Capabilities of Microsoft Security Solutions

Introduction

This lab explores key Microsoft security solutions including Network Security Groups (NSGs), Microsoft Defender for Cloud, Microsoft Sentinel, and Microsoft Defender for Cloud Apps. Through hands-on configuration and testing, I demonstrated how these tools work together to provide comprehensive cloud security across Azure environments.

Objectives

  • Configure NSGs to control network traffic
  • Deploy and configure Microsoft Defender for Cloud
  • Set up Microsoft Sentinel for threat detection
  • Explore Microsoft Defender for Cloud Apps capabilities
  • Validate security policies and remediation workflows

Prerequisites

  • Azure subscription with admin access
  • Skillable lab environment
  • Familiarity with Azure Portal and security concepts

Walkthrough

Lab 1: Network Security Groups

Task 1: Create NSG and Rules

  1. Create NSG named NSG-SC900
  2. Add inbound rule to allow RDP (port 3389) from specific source
  3. Add outbound rule to block internet traffic

NSG creation interface showing rule configuration for RDP access and outbound filtering Creating NSG with RDP rule

Task 2: Associate NSG with Subnet

  1. Navigate to virtual network
  2. Select subnet for VM deployment
  3. Associate NSG-SC900
  4. Verify association status

NSG association interface showing subnet selection and successful firewall rule binding Associating NSG with subnet

Task 3: Test NSG Rules

  1. Deploy VM in protected subnet
  2. Test RDP connectivity (should succeed)
  3. Test outbound internet access (should fail)

Network connectivity testing showing RDP success and internet access blocked Testing RDP connectivity

Outbound access test demonstrating blocked internet traffic enforcement Testing outbound access

Task 4: Block Outbound Internet

  1. Create an outbound rule in NSG-SC900 to deny traffic to the Internet service tag
  2. Test by attempting to access www.bing.com from the VM (access should fail)

Outbound deny rule configuration showing Internet service tag blocking Blocking outbound internet rule

Browser test showing blocked access to bing.com via NSG rule enforcement Testing blocked access

Lab 2: Microsoft Defender for Cloud

Task 1: Explore Defender Dashboard

  1. Navigate to Microsoft Defender for Cloud in the Azure Portal
  2. Review the secure score, assessed resources, and security recommendations

Defender for Cloud dashboard showing secure score and resource assessment summary Defender for Cloud dashboard

Task 2: Review Recommendations

  1. Select a VM resource and view remediation steps for identified security issues

Security recommendations interface showing remediation steps and risk severity levels Security recommendations

Task 3: Enable Defender Plans

  1. Enable the Cloud Security Posture Management (CSPM) and Server protection plans

Defender for Cloud plans configuration showing CSPM and server protection enablement Enabling Defender plans

Lab 3: Microsoft Sentinel

Task 1: Create Sentinel Instance

  1. Create a Log Analytics workspace named SC900-LogAnalytics-workspace
  2. Enable Microsoft Sentinel in the workspace

Log Analytics workspace and Sentinel creation interface showing successful provisioning Creating Sentinel instance

Task 2: Assign Roles

  1. In the resource group SC900-Sentinel-RG, assign built-in Sentinel roles via Identity and Access Management (IAM)

IAM role assignment interface showing Sentinel contributor and viewer role options Assigning Sentinel roles

Task 3: Connect Defender for Cloud

  1. Navigate to Content Hub in Microsoft Sentinel
  2. Deploy the Defender for Cloud solution and configure the connector
  3. Verify alert ingestion from Defender for Cloud

Sentinel Content Hub showing Defender for Cloud solution deployment interface Accessing Content Hub

Defender for Cloud solution deployment in Microsoft Sentinel showing connector configuration Deploying Defender solution

Lab 4: Microsoft Defender for Cloud Apps

Task 1: Explore Cloud Discovery

  1. Access the Microsoft 365 Defender portal
  2. Navigate to the Cloud Discovery dashboard to review discovered apps

Cloud Discovery dashboard showing discovered applications and risk assessment data Cloud Discovery dashboard

Task 2: Review App Catalog

  1. View discovered apps, their risk scores, and usage statistics in the app catalog

App catalog interface showing cloud application risk scores and usage metrics Reviewing app catalog

Task 3: Investigate Findings

  1. Use investigation tools and filters to analyze app-related findings

Investigation tools interface showing filtering options and app analysis capabilities Investigation tools

Task 4: Configure Policies

  1. Create Cloud Discovery anomaly detection policy
  2. Set alert thresholds and notification preferences

Summary

This lab successfully demonstrated Microsoft’s comprehensive security solutions. NSGs provided network-level protection, Defender for Cloud assessed security posture, Sentinel enabled threat detection, and Defender for Cloud Apps monitored cloud application risks.

References