MCSB Control Domains

The Microsoft Cloud Security Benchmark organizes security controls into 12 domains. Each domain represents a security design pattern applicable across all Azure services. Use these as your architecture review checklist — walk through each domain for every service in your design.

NS Network Security

Security Principle: Isolate workloads on private networks, control traffic flows at every boundary, and ensure no service endpoint is unnecessarily exposed to the public internet. Think of the network as your first physical wall — everything inside should be segmented, inspected, and encrypted.

Architecture Pattern: Hub-Spoke Network Isolation

# Terraform — Hub VNet with Firewall + Spoke with Private Endpoints
resource "azurerm_virtual_network" "hub" {
  name                = "vnet-hub-prod"
  address_space       = ["10.0.0.0/16"]
  resource_group_name = azurerm_resource_group.hub.name
  location            = azurerm_resource_group.hub.location
}

resource "azurerm_subnet" "firewall" {
  name                 = "AzureFirewallSubnet"    # Required name
  virtual_network_name = azurerm_virtual_network.hub.name
  resource_group_name  = azurerm_resource_group.hub.name
  address_prefixes     = ["10.0.1.0/26"]
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub-prod"
  sku_name            = "AZFW_VNet"
  sku_tier            = "Premium"                 # Required for IDPS
  threat_intel_mode   = "Deny"
  location            = azurerm_resource_group.hub.location
  resource_group_name = azurerm_resource_group.hub.name

  ip_configuration {
    name                 = "fw-ipconfig"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.fw.id
  }
}

# Spoke VNet with NSG-protected private endpoint subnet
resource "azurerm_network_security_group" "pe_subnet" {
  name                = "nsg-pe-subnet"
  location            = azurerm_resource_group.spoke.location
  resource_group_name = azurerm_resource_group.spoke.name

  security_rule {
    name                       = "DenyInternetOutbound"
    priority                   = 100
    direction                  = "Outbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "Internet"
  }
}

# Terraform — Hub VNet with Firewall + Spoke with Private Endpoints
resource "azurerm_virtual_network" "hub" {
  name                = "vnet-hub-prod"
  address_space       = ["10.0.0.0/16"]
  resource_group_name = azurerm_resource_group.hub.name
  location            = azurerm_resource_group.hub.location
}

resource "azurerm_subnet" "firewall" {
  name                 = "AzureFirewallSubnet"    # Required name
  virtual_network_name = azurerm_virtual_network.hub.name
  resource_group_name  = azurerm_resource_group.hub.name
  address_prefixes     = ["10.0.1.0/26"]
}

resource "azurerm_firewall" "hub" {
  name                = "fw-hub-prod"
  sku_name            = "AZFW_VNet"
  sku_tier            = "Premium"                 # Required for IDPS
  threat_intel_mode   = "Deny"
  location            = azurerm_resource_group.hub.location
  resource_group_name = azurerm_resource_group.hub.name

  ip_configuration {
    name                 = "fw-ipconfig"
    subnet_id            = azurerm_subnet.firewall.id
    public_ip_address_id = azurerm_public_ip.fw.id
  }
}

# Spoke VNet with NSG-protected private endpoint subnet
resource "azurerm_network_security_group" "pe_subnet" {
  name                = "nsg-pe-subnet"
  location            = azurerm_resource_group.spoke.location
  resource_group_name = azurerm_resource_group.spoke.name

  security_rule {
    name                       = "DenyInternetOutbound"
    priority                   = 100
    direction                  = "Outbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "Internet"
  }
}

Framework mapping: NIST SP 800-53 SC-7, SC-8, AC-4 • CIS v8 9.2, 9.3, 12.1 • PCI-DSS v4 1.2–1.4 • ISO 27001 A.8.20–A.8.22

IM Identity Management

Security Principle: Every access decision must be identity-driven. Centralize on Entra ID, eliminate local authentication methods, use managed identities for all service-to-service communication, and enforce MFA with phishing-resistant methods. Identity is your new perimeter.

Architecture Pattern: Managed Identity Chain

# Terraform — App Service with Managed Identity accessing Key Vault & SQL
resource "azurerm_linux_web_app" "api" {
  name                = "app-api-prod"
  resource_group_name = azurerm_resource_group.app.name
  location            = azurerm_resource_group.app.location
  service_plan_id     = azurerm_service_plan.main.id

  identity {
    type = "SystemAssigned"    # MI for downstream access
  }

  site_config {
    minimum_tls_version = "1.2"
  }

  app_settings = {
    # Key Vault references — no secrets in config
    "ConnectionStrings__DefaultConnection" = "@Microsoft.KeyVault(VaultName=kv-prod;SecretName=sql-conn)"
  }
}

# Grant MI access to Key Vault via RBAC (not access policy)
resource "azurerm_role_assignment" "app_kv_secrets" {
  scope                = azurerm_key_vault.main.id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = azurerm_linux_web_app.api.identity[0].principal_id
}

# Grant MI access to SQL Database
resource "azurerm_role_assignment" "app_sql" {
  scope                = azurerm_mssql_database.main.id
  role_definition_name = "Contributor"
  principal_id         = azurerm_linux_web_app.api.identity[0].principal_id
}

# Terraform — App Service with Managed Identity accessing Key Vault & SQL
resource "azurerm_linux_web_app" "api" {
  name                = "app-api-prod"
  resource_group_name = azurerm_resource_group.app.name
  location            = azurerm_resource_group.app.location
  service_plan_id     = azurerm_service_plan.main.id

  identity {
    type = "SystemAssigned"    # MI for downstream access
  }

  site_config {
    minimum_tls_version = "1.2"
  }

  app_settings = {
    # Key Vault references — no secrets in config
    "ConnectionStrings__DefaultConnection" = "@Microsoft.KeyVault(VaultName=kv-prod;SecretName=sql-conn)"
  }
}

