Azure Services Companion Guide

Azure Virtual Machines (VMs)

Purpose

Azure VMs provide scalable, on-demand compute resources for running applications in a virtualized environment.

Capabilities

Supports multiple operating systems, flexible scaling, integration with Azure services, and high availability.

Pairings

Azure Key Vault: Secures sensitive information like passwords and keys.
Azure Load Balancer: Distributes traffic across multiple VMs for high availability.
Azure Security Center: Provides security monitoring and threat detection for VMs.

Crown Jewels

Critical applications and user access environments on VMs are essential for business continuity.

Best Practice Mitigations

Use multi-factor authentication, enforce RBAC, and enable data encryption at rest.

Applicable Controls

Network security groups, access control, and continuous monitoring with Defender for Endpoint or Deffender for Cloud(Server).

Azure SQL Database

Purpose

Managed relational database service for high-performance applications with availability, scalability, and security.

Capabilities

Automated backups, scaling, built-in intelligence, and AD integration for secure access control.

Pairings

Azure Key Vault: Protects database connection strings and credentials.
Azure Active Directory: Manages access control for SQL databases.
Azure Data Factory: Enables ETL workflows for data processing and storage in SQL Database.

Crown Jewels

Stores business-critical data, user information, and historical data for analytics.

Best Practice Mitigations

Enable TDE for data protection, use threat detection, and enforce RBAC.

Applicable Controls

Firewall settings, SSL/TLS for data transit, and geo-replication for availability.

Azure Kubernetes Service (AKS)

Purpose

Managed Kubernetes service that simplifies deployment and management of containerized applications.

Capabilities

Automated scaling, monitoring, and secure management for container workloads.

Pairings

Azure Monitor: Tracks containerized app performance.
Azure Container Registry: Hosts container images securely for AKS deployment.

Crown Jewels

Hosts scalable app workloads involving sensitive data and high-traffic applications.

Best Practice Mitigations

Implement RBAC, use private registries for images, and monitor with Defender for Cloud(Containers).

Applicable Controls

RBAC, network security policies, and logging.

Azure App Service

Purpose

A fully managed platform for building, deploying, and scaling web apps and APIs.

Capabilities

Supports multiple languages, integrated DevOps, and high availability.

Pairings

Azure SQL Database: Backend data management.
Azure DevOps: Streamlined CI/CD deployment for updates and releases.

Crown Jewels

Critical application code and user data served by web and API services.

Best Practice Mitigations

Enable HTTPS, use secure data connections, and restrict IP access.

Applicable Controls

Access control, encryption, monitoring with Application Insights.

Azure Functions

Purpose

Enables serverless computing, running code in response to events.

Capabilities

Auto-scaling, pay-per-use pricing, and integration with Azure services.

Pairings

Event Grid: Event-driven automation.
Cosmos DB: Data persistence and querying for function-triggered events.

Crown Jewels

Critical business logic and workflow automation code.

Best Practice Mitigations

Secure function keys, limit access, and use Application Insights for monitoring.

Applicable Controls

Identity-based access control, secure keys, and monitoring.

Azure Cosmos DB

Purpose

Globally distributed, multi-model database service for mission-critical applications.

Capabilities

Multi-region writes, automatic scaling, and low-latency response times.

Pairings

Azure Functions: Real-time processing and automation.
Azure Kubernetes Service (AKS): Microservice data storage.

Crown Jewels

Stores sensitive and transactional data that must be highly available.

Best Practice Mitigations

Use private endpoints, enable automatic backups, and implement role-based access control.

Applicable Controls

Network security, RBAC, and data encryption.

Azure Key Vault

Purpose

Manages cryptographic keys, secrets, and certificates for secure access.

Capabilities

Secret management, key management, and certificate management.

Pairings

Azure Virtual Machines: Secure sensitive data like passwords.
App Service: Protects API keys and database connection strings.

Crown Jewels

Protects critical secrets, keys, and certificates used across applications.

Best Practice Mitigations

Enable access logging, use soft delete, and limit key permissions.

Applicable Controls

Access control, encryption, and audit logging.

Azure Storage

Purpose

Secure, scalable storage for large amounts of structured and unstructured data.

Capabilities

Blob storage, file storage, table storage, and queue storage.

Pairings

Azure Content Delivery Network (CDN): Distributes files globally.
Azure Backup: Provides long-term retention for storage data.

Crown Jewels

Stores essential business data and backups.

Best Practice Mitigations

Enable TLS, restrict IP ranges, and set up redundancy.

Applicable Controls

Data encryption, access control, and redundancy.

Azure Synapse Analytics

Purpose

Integrated analytics service for big data and data warehousing.

Capabilities

Unified analytics experience with SQL, Spark, and data integration.

Pairings

Azure Data Lake: Stores big data for Synapse analysis.
Power BI: Visualizes Synapse data for insights.

