| Identity · PIM, Conditional Access, authentication, apps, consent and managed identity |
01 Microsoft Entra ID and Azure RBAC, 09 Defender, Key Vault and Preventive Controls |
| Secrets · Key Vault access, keys, certificates and protection |
09 Defender, Key Vault and Preventive Controls |
| Governance · Policy, roles, locks, backup security and IaC |
02 Subscriptions, Policy and Cost Governance, 08 Azure Backup and Site Recovery, 09 Defender, Key Vault and Preventive Controls |
| Storage · Storage access, firewalls and Defender protection |
03 Storage Access, Encryption and Redundancy, 09 Defender, Key Vault and Preventive Controls |
| Databases · SQL security, auditing and Defender for Databases |
09 Defender, Key Vault and Preventive Controls, 12 SQL Security and Compliance Controls |
| Networks · NSGs, Network Manager, WAN/VPN, Private Access, endpoints and Firewall |
06 Virtual Networks, Routes and Secure Access, 09 Defender, Key Vault and Preventive Controls |
| AI · Purview, agent identity, API gateway, Foundry and AI protection |
10 AI Data Exposure and Agent Security |
| Servers · Encryption, Bastion, JIT, Arc, Defender and machine configuration |
04 Virtual Machines, Disks and Scale Sets, 09 Defender, Key Vault and Preventive Controls |
| Applications · Container/serverless/app/API/WAF security |
05 App Service and Container Platforms, 09 Defender, Key Vault and Preventive Controls |
| Posture · CSPM, multicloud protection, vulnerabilities and EASM |
09 Defender, Key Vault and Preventive Controls |
| Sentinel · Connectors, collection, automation and retention |
07 Azure Monitor, Logs and Alerts, 11 Sentinel, Incident Automation and Security Copilot |
| Copilot · Security Copilot workspaces, roles, plugins and agents |
11 Sentinel, Incident Automation and Security Copilot |
