- Azure Resource Security Standard as code
Convert the Azure Resource Security Standard checklist into a Terraform module library (App Service, storage, SQL, Key Vault, VNet) plus a matching Azure Policy initiative. New resources land compliant by default instead of relying on a checklist being completed after the fact. Phase 1 audit-only policy, Phase 2 modules in pilot, Phase 3 deny and deploy-if-not-exists.
- App Service estate hardening campaigns
Execute the estate-wide App Service hardening campaigns: SCM site lockdown, network rule corrections, Front Door origin pinning, FTP and basic-auth publishing hygiene, and firewall rule cleanup. Idempotent scripts plus a before-and-after posture export for audit evidence.
- Diagnostic and audit logging coverage
Most App Service instances and Key Vaults in the estate have no diagnostic settings configured. Deliver deploy-if-not-exists policy at scale across all subscriptions with destination routing, retention, and an ingestion cost model produced before enablement.
- Storage and database network exposure remediation
Build a private endpoint and private DNS zone module, then run phased enforcement waves with owning teams across storage accounts and database services currently allowing public network access.
- Secretless pipelines and applications
Convert Azure DevOps service connections to workload identity federation, move application settings to Key Vault references backed by managed identity, and enforce a maximum credential lifetime on app registrations. Retires long-lived and never-expiring client secrets.
Stand up Managed DevOps Pools or self-hosted agents inside the application VNets. This removes the reason broad platform allow rules and basic-auth publishing remain enabled across the App Service estate, replacing a time-boxed exception with a permanent fix.
Implement the pre-deployment security review the Azure Resource Security Standard requires, as a reusable YAML template rather than per-pipeline custom work: IaC scanning on Bicep, ARM and pipeline YAML, dependency scanning enforcement, container image scanning before registry push, failing the build on High and Critical findings, with output attached to the change record.
- Azure DevOps organization hardening, enforcement phase
Complete the enforcement items from the organization settings review: job authorization token scoping, queue-time variable restrictions, and YAML pipeline repository protection. Includes the cross-project reference inventory needed to size blast radius before enforcement, automated through the ADO REST API.
- Resource sprawl and decommissioning program
Tagging and ownership enforcement, an orphan resource report covering unattached disks, unused public IPs, stopped VMs and empty resource groups, and a decommissioning runbook that includes DNS record cleanup. Addresses both cost inflation and the attack surface created by abandoned resources.
