Azure Architecture Guide

Choosing Security Services

What This Chapter Is About

Help readers choose Azure security services by matching each service to a control objective.

This chapter connects security service selection back to governance, networking, workload identity, secrets, detection, response, and evidence. The focus is not to list security products. The focus is to understand what risk or control each service helps address.

Keep one durable idea in view:

Security service selection starts with the control objective: identity, secrets, traffic protection, posture, detection, response, or evidence.

Sections

  1. Security Selection Mental Model

  2. Identity, Secrets, and Access Boundaries

  3. Network and Edge Protection Services

  4. Posture Management and Threat Detection

  5. Security Operations, Evidence, and Cost Trade-Offs

  6. Security Choice Scenario

How the Chapter Develops

The chapter develops in this order:

  1. Start by defining security selection as matching controls to risks and responsibilities.

  2. Explain identity, workload identity, access scope, and secret handling.

  3. Explain network and edge protection for traffic paths and public exposure.

  4. Explain posture management, workload protection, SIEM, analytics, and response.

  5. Compare operating responsibilities, evidence, alert ownership, and cost trade-offs.

  6. Apply the model to a regulated customer platform that needs layered controls.

Together, these sections show that security services work together as a control model, not as a shopping list.

What You Will Be Able to Do

By the end of this chapter, the reader should be able to:

  • Explain how security service selection differs from general service selection.

  • Distinguish identity, access, secrets, network protection, posture, detection, response, and evidence controls.

  • Explain when Microsoft Entra ID, Azure RBAC, managed identities, and Key Vault matter.

  • Explain how Azure Firewall, Web Application Firewall, and DDoS Protection address different traffic risks.

  • Explain the difference between Microsoft Defender for Cloud and Microsoft Sentinel at a high level.

  • Sketch a layered security service design for a regulated workload.

Key Ideas

  • Microsoft Entra ID and Azure RBAC control identity and management-plane access.

  • Managed identities reduce secret handling for workloads.

  • Key Vault protects secrets, keys, and certificates, but access design still matters.

  • Azure Firewall, Web Application Firewall, and DDoS Protection protect different traffic risks.

  • Defender for Cloud helps with posture and workload protection.

  • Sentinel helps with SIEM, analytics, and response orchestration.

  • Security services need ownership, alert tuning, logging, and response processes to create real protection.