# Azure Security

*  
* Cloud Shared Security Responsibility Model
* * Few controls need to focus
  * * Physical Security
    * Host Security/client/end point protection
    * Network controls
    * Application Security controls
    * Identity and Access Management
    * Data Classification
*  
* Azure Subscription
* * How many subscriptions we have now ?
*  
* Azure Tenants
* * Tenant ID
*  
* \*\*\* Azure AD might have collection of subscriptions based on the cloud services onboarded
*  
*  
* Cloud based Identity and Access management service
* Azure Active Directory :
* Azure AD Rest API calls on port 80,443
*  
* Authentication and Authorization protocol's :
* AML, WS-Federation, OpenID Connect, Oauth, SAML 2.0  over HTTPS/HTTP
* Kerberos, which is used by on-premises AD.
* Uses federation services, ADFS
*  
* Azure AD helps,
* authentication with SaaS
* Applications hosted on Azure
* Authentication management, cloud and on prem applications
*  
*  
*  
* Traditional AD :
* LDAP (389) and LDAPs (686)
* Uses kerberos for authentication
* User and Groups on organization units and group policy objects
* Service principles
*  
*  
* External Users UPN's
* * Need regular audit
*  
*  
*  
*  
* Custom domain on Azure\
  DNS configuration
*  
*  
*  
* Azure AD Licensing and what features we have
* * Identity Protection
  * Privileged Identity Management
  * Azure AD Identity Security
*  
*  
*  
* Azure Groups
* * Security groups
  * MS 365 groups
*  
* Azure AD roles : access to azure AD
* Azure AD RBAC roles  : access to Azure resources
*  
*  
*  
*  
* Application Registration on Azure
*  
*  
* Azure AD Connect : synchronization of on prem AD to cloud AD
*  
* Domain Join
*  
* Attack scenarios:
* * Compromised credentials
  * Azure AD authentication brute force
*  
* Logs:
* * Azure AD auth on 443, 80
  * AD on LDAP 389, 686
  * Azure AD Modern authentication protocols
  * Monitoring GPO changes
  * Kerberos authentication activity
  * * UDP 88
    * TCP 88
    * TCP 2105
    * TCP 544
    * TCP 1 -1023
    * TCP 32000-65535
  * NTLM authentication activity
  * Azure AD Built in roles review
*  
*  
* Reference:
* <https://learn.microsoft.com/en-us/azure/security/fundamentals/>
* <https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/>
* <https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/>
* &#x20;
* &#x20;
* &#x20;
* &#x20;
* &#x20;


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://moharat.gitbook.io/cylabs/security-domains/cloud-security-1/azure-security.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.