Credits and sources Microsoft Learnhttps://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-key-vault-introduction Intro In this part of the blog series, I want to show you what Microsoft Defender for Key Vault (MDKV) brings. MDKV helps to protect the Azure Key Vaults against suspicious activities, and it does so without any agent installation. MDKV is one of the most straightforward features to manage. Still, it does protect some of the most sensitive resources you will have in Azure, like, for instance, certificates and secrets used to access your resources and data.

Credits and sources Microsoft Learnhttps://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns-introduction Intro In this part of the blog series, I want to show you what Microsoft Defender for DNS (MDDNS) brings. MDDNS helps to protect the Azure DNS services against suspicious activities, and it does so without any agent installation. Microsoft Defender for DNS features The features that MDDNS offers are protection against: Data exfiltration Malware DNS attacks Communication with domains used for malicious activities (phishing and crypto mining) Microsoft Defender for DNS alerts Microsoft Learn Docs provides a complete list of alerts that MDDNS provides; see the link below.

Credits and sources Microsoft Learnhttps://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls Intro In this part of the blog series, I want to show you how to remediate or dismiss the recommendation that Microsoft provides. Most of the recommendations are something you will want to implement, but some recommendations might not fit your environment. There are multiple ways of dismissing the recommendation. Here I will show you two, one is to waive the recommendation, and the other is to disable the policy that provides the recommendation.

Credits and sources Microsoft Learnhttps://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction TechTargethttps://www.techtarget.com/searchsecurity/definition/Cloud-Security-Posture-Management-CSPM Intro In this blog series, I want to focus on how Microsoft Defender for Cloud (MDFC) can help secure your Azure environment. MDFC is a collection of Defender products that provides security and visibility into your security posture in Azure. Still, many security features can also cover on-premises and other public clouds. MDFC offers free features and a range of paid features for your cloud workloads.

Credits and sources Microsoft Learnhttps://learn.microsoft.com/en-us/azure/bastion/bastion-overview Intro I want to look closely into the Azure Bastion service in this post. Azure Bastion is a service that provides secure remote access to Azure virtual machines. Bastion supports RDP and SSH for managing the virtual machines, and all traffic will use TLS for security. One of the key benefits of Bastion is that the need for a public IP address on your resources is removed.

Intro In this part of the series, I am creating the AVD session hosts so my users can start using the new Azure environment. A session host is a virtual machine that users can log in to and use their corporate software while having low latency to other resources placed in Azure. The steps I will go through in this post are. Deploy a virtual machine Install the AVD components on the virtual machine.

Intro In this part of the series, I want to ensure that all permissions are given to the correct groups. I could provide access to individual users, but I try to stick to groups as they are easier to manage across an enterprise. I have identified the following permissions I need to grant to user groups. Azure AD Group to add to AVD Application groups Azure AD Group to add to “Virtual Machine User Login” RBAC role for the session hosts Azure AD Group to add to the “Storage File Data SMB Share Contributor” for the profile storage account There are a few steps to get the storage account configured, and I will go through this process in depth.

Intro I have now come to the part where I will start deploying AVD resources in my Azure environment. I am going to split the resources up into three parts. This first part will be the “backend,” meaning AVD workspace, host pool, and application groups. The next part will be on RBAC roles and security groups, and the last part will be on the session hosts. Azure virtual desktop hostpool First, I will create a host pool for AVD as a container for the session hosts.

Intro I want to deploy some network services to my environment in this part of the blog series. I first need to update my peerings to use the VPN gateway. The VPN requires a slight change in both ends of the current peering. I also want to add an Azure Firewall, which means using route tables, and finally, I want to add network security groups to my subnets in the AVD virtual network.

Intro In this part of the blog series, I want to deploy a new virtual network for my Azure Virtual Desktop environment. I also want to create a network peering between the new network and the one I already deployed named vnet-connectivity-001. Azure Virtual Desktop network As I created a virtual network already in the blogs series, I will make a copy of the code for the network and adjust it to fit this new network I am creating.