1. Enforce resource tagging
2. Limit allowed locations
3. Prohibit specific resources deployment (e.g. Public IP addresses)
4. Require Secure Transfer for Storage Accounts
5. Block Public Access to Storage Accounts
6. Block Anonymous access to storage accounts
7. Configure Cosmos DB accounts to disable public network access
8. Configure Azure SQL accounts to disable public network access

The post Azure Policy Recommended Policies appeared first on Azure Security Architect.

Azure Firewall requires it’s own empty subnet and an unused IP address space. You will need to create an address space, if one isn’t available.

Do I also need NSGs?

No. Once an Azure Firewall is in place, no NSGs are needed.

Do I also need ASGs?

No. An Application Security Group is a grouped set of azure resources that can be referenced via a common set of NSGs rules.

Do I also Azure Policy?

No. These are different from Firewalls – these are more around Governance.

The post Azure Firewall – Stateful, Packet Inspection appeared first on Azure Security Architect.