The post Azure Monitor Baseline Alerts for AVDs appeared first on Azure Security Architect.

Enable Azure Insights to capture RTT for the AVD Spin Up as well as RTT for the networking

VM LEvel

At the NIC level, Enable VM Accelerated Networking if the VM Type (and OS) supports it

FW LEvel

Ensure that Deep Packet Filtering is not causing the latency

Ensure that  the outbound route to the internet is not causing the latency (if it is via a PA FW for example)

The post AVD Latency Issues Troubleshooting appeared first on Azure Security Architect.

1. The identities (for those devices) need to be in place already
2. The licensing for the devices needs to be in place.

The post InTune Migration PreExisting Identities appeared first on Azure Security Architect.

Types – Storage accounts are of three types – V2 (most general purpose), V1 (hardly used anymore) and Blob Storage (can only store blobs – no table storage etc).

Replication

1. LRS (Locally redundant – always triple redundant within a datacenter)
2. Geo Redundant
3. Read-Access GeoRedudant

Tiers – HOT or COOL (Archive can only be set LATER)

Additional Security Options

– Bind to a VNET

Secure Transfer only

Step 2  – Adding a BLOB

Once the  storage account is ready, add a new CONTAINER (BLOB).

Access type – Private (useful for BACKUPS being stored to BLOBS), Anonymous read for BLOBS only (is the second option).

The post Storage Accounts and Blob Storage appeared first on Azure Security Architect.

1. Enforce resource tagging
2. Limit allowed locations
3. Prohibit specific resources deployment (e.g. Public IP addresses)
4. Require Secure Transfer for Storage Accounts
5. Block Public Access to Storage Accounts
6. Block Anonymous access to storage accounts
7. Configure Cosmos DB accounts to disable public network access
8. Configure Azure SQL accounts to disable public network access

The post Azure Policy Recommended Policies appeared first on Azure Security Architect.

The exact error

The portal encountered an issue while attempting to retrieve access tokens. We suggest attempting to sign in again, or alternatively, continuing without access tokens, although this may result in a suboptimal user experience. Additional details: invalid_grant: AADSTS530004: AcceptCompliantDevice setting isn’t configured for this organization. The admin needs to configure this setting to allow external users access to protected resources. Trace ID: af449c59-5668-4e01-9c12-6148328d6500 Correlation ID: e0318484-7e18-4c0f-b7a9-a678a9bc8cfd Timestamp: 2024-11-27 17:58:53Z.

The post Device Restrictions using Conditional Access Policies in Azure Entra ID appeared first on Azure Security Architect.

Let in a set of Vendor Engineers into your Azure Subscription (typically with GLOBAL READER permissions)

Steps in Entra and in Azure

1. Set up SSO using the vendor’s email id as the UUID.
2. Grant them GUEST User licenses – into your Entra Tenant
3. Put all these VENDOR GUESTS into a single AAD User Group.
4. Now use RBAC to grant this user group Azure resource permissions.

The post Letting in vendors to your Entra Tenant appeared first on Azure Security Architect.

P2 licenses – Cloud Only Authentication (not federated)

The post P2 licenses – Use Case – SSO Authentication and MFA – no mailbox appeared first on Azure Security Architect.

Can be used to manage both devices as well as applications on the devices.

One can configure InTune for JUST application management (and have some other tool do the device management).

The post Devices versus Apps – Managed by Intune appeared first on Azure Security Architect.

Create a new VPN gateway in the desired region

Configure the new gateway with the same connection settings as the old one

and then update your on-premises VPN device to point to the new Azure gateway effectively switching the tunnel to the new region while maintaining connectivity

Most of this can be done through the Azure portal by modifying the VPN gateway’s location and connection details, ensuring your on-premises device is updated accordingly.

Option 2 – actually move the resources over (not preferred)

Entire VNet  (containing the gateway Subnet) needs to be migrated

Done using the Resource Manager migration

The post Migration of Azure site-to-site VPN tunnel from one region to another appeared first on Azure Security Architect.