# Grant MI access to Key Vault via RBAC (not access policy)
resource "azurerm_role_assignment" "app_kv_secrets" {
  scope                = azurerm_key_vault.main.id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = azurerm_linux_web_app.api.identity[0].principal_id
}

# Grant MI access to SQL Database
resource "azurerm_role_assignment" "app_sql" {
  scope                = azurerm_mssql_database.main.id
  role_definition_name = "Contributor"
  principal_id         = azurerm_linux_web_app.api.identity[0].principal_id
}

Framework mapping: NIST SP 800-53 AC-2, AC-3, IA-2, IA-5 • CIS v8 5.1–5.3, 6.1 • PCI-DSS v4 7.1–8.3 • ISO 27001 A.5.15, A.8.2

PA Privileged Access

Security Principle: No standing privileged access. Use just-in-time elevation via PIM, separate admin accounts from daily-use accounts, enforce PAW for sensitive operations, and audit every privileged action. Assume breach — limit the blast radius an attacker gets from any single compromised identity.

Framework mapping: NIST SP 800-53 AC-2(7), AC-6, AC-6(5) • CIS v8 5.4, 6.5, 6.8 • PCI-DSS v4 7.2, 8.2, 8.6 • ISO 27001 A.5.15, A.8.18

DP Data Protection

Security Principle: Encrypt everything at rest and in transit. Know where your sensitive data lives, classify it, and protect it proportionally. Use platform-managed keys by default, customer-managed keys for regulated workloads, and Key Vault for all key lifecycle management.

Architecture Pattern: CMK Encryption with Key Vault

# Terraform — Key Vault with CMK for SQL Database and Storage
resource "azurerm_key_vault" "main" {
  name                       = "kv-prod-001"
  resource_group_name        = azurerm_resource_group.security.name
  location                   = azurerm_resource_group.security.location
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "premium"          # HSM-backed
  soft_delete_retention_days = 90
  purge_protection_enabled   = true               # Required for CMK
  enable_rbac_authorization  = true               # RBAC over access policies

  network_acls {
    default_action = "Deny"
    bypass         = "AzureServices"
  }
}

resource "azurerm_key_vault_key" "sql_cmk" {
  name         = "sql-tde-cmk"
  key_vault_id = azurerm_key_vault.main.id
  key_type     = "RSA"
  key_size     = 2048
  key_opts     = ["unwrapKey", "wrapKey"]

  rotation_policy {
    automatic {
      time_before_expiry = "P30D"
    }
    expire_after = "P365D"
  }
}

# Terraform — Key Vault with CMK for SQL Database and Storage
resource "azurerm_key_vault" "main" {
  name                       = "kv-prod-001"
  resource_group_name        = azurerm_resource_group.security.name
  location                   = azurerm_resource_group.security.location
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "premium"          # HSM-backed
  soft_delete_retention_days = 90
  purge_protection_enabled   = true               # Required for CMK
  enable_rbac_authorization  = true               # RBAC over access policies

  network_acls {
    default_action = "Deny"
    bypass         = "AzureServices"
  }
}

resource "azurerm_key_vault_key" "sql_cmk" {
  name         = "sql-tde-cmk"
  key_vault_id = azurerm_key_vault.main.id
  key_type     = "RSA"
  key_size     = 2048
  key_opts     = ["unwrapKey", "wrapKey"]

  rotation_policy {
    automatic {
      time_before_expiry = "P30D"
    }
    expire_after = "P365D"
  }
}

AM Asset Management

Security Principle: You can't protect what you don't know about. Maintain a current inventory of all Azure resources, restrict what can be deployed via Azure Policy, tag everything for governance, and ensure security teams have visibility into all assets.

LT Logging and Threat Detection

Security Principle: Enable threat detection on every service that offers it, collect all logs centrally, and ensure your SIEM has enough retention and correlation capabilities. The question isn't if you'll be attacked — it's whether you'll detect and respond fast enough.

IR Incident Response

Security Principle: Prepare before incidents happen. Have playbooks, automation, and contact chains ready. When an incident occurs, leverage Sentinel's investigation graph, automated containment playbooks, and systematic post-incident review to continuously improve.

PV Posture and Vulnerability Management

Security Principle: Know your security posture at all times. Define baselines, enforce them with policy, scan continuously for vulnerabilities, and remediate rapidly. Combine CSPM, vulnerability assessment, and regular red team testing for comprehensive coverage.

ES Endpoint Security

Security Principle: Every VM and server in your cloud environment needs EDR and anti-malware. Deploy MDE via auto-provisioning, keep signatures current, and monitor endpoint health centrally.

BR Backup and Recovery

Security Principle: Backups are your last line of defense against ransomware and data destruction. Automate backups, protect them with immutability, test restores regularly, and ensure recovery meets your RPO/RTO commitments.

DS DevOps Security

Security Principle: Security at the speed of DevOps. Embed threat modeling, SAST, DAST, dependency scanning, and secrets detection into your pipelines. Harden build infrastructure. Sign artifacts and verify the supply chain.

GS Governance and Strategy

Security Principle: Security doesn't happen by accident. Define roles, document strategy, set policies, and align the organization. Governance is the glue that makes all other domains work together consistently across teams and time.

Architecture Review Checklist