7 Azure Security Gaps I have Seen in Production (and How to Fix Them)

7 Azure Security Gaps I have Seen in Production (and How to Fix Them)

Note: The issues described here are from real production environments, security audits, and incident reviews — not lab or demo setups.

Over the past few years, while managing 100+ Azure virtual machines in production environments running critical PeopleSoft and Oracle workloads, I have repeatedly encountered the same security gaps across different organizations.

These are not theoretical vulnerabilities from security blogs. They are real-world issues that surface during security audits, incident response investigations, and routine infrastructure reviews.

In this article, I will walk through seven critical Azure security gaps I have personally identified in production, along with:

• Real-world examples

• Detection methods using Azure-native tools

• Practical, step-by-step remediation strategies

Whether you manage a handful of VMs or hundreds, addressing these gaps will significantly improve your Azure security posture before they turn into incidents.

1. Inadequate Network Security Group (NSG) Rules

The Problem

Network Security Groups (NSGs) are the primary network-level control for Azure VMs. Yet I often find production environments with overly permissive inbound rules such as:

• Allow * from 0.0.0.0/0

• SSH (22) or RDP (3389) exposed to the public internet

Real-world example:
During a security audit, I found 12 production VMs with SSH open to the internet. NSG flow logs showed 50,000+ failed login attempts in 30 days.

How to Detect:

Azure Portal

• Network Security Groups → Inbound rules

• Look for:

  • Source: Any or 0.0.0.0/0
  • Ports: 22, 3389, 1433, 5432

• Review Effective security rules per VM

KQL (NSG Flow Logs)

AzureNetworkAnalytics_CL
| where SubType_s == "FlowLog"
| where SrcIP_s !startswith "10."
and SrcIP_s !startswith "172."
and SrcIP_s !startswith "192.168."
| where DestPort_d in (22, 3389)
| summarize Attempts = count() by SrcIP_s, DestPort_d
| order by Attempts desc

The Fix
Immediate

• Remove 0.0.0.0/0 access for SSH/RDP

• Whitelist trusted office or VPN IPs

• Use Azure Bastion

• Enable Just-In-Time (JIT) VM access via Microsoft Defender for Cloud

Long-term

• Use Application Security Groups (ASGs)

• Implement Azure Firewall

• Enforce NSG standards using Azure Policy

2. Missing Azure Backup Policies

The Problem

Many teams assume Azure automatically backs up VMs. It doesn’t.
I have seen production workloads with no Recovery Services vault and no backups.

How to Detect

Azure Portal

• Recovery Services vaults → Backup items

• Compare against VM inventory

Resources
| where type == "microsoft.compute/virtualmachines"
| project name, resourceGroup
| join kind=leftouter (
RecoveryServicesResources
| where type contains "protectedItems"
| extend vmName = tostring(split(properties.sourceResourceId, "/")[8])
| project vmName
) on $left.name == $right.vmName
| where isnull(vmName)

The Fix

• Create Recovery Services vaults per region

• Define policies aligned with RPO/RTO

• Enable Soft Delete

• Test restores quarterly

• Configure backup alerts via Azure Monitor

3. Weak Authentication Methods

The Problem

Password-based SSH and RDP access is still common. I have seen environments using the same password across multiple admin accounts, creating a single point of failure.

How to Detect

Linux

grep -i PasswordAuthentication /etc/ssh/sshd_config
grep -i PubkeyAuthentication /etc/ssh/sshd_config

Windows

• Review Azure AD Conditional Access

• Check Azure AD sign-in logs

The Fix

Linux

• Disable passwords: PasswordAuthentication no

• Use SSH key-based authentication

• Store keys in Azure Key Vault

• Enable Azure AD Login for Linux VMs

Windows

• Enforce MFA

• Reduce local admin usage

• Use Privileged Access Workstations (PAWs)

4. Unencrypted Data in Transit

The Problem

HTTP endpoints, databases without TLS, and FTP transfers still exist in production — even for sensitive data.

How to Detect

Application Gateway / WAF Logs

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS"
| where requestUri_s startswith "http://"
| summarize Count = count() by requestUri_s, clientIP_s
| order by Count desc

The Fix

• Enforce HTTPS end-to-end

• Redirect HTTP → HTTPS

• Enable TLS 1.2+ for databases

• Replace FTP with SFTP/FTPS

• Manage certificates via Azure Key Vault

5. Improper Role-Based Access Control (RBAC)

The Problem

Developers often have Contributor or Owner access at subscription level, violating least privilege.

How to Detect

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where properties.roleDefinitionId contains "Owner"
or properties.roleDefinitionId contains "Contributor"
| project principalId, scope = tostring(properties.scope)

The Fix

• Audit RBAC regularly

• Remove unnecessary subscription-level roles

• Create custom roles

• Use Azure AD PIM

• Enable access reviews

6. Missing Activity Log Alerts

The Problem

Critical changes happen with no alerts, leaving teams blind.

How to Detect

• Azure Monitor → Alerts

• Filter by Activity Log

The Fix

Create alerts for:

• NSG rule changes

• VM deletion/creation

• RBAC changes

• Defender for Cloud policy updates

• Key Vault access changes

7. Exposed Management and Database Ports

The Problem

Beyond SSH/RDP, I often find database ports and admin interfaces exposed to the internet.

How to Detect

AzureNetworkAnalytics_CL
| where SubType_s == "FlowLog"
| where DestPort_d in (1433, 3306, 5432, 8080, 8443, 27017, 6379)
| where SrcIP_s !startswith "10."
and SrcIP_s !startswith "172."
and SrcIP_s !startswith "192.168."
| summarize Count = count() by DestPort_d, DestIP_s
| order by Count desc

The Fix

• Close non-essential ports

• Use Private Endpoints / Private Link

• Deploy Application Gateway with WAF

• Use Azