Practical Security Monitoring and Response in Microsoft Azure

Darren Leong presents a practical approach to Azure security monitoring and incident response, emphasizing zero trust, identity-centric security, and proactive defense. 01:30

Key Takeaways:
• Zero Trust centers on verifying explicitly, enforcing least privilege access, and assuming breach by ingesting logs and documenting response plans 01:30
• Secure identity with MFA everywhere, document exceptions, track privileged identities, and leverage Conditional Access as if-then rules 04:00
• Microsoft Entra provides risky sign-in detection, unfamiliar location baselining, and smart lockout (event 50053) blocking password spray attacks 10:30
• Key detection opportunities include Graph API audit logs (public preview), CLI tool access, and PIM role abuse outside business hours 15:00
• Incident response preparation—ingesting logs into SIEM via Graph Security API and defining use cases and runbooks—is the most critical step 25:30
• Proactive defense includes running AzureHound, leveraging Microsoft on-demand assessments, and applying threat intelligence for new cloud TTPs 28:00

Effective Azure security requires shifting from perimeter-based thinking to identity-centric monitoring, combining strong preventive controls with detection and proactive threat hunting.

Sources:

• 01:30 Zero trust principles
• 04:00 Identity security and Conditional Access
• 10:30 Entra risk-based analytics
• 15:00 Detection opportunities
• 25:30 Incident response preparation
• 28:00 Proactive defense