Task 03: Configure Security Baselines

DOCUMENT CATEGORY: Runbook
SCOPE: Security baseline configuration
PURPOSE: Review and remediate security recommendations
MASTER REFERENCE: Microsoft Learn - Security Baselines

Status: Active

Security baselines provide a standardized set of security configurations based on Microsoft best practices. This step reviews Defender for Cloud recommendations and remediates high-priority findings before Azure Local deployment.

Proactive Security

Addressing security recommendations before deploying Arc-enabled servers and the Azure Local cluster reduces the attack surface and simplifies post-deployment hardening.

Overview

Baseline Category	Focus Area	Priority
Compute	VM security, extensions, encryption	High
Networking	NSG rules, public access, network segmentation	High
Identity	RBAC, privileged accounts, MFA	High
Data	Encryption at rest, Key Vault configuration	Medium
Monitoring	Diagnostic settings, log retention	Medium

Prerequisites

• Defender for Cloud enabled (Step 2)
• Azure Policy initiatives assigned (Step 3)
• Security Administrator role or equivalent

Variables from variables.yml

Variable	Config Path	Example
AZURE_SUBSCRIPTION_ID	azure.subscription.id	00000000-0000-0000-0000-000000000000
AZURE_RESOURCE_GROUP	azure.resource_group.name	rg-azurelocal-prod-eus2
AZURE_KEYVAULT_NAME	azure.keyvault.name	kv-azl-dal-prod-01

Procedure

Azure Portal

Review Security Recommendations

1. Navigate to Defender for Cloud

• In Azure Portal, go to Microsoft Defender for Cloud
• Click Recommendations in the left menu

2. Filter by Severity

• Set Severity filter to High
• Review the list of high-severity recommendations

3. Review by Resource Type

• Click Inventory to view resources
• Filter by resource type (VMs, Key Vaults, Storage, etc.)
• Click a resource to see its security findings

Remediate High-Priority Recommendations

Key Vault Recommendations

1. Key Vault should use RBAC permission model

• Navigate to Key Vault → Access configuration
• Select Azure role-based access control
• Click Save

2. Key Vault should have soft delete enabled

• Navigate to Key Vault → Properties
• Verify soft delete is enabled (default in new vaults)

3. Key Vault should have purge protection enabled

• Navigate to Key Vault → Properties
• Enable Purge protection

Network Recommendations

1. Subnets should be associated with an NSG

• Navigate to Virtual Network → Subnets
• Verify each subnet has an NSG attached
• Apply NSGs created in Stage 06

2. Management ports should be protected with JIT

• In Defender for Cloud, go to Workload protections
• Click Just-in-time VM access
• Enable JIT for management VMs

Storage Recommendations

1. Storage accounts should use private link

• Navigate to Storage account → Networking
• Configure private endpoints (if required)

2. Secure transfer to storage accounts should be enabled

• Navigate to Storage account → Configuration
• Verify Secure transfer required is enabled

Export Recommendations

1. Export to CSV

• In Recommendations view, click Download CSV
• Save for documentation and tracking

2. Configure Continuous Export

• Go to Environment settings → Your subscription
• Click Continuous export
• Configure export to Log Analytics or Event Hub

Standalone Script

# Variables
$subscriptionId = "<your-subscription-id>"
$resourceGroup = "rg-management-prod-eastus2"
$keyVaultName = "kv-azlmgmt-prod-eus2"

# Connect and set context
Connect-AzAccount
Set-AzContext -SubscriptionId $subscriptionId

# Get security assessments (recommendations)
$assessments = Get-AzSecurityAssessment

# Filter unhealthy (non-compliant) assessments
$unhealthyAssessments = $assessments | Where-Object { 
 $_.Status.Code -eq "Unhealthy" 
}

Write-Host "Security Recommendations Requiring Attention:" -ForegroundColor Cyan
Write-Host "=============================================" -ForegroundColor Cyan

# Group by severity
$grouped = $unhealthyAssessments | Group-Object { $_.Metadata.Severity }

foreach ($group in $grouped) {
 $color = switch ($group.Name) {
 "High" { "Red" }
 "Medium" { "Yellow" }
 "Low" { "White" }
 default { "Gray" }
 }
 Write-Host "`n$($group.Name) Severity ($($group.Count) items):" -ForegroundColor $color
 
 $group.Group | ForEach-Object {
 Write-Host " • $($_.DisplayName)" -ForegroundColor $color
 }
}

