Azure Security Glossary: Core Terms for a Hands-On PoC
A concise map of Entra tenants, subscriptions, RBAC, Conditional Access, Azure Policy, Defender for Cloud, Log Analytics, and Microsoft Sentinel—with careful AWS comparisons.
Independent Hands-on Lab · Reference Architecture
Enterprise Azure Security Architecture: From Landing Zone to SOC Operations
This hands-on series demonstrates how generalized enterprise security requirements can be translated into a phased Azure architecture, implemented with measurable controls, and operationalized through identity governance, cloud security posture management, threat detection, and automated response.
12 stages2 In Progress10 Planned
Published Guides
Azure Security Foundations
Use these localized guides to establish the vocabulary and design decisions behind the lab. Publication makes the guidance available; it does not assert that a hands-on stage has been validated.
Coursera Review Series
Course Learning Notes
These lesson-by-lesson reviews revisit key ideas from the Azure Cybersecurity Solutions and Microsoft Defender course.
Learning boundary: These notes are personal learning reviews; they are not evidence that any Azure Security Lab implementation or validation has been completed.
Module 1 Review: Azure Basic Security Capabilities
Study notes on Azure DDoS Protection, virtual networks, Azure Firewall, web application firewalls, just-in-time VM access, and encryption, updated for the 2026 Azure security landscape.
Azure Defense in Depth: Build Security Layers That Still Work When One Fails
A practical method for turning Azure security layers into a verifiable architecture with clear trust boundaries, signals, owners, containment, and recovery evidence.
Azure DDoS Infrastructure Protection: What the Built-In Baseline Actually Covers
A precise guide to Azure's automatic DDoS infrastructure baseline, its workload-level gaps, and the evidence needed before claiming an application is DDoS-ready.
Azure DDoS IP Protection vs. Network Protection: Choose by Scope, Operations, and Cost
Compare Azure DDoS IP Protection and Network Protection by eligible resources, attachment scope, telemetry, response benefits, and pricing structure.
Secure an Azure VM Without a Public IP: Separate Management, Inbound, and Outbound Paths
Design a private Azure VM by separating guest administration, application ingress, explicit internet egress, and private Azure service access—with evidence for every path.
Azure VNet, Subnet, and NSG Fundamentals: Plan Address Space, Read Rules, and Verify Traffic
Learn Azure networking through a three-tier example: plan non-overlapping CIDRs, segment subnets, read stateful NSG rules, and prove both allowed and denied traffic paths.
Azure Firewall Basic vs. Standard vs. Premium: Choose by Traffic, Inspection, and Operations
Compare Azure Firewall SKUs by real traffic paths, throughput, FQDN control, threat intelligence, TLS inspection, IDPS, cost, operations, and migration risk.
Azure Firewall UDR and DNS Design: Prove the Traffic Path Before Writing Rules
Build and verify a single-region Azure Firewall hub-spoke path with UDRs, symmetric return routing, DNS Proxy, Private Resolver, DNAT, hybrid routing, and a controlled forced-tunnel branch.
Module 2 Review: Security Management in Azure
A detailed review of cloud security management, Defender for Cloud, Azure Bastion, Azure Policy, and Microsoft Sentinel SIEM/SOAR, with 2026 product corrections and validation patterns.
Module 3 Review: Connecting Microsoft Defender Threat Protection Signals
A practical review of Microsoft Defender XDR, Defender for Cloud, endpoint and identity protection, Microsoft Purview, incident correlation, and the Microsoft Sentinel connector covered in Module 3.
Module 4 Review: Designing and Proving a Layered Azure VM Defense
A final-course reflection that turns Azure DDoS, Firewall, Bastion, JIT, encryption, Policy, Defender, and Sentinel concepts into a threat-control-evidence model for securing virtual machines.
Implemented Baseline
Governance and evidence flow
Identity Stage · In Progress
Conditional Access report-only design
Roadmap
Phased security architecture
- In Progress
Secure Azure Landing Zone
Establish a governance, logging, access, policy, posture, and cost baseline.
Published design reference How to Design an Enterprise Azure Landing Zone Reference architecture; Stage 01 lab validation remains In Progress. - In Progress
Entra Conditional Access
Prepare a least-privilege, report-only identity access policy and its validation gates.
- Planned
Entra Privileged Identity Management
Model time-bound privileged access and approval controls.
- Planned
Managed Identity and Key Vault
Reduce credential exposure with workload identity and secret lifecycle controls.
- Planned
Microsoft Defender for Cloud Onboarding
Define scope, plan selection, data collection, and initial posture review.
- Planned
CSPM and Secure Score Remediation
Prioritize posture findings by risk, effort, cost, and operational impact.
- Planned
Attack Path Analysis
Trace identity, resource, and exposure relationships in a synthetic environment.
- Planned
Microsoft Sentinel Mini SOC
Create a minimal monitoring and investigation workflow for the lab.
- Planned
KQL Analytics Rules
Develop explainable detections with test criteria and known limitations.
- Planned
Logic Apps Automated Response
Automate a bounded response with approval and failure handling.
- Planned
Compromised Administrator Investigation
Document a synthetic investigation timeline, evidence, and containment decisions.
- Planned
Architecture Design Session
Review the end-to-end design, trade-offs, gaps, and production recommendations.
Validation Boundary
Lab evidence is not production evidence
The first two stages are in progress and have not been marked as validated. Planned stages remain roadmap entries rather than empty public articles. Each stage will be published only after its implementation notes, validation criteria, redacted evidence, limitations, and production recommendations are ready. A published design reference does not by itself move a hands-on stage to Lab Validated.