Page 169 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Azure resource locks can block deletion or modification at management scope and inherit to child resources, but authorized users can remove locks and data-plane operations may not be affected.
Read the explainer
Disallowing Shared Key rejects account-key and dependent SAS authorization while allowing supported Microsoft Entra authorization, so caller discovery and migration must precede enforcement.
Read the playbook
Azure Backup soft delete delays permanent deletion for a configured retention period, but workload and vault support, regional state, recovery-point limits, and restore procedure still require verification.
Read the playbook
Azure Update Manager scheduled patching uses maintenance configurations and requires compatible machine orchestration; a visible schedule can fail to patch a machine whose orchestration state does not match.
Read the checklist
Azure Bastion Premium can record graphical RDP and SSH sessions to Blob storage, but it records all sessions through an enabled host and has storage, identity, client, and immutability constraints.
Read the guide
Azure Monitor data collection rules define sources, schemas, transformations, and destinations, while associations decide which resources use them; either can change the telemetry available to operations and security.
Read the guide
Validate that access switches inspect IPv6 extension-header chains and fragments before relying on Router Advertisement Guard.
Read the checklist
Introduce BGP Roles and the Only-to-Customer attribute with explicit relationship mapping, interoperability tests, and a rollback path.
Read the guide
Confirm explicit import and export policy coverage before changing an eBGP platform to default-reject behavior.
Read the playbook
Use DNS Certification Authority Authorization records to express issuance policy without disrupting approved certificate workflows.
Read the playbook