# Remediation: Enable purge protection on Key Vault
Write-Host "`nApplying Key Vault security baseline..." -ForegroundColor Cyan

$keyVault = Get-AzKeyVault -VaultName $keyVaultName -ResourceGroupName $resourceGroup

if (-not $keyVault.EnablePurgeProtection) {
 Update-AzKeyVault `
 -VaultName $keyVaultName `
 -ResourceGroupName $resourceGroup `
 -EnablePurgeProtection
 Write-Host "✅ Purge protection enabled on Key Vault" -ForegroundColor Green
} else {
 Write-Host "✓ Purge protection already enabled" -ForegroundColor Green
}

# Verify Key Vault uses RBAC
if ($keyVault.EnableRbacAuthorization) {
 Write-Host "✓ RBAC authorization enabled on Key Vault" -ForegroundColor Green
} else {
 Write-Host "⚠️ Key Vault using Access Policies - consider migrating to RBAC" -ForegroundColor Yellow
}

Write-Host "`n✅ Security baseline review complete" -ForegroundColor Green

Orchestrated Script

When to use: Use this option when deploying across multiple nodes from a management server using ariables.yml.

Script: See azurelocal-toolkit for the orchestrated script for this task.

Content Pending

Orchestrated script content references the toolkit repository. See the Standalone Script tab for a self-contained implementation.

Common Recommendations for Azure Local

Recommendation	Category	Remediation
Enable MFA for accounts with owner permissions	Identity	Configure Conditional Access (Step 6)
Subnets should be associated with NSG	Network	Apply NSGs from Stage 06
Key Vault should use RBAC	Data	Update Key Vault access model
Enable Defender for servers	Compute	Enable in Defender for Cloud (Step 2)
Storage accounts should restrict network access	Data	Configure private endpoints
Management ports should be protected	Network	Enable JIT access

Validation

# Get secure score
$secureScore = az security secure-score show --name ascScore | ConvertFrom-Json
Write-Host "Current Secure Score: $($secureScore.score.current) / $($secureScore.score.max)" -ForegroundColor Cyan

# Get recommendation count by status
$recommendations = az security assessment list | ConvertFrom-Json
$healthy = ($recommendations | Where-Object { $_.status.code -eq "Healthy" }).Count
$unhealthy = ($recommendations | Where-Object { $_.status.code -eq "Unhealthy" }).Count

Write-Host "`nRecommendation Status:"
Write-Host " Healthy: $healthy" -ForegroundColor Green
Write-Host " Unhealthy: $unhealthy" -ForegroundColor $(if ($unhealthy -gt 0) { "Yellow" } else { "Green" })

Expected Output

Current Secure Score: 72 / 100

Recommendation Status:
 Healthy: 45
 Unhealthy: 8

Secure Score Target

Score Range	Status	Action
80-100%	Excellent	Maintain current posture
60-79%	Good	Address high-severity items
40-59%	Fair	Prioritize remediation plan
0-39%	Poor	Immediate attention required

note

Secure score may take up to 24 hours to reflect changes after remediation.

---

Troubleshooting

Issue	Cause	Resolution
Secure score not updating after remediation	Assessment cycle not yet completed	Wait up to 24 hours; force refresh by navigating to Defender for Cloud > Secure score and clicking refresh
Remediation script fails with authentication errors	Azure context expired or wrong subscription	Re-authenticate: Connect-AzAccount; verify context: Get-AzContext; set correct subscription
Recommendations show resources not in scope	Policy evaluation includes resources outside intended scope	Review assignment scope; add exclusions for out-of-scope resource groups or subscriptions

Next Steps

Proceed to Task 5: Enable Security Logging to configure security event collection.

---

Toolkit Reference

Scripts for this task are located in the azurelocal-toolkit repository under scripts/deploy/ in the appropriate task folder.

---

Alternatives

The procedures in this task use the scripted methods shown in the tabs above. Additional deployment methods including Azure CLI and Bash scripts are available in the azurelocal-toolkit repository under scripts/deploy/.

Method	Description
Azure CLI	PowerShell-based Azure CLI scripts for Azure resource operations
Bash	Linux/macOS compatible shell scripts for pipeline environments

Navigation

Previous	Up	Next
← Task 02: Azure Policy	Phase 04: Security & Governance	Task 04: Security Logging →

---

Version	Date	Author	Changes
1.0.0	2026-03-24	Azure Local Cloud	Initial release

---

Version Control

Version	Date	Author	Changes
1.0.0	2025-03-25	Azure Local Cloud	Initial release