Crown Jewels

Stores and processes business insights data for decision-making.

Best Practice Mitigations

Use data encryption, network isolation, and auditing.

Applicable Controls

Access control, data masking, and logging.

Azure SQL Managed Instance

Purpose

Fully managed database service that supports SQL Server workloads in the cloud.

Capabilities

Full SQL Server compatibility, automated backups, and high availability.

Pairings

Azure Active Directory: Provides secure access control.
Azure Blob Storage: Offloads backups to blob storage for long-term retention.

Crown Jewels

Critical data supporting business applications and customer interactions.

Best Practice Mitigations

Use encryption, secure networking, and regular audits.

Applicable Controls

Access control, backup encryption, and network isolation.

Azure Event Hubs

Purpose

Event Hubs is a fully managed data streaming platform and event ingestion service, capable of receiving and processing millions of events per second.

Capabilities

Supports real-time data streaming, event storage, and integration with analytics services.

Pairings

Azure Stream Analytics: Provides real-time analytics for data ingested by Event Hubs.
Azure Data Lake: Stores large volumes of raw event data for batch processing.

Crown Jewels

Ingests, stores, and processes high-frequency event data from various sources.

Best Practice Mitigations

Enable private endpoints, limit access through IP filters, and configure logging and monitoring.

Applicable Controls

Network security, access policies, and monitoring through Azure Monitor.

Azure Logic Apps

Purpose

Logic Apps enables automation of workflows and integration with other Azure services, on-premises, and third-party applications.

Capabilities

Automates complex workflows, supports connectors for seamless integration, and offers a visual designer for easy setup.

Pairings

Azure Functions: Extends workflow capabilities with custom code executions.
Power Automate: Enables further automation across Microsoft 365 services.

Crown Jewels

Automates critical business processes and integrates multiple services for streamlined operations.

Best Practice Mitigations

Use secure connections, enforce role-based access control, and monitor workflow execution logs.

Applicable Controls

Access control, secure connections, and audit logging.

Azure Data Factory

Purpose

Data Factory is a cloud-based ETL service for orchestrating data movement and transforming data at scale.

Capabilities

Offers data ingestion, transformation, and movement capabilities for large-scale data processing.

Pairings

Azure Synapse Analytics: Loads and prepares data for advanced analytics.
Azure SQL Database: Supports data storage and querying for transformed data.

Crown Jewels

Manages and processes data critical for analytics, reporting, and decision-making.

Best Practice Mitigations

Use private endpoints, configure access control policies, and monitor data activity.

Applicable Controls

Access control, monitoring, and secure data transfer.

Azure IoT Hub

Purpose

IoT Hub provides a secure communication channel between IoT applications and the devices they manage.

Capabilities

Supports bidirectional communication, device authentication, and real-time monitoring of connected devices.

Pairings

Azure Stream Analytics: Analyzes device data in real-time.
Azure Digital Twins: Models physical environments for real-time insights.

Crown Jewels

Enables secure management of IoT device data and interactions with applications.

Best Practice Mitigations

Use X.509 certificates for device authentication, enable private endpoints, and monitor IoT Hub activities.

Applicable Controls

Device authentication, access control, and monitoring.

Azure Cognitive Services

Purpose

Cognitive Services provides AI-powered algorithms for vision, speech, language, and decision-making.

Capabilities

Offers pre-built APIs to enable natural and contextual interactions in applications.

Pairings

Azure Machine Learning: Enhances and customizes cognitive models.
Power BI: Visualizes AI-generated insights for business intelligence.

Crown Jewels

Delivers AI-driven insights and capabilities that enhance user experience and decision-making.

Best Practice Mitigations

Use API keys securely, monitor API usage, and implement data access policies.

Applicable Controls

Access control, secure API management, and usage monitoring.

Azure DevOps

Purpose

DevOps is a set of development tools for building, testing, and deploying applications efficiently.

Capabilities

Provides version control, CI/CD pipelines, and project management tools.

Pairings

GitHub: Enables collaboration and source control management.
Azure Kubernetes Service (AKS): Deploys containerized apps using automated pipelines.

Crown Jewels

Supports streamlined development workflows, essential for continuous integration and delivery.

Best Practice Mitigations

Use role-based access control, enforce code review policies, and enable logging and auditing.

Applicable Controls

Access policies, CI/CD security, and audit logging.

Azure Virtual Network (VNet)

Purpose

VNet enables secure communication between Azure resources and on-premises networks.

Capabilities

Supports network segmentation, secure communication, and virtualized network management.

Pairings

Network Security Groups (NSGs): Controls network access within VNet.
Azure Firewall: Provides enhanced security for traffic entering and leaving the VNet.

Crown Jewels

Critical for isolating and securing Azure workloads and connections.

Best Practice Mitigations

Use NSGs for access control, limit IP ranges, and enable logging.

Applicable Controls

Network security, traffic filtering, and logging.