Skip to content

Security Best Practices

For Azure VMs, strong security starts with the management path. If administration is exposed or poorly controlled, other hardening steps become much less valuable.

This page's baseline at a glance — the recommended practices and the validation gate:

flowchart TD
    T["Security Best Practices"]
    P1["Reduce the standing attack surface"]
    T --> P1
    P2["Use JIT for exception-based access"]
    T --> P2
    P3["Separate platform security detail from review guidance"]
    T --> P3
    V["Validation Checklist"]
    P1 --> V
    P2 --> V
    P3 --> V

Why This Matters

Attackers do not need an exotic platform failure if open management ports, broad inbound rules, or weak privileged-access patterns already exist. Security reviews should reduce routine exposure before they add advanced controls.

Reduce the standing attack surface

  • Keep inbound management ports closed unless access is actively needed.
  • Use Bastion, VPN, or ExpressRoute for day-to-day administration so public exposure is not the default.
  • Review NSG intent around management ports as part of every production change.

Use JIT for exception-based access

  • Use Defender for Cloud just-in-time access where the environment already depends on Defender for Servers Plan 2.
  • Keep the approval window and source IP scope as small as the operating model allows.
  • Treat JIT as a compensating control for necessary management access, not as permission to leave the architecture public-first.

Separate platform security detail from review guidance

Common Mistakes / Anti-Patterns

Anti-Pattern 1: Leaving SSH or RDP open “for convenience”

Convenience-based exposure becomes standing risk, and cleanup usually happens only after an alert or audit.

Anti-Pattern 2: Treating JIT as a substitute for private administration

JIT reduces exposure, but it still works best when the management path is already tightly bounded.

Anti-Pattern 3: Reviewing NSGs without reviewing operator workflow

If responders do not know how access is granted during incidents, they create emergency exceptions that bypass the intended design.

Validation Checklist

  • [ ] Public management access is disabled by default or has an approved exception.
  • [ ] JIT is used where the operating model supports Defender for Cloud controls.
  • [ ] NSG rules for management ports were reviewed explicitly.
  • [ ] The incident workflow for administrative access is documented.
  • [ ] Platform-specific identity and access choices were reviewed in the linked platform docs.

See Also

Sources