NSGs “to subnets and network interfaces to control inbound and outbound traffic based on source IP, destination IP, port, and protocol.”
• Deny by default: Microsoft describes “a deny-by-default, permit-by-exception approach to reduce the attack surface.”
• Fewer public IP addresses: Microsoft says to “Minimize the number of public IP addresses”, and where they’re needed, to use port management, traffic filtering and request validation.
• Azure Bastion: Microsoft describes using Azure Bastion “to securely connect to virtual machines over RDP or SSH without exposing them to the public internet.”
• Time-limited admin roles: Microsoft describes Privileged Identity Management “to provide time-limited access to network administration roles.”

More is in the network security section of Microsoft’s Azure security documentation. Storage exposure is covered separately in cloud storage permissions.

How backups and recovery work in Azure

The ACSC’s tenants guidance lists performing “up-to-date encrypted backups in a format avoiding CSP lock-in”, and describes storing backups offline or with a second provider, requiring MFA to modify or delete them, and testing recovery annually.

Within Azure, Microsoft describes Azure Backup as “secure by default”:

• soft delete is enforced by default for new vaults, so deleted backup items can be recovered for a period
• the default soft-delete retention is 14 days, extendable to 180 days
• Microsoft says there’s no retention cost for the default 14 days for vaulted backups.

Microsoft notes availability differs by vault type and region. The broader backup ideas are covered in the 3-2-1 backup rule.

How long Azure keeps activity logs

Microsoft says Azure retains activity log events for 90 days and then deletes them, and describes diagnostic settings to keep them longer. See cloud logging and monitoring for the activity log, retention and alerts.

A fictional example

Lena joins a five-person software business, apps.example, as its first IT hire. The Azure subscription has four owners, a test virtual machine with remote desktop open to the internet, and no backups. Working from Microsoft’s documentation, she opens Defender for Cloud to see the free recommendations and secure score, reduces owners to two named accounts, assigns developers a narrower role through a group on the test resource group only, restricts the test machine’s open ports with a network security group in line with the ACSC’s IaaS mitigations, and sets up Azure Backup for the production database server. She notes each change and when to review it.

Things to watch for

• Too many owners. Microsoft’s guidance states a maximum of three.
• Service automation on user accounts. Microsoft notes these are affected by mandatory MFA.
• Remote administration open to the internet. The ACSC describes limiting connectivity to required ports and protocols.
• Free tier versus paid plans. Turning on all Defender plans starts billing after trials end.
• Backups in the same blast radius. The ACSC describes offline or second-provider backups and MFA for deleting them.
• Things that change. Azure features, names and defaults change often; Microsoft Learn has current details.

Common questions

How do I secure my Azure subscription as a small team?

Microsoft’s documentation and the ACSC’s cloud guidance describe a handful of starting points: prepare for mandatory MFA, keep subscription owners to three or fewer, assign narrow roles to groups, and use managed identities instead of stored keys. They also cover reviewing Defender for Cloud’s free recommendations, limiting what’s reachable from the internet, and setting up backups that can be recovered. Each links to a section of this guide, starting with how sign-ins work.

Is Microsoft Defender for Cloud free?

Partly. Microsoft says Defender for Cloud includes foundational CSPM capabilities for free, including security recommendations based on the Microsoft cloud security benchmark, a secure score and asset inventory. Paid plans such as Defender CSPM add features like attack path analysis and are billed by resource. Microsoft’s get-started guide says paid plans are free for the first 30 days or until a usage limit is reached. See what Defender for Cloud includes for free.

Is MFA mandatory for Azure?

Yes, according to Microsoft. It enforces MFA for Azure portal, Entra admin center and Intune admin center sign-ins, and is gradually enforcing it for create, update and delete operations through Azure CLI, PowerShell, the mobile app, infrastructure-as-code tools, REST APIs and the Azure SDK. Microsoft says there’s no way to opt out and break-glass accounts are included, while managed identities and service principals aren’t affected. See what mandatory MFA covers.

How many owners should an Azure subscription have?

Microsoft’s RBAC best practices state a maximum of three subscription owners, to reduce the potential for breach by a compromised owner. Microsoft also describes granting the least privilege needed, using job-function roles at narrow scopes such as a resource group, assigning roles to groups rather than directly to users, and Privileged Identity Management for time-bound access. See how to limit access with subscriptions and RBAC.

Does Azure back up my data automatically?

Not by itself. Microsoft’s shared responsibility documentation says the customer owns their data and identities, and Azure Backup is a service the customer configures. Microsoft describes Azure Backup as secure by default, with soft delete enforced for new vaults and a 14-day default retention, extendable to 180 days. The ACSC describes offline or second-provider backups and testing recovery annually. See how backups and recovery work in Azure.

What do I do if I think my Azure account has been compromised?

The ACSC takes reports through ReportCyber and runs a 24/7 hotline on 1300 CYBER1 (1300 292 371). Microsoft says Azure keeps activity log events for 90 days before deleting them, and describes diagnostic settings to keep them longer, so those records can help show what changed. Our guide to cloud logging and monitoring covers the activity log, and where to get official help has the links.

Where to get official help

• Microsoft Learn’s Azure security documentation has Microsoft’s best practices and current feature details.
• The ACSC for cloud security guidance, ReportCyber and the 24/7 hotline (1300 CYBER1, 1300 292 371).