[ PLATFORM // MICROSOFT_AZURE ]
Security for Azure.
Entra to data plane.
Subscription and management-group visibility across Entra ID, Defender, Policy, and network — without Contributor write paths.
50+
Subscriptions
Hourly
Policy eval
Read-only
Graph queries
Secure score 84 · +6 vs baseline
Entra: 3 global admins · CA policy missing for legacy auth
What we assess
in Microsoft Azure.
Platform-native domains — not a generic cloud checklist pasted from another provider.
Entra ID
Conditional access gaps, privileged roles, guest risks.
Defender for Cloud
Secure score, regulatory compliance bundles.
Network
NSGs, Azure Firewall rules, exposed PaaS endpoints.
Storage
Blob public access, encryption, soft-delete settings.
Key Vault
Access policies, purge protection, logging.
Policy
Initiative compliance drift per subscription.
PaaS SQL / App
TLS versions, managed identity usage.
Activity logs
Diagnostic settings to Log Analytics completeness.
Onboarding preview
from checklist.
Steps align with NNSEC_Onboarding_Checklist — full runbook generates after discovery wizard.
- 01
App registration
Read-only custom role at management group scope.
- 02
Consent + audit
Admin grants API permissions; NNSEC logs grant event.
- 03
Scope subs
Tag-based inclusion for prod vs lab.
- 04
Defender sync
Import recommendations and secure score trend.
- 05
Posture dashboard
OCSF-normalized findings with resource ARM IDs.
- 06
Evidence export
SOC 2 control attachments auto-linked.
Tools we deploy
and integrate.
Open-source and native cloud APIs — no proprietary agent required unless noted for on-prem.
Connector · Service principal with least-privilege role definitions — no write operations.
Framework mapping
for Microsoft Azure.
Evidence exports attach findings to auditor-friendly control IDs.
CIS Azure
CIS · ISO A.8
SOC 2 CC6.1
Logical access
NIS2
EU incident readiness
[ TIERS ]
Connector included by tier
| foundation · $3,500 | ☑ |
| growth · $5,000 | ☑ |
| scale · $8,000 | ☑ |
| enterprise · $12,000 | ☑ |
Customer story
Secure score +24
SaaS vendor unified 12 subscriptions under one NNSEC retainer.
SaaS
FAQ
Never — Reader + security-specific read data actions only.
Connect Microsoft Azure to NorthSec AI
Full coverage · read-only · per-tenant KMS