Finding, preventing and evidencing misconfigurations in Azure

An Azure environment that runs is not necessarily one that is securely configured. Many environments grow over years, project by project, and nobody has the overall state in view. For management, this is a liability question: whether a misconfiguration will lead to an incident cannot be known in advance, but whether it was known and being addressed can. This article shows which points we check first and how to bring them under lasting control with Microsoft tools.

How do you find misconfigurations in Azure systematically?

With Microsoft Defender for Cloud. Even the free Foundational CSPM tier assesses all resources in a subscription against the Microsoft cloud security benchmark, provides concrete recommendations and condenses the result into the secure score. For management, the score is a trend value: it shows whether the situation is improving. For IT, the recommendations are the work list, sorted by affected resources and severity. Advanced capabilities such as attack path analysis or additional standards in the compliance dashboard require the paid Defender CSPM plan.

The score is a trend indicator; it does not prove security. A number alone says nothing about whether the remaining findings are the critical ones.

Which misconfigurations do we check first?

Overly broad permissions

Anyone with permanent Owner or Contributor rights at subscription level can change or delete the entire environment if their account is compromised. The answer is the least-privilege principle: rights only as broad as necessary, and time-limited for privileged roles through Privileged Identity Management (PIM) for Azure resources. Defender for Cloud flags subscriptions with too many owners and privileged accounts without MFA.

Missing network segmentation

In flat virtual networks, every resource can reach every other. An attacker who gains access to one resource can move laterally through the environment. Separate subnets per workload, restrictive network security groups (NSGs, rule sets for network traffic) and private endpoints that separate PaaS services from the public internet address this.

Publicly accessible storage accounts

Blob containers with anonymous read access make data readable from the internet without sign-in, often unintentionally. Azure Storage encrypts data at rest by default; the risk lies in the access configuration. Disallow anonymous access at storage account level, prefer managed identities over account keys, and issue SAS tokens only with short validity.

Missing logging

Without diagnostic settings, the data needed to detect an incident and reconstruct it later is missing. The activity log, Entra sign-in logs and resource logs belong centrally in a Log Analytics workspace or Microsoft Sentinel, with active analytics rules for security-relevant events.

Gaps in sign-in protection

Since 1 October 2025, Microsoft has been gradually introducing mandatory MFA for create, update and delete operations through Azure CLI, PowerShell and infrastructure-as-code tools. User accounts running as service accounts in scripts should therefore be replaced by managed identities or other workload identities. Also check whether Conditional Access policies block legacy authentication. How to introduce Conditional Access without locking users out is covered in a separate article.

How do Azure Policy and landing zones prevent new misconfigurations?

A fixed finding returns as soon as someone creates the next resource by hand. Azure Policy therefore enforces rules on every create and update. The policy effects are decisive: “audit” marks deviating resources as non-compliant, “deny” rejects the request before the resource is created, and “deployIfNotExists” adds missing settings such as diagnostic settings automatically.

A two-stage approach has proven itself: assign policies with “audit” first, evaluate the impact, then switch to “deny”. Combine several policies into an initiative and assign it to a management group so that it applies to all subscriptions below.

An Azure landing zone provides the framework for this: a hierarchy of management groups, subscriptions for platform and workloads, and a baseline of policies, roles and central services such as logging and networking. The Microsoft reference architecture assigns policies that must apply everywhere at the top of the hierarchy and more specific requirements further down. New subscriptions inherit the rules as soon as they are placed in the right management group.

How do findings become evidence?

Evidence shows the current state and how deviations were handled. Three sources contribute:

• Compliance dashboard in Defender for Cloud: It shows the status against the Microsoft cloud security benchmark and can be downloaded as a PDF or CSV report.
• Continuous export: Recommendations, secure score and compliance status can be exported continuously or as weekly snapshots to a Log Analytics workspace. This creates a history that still shows months later when a finding was open and when it was fixed.
• Policy compliance and exemptions: The Azure Policy compliance state documents which resources meet the rules. Record justified deviations as a policy exemption with category, justification and expiry date instead of switching the rule off.

For auditors working against NIS2, DORA or ISO 27001, this combination of rule, measurement and documented exemption is considerably more convincing than a one-off screenshot.

The next step

Our Azure Cloud Security services cover landing zone build-out, policy design and the operation of Defender for Cloud. If you first want to know where your environment stands, our Gap Assessment reviews your Azure subscriptions at a fixed price and delivers a prioritised list of actions.

Book an introductory call

Frequently Asked Questions

Which Azure misconfiguration has the widest impact?

Permanent Owner or Contributor rights at subscription level, because a single compromised account can then change every resource in that subscription. Privileged Identity Management limits the risk by activating rights only on request and for a limited time.

Does Microsoft Defender for Cloud cost extra?

The Foundational CSPM tier with recommendations, secure score and the Microsoft cloud security benchmark is free. The Defender CSPM plan and the workload protection plans, for example for servers or databases, are billed per resource.

Is it enough to configure network security groups once?

No. Environments change, and every new service creates exceptions. Plan regular reviews and enforce baseline rules, for example against public IP addresses on network interfaces, through Azure Policy.

How do I know whether my Azure logs are actually being analysed?

Check whether the activity log and resource logs flow via diagnostic settings into a Log Analytics workspace or Microsoft Sentinel, and whether active analytics rules there generate alerts. Logs that are stored but never analysed only help after an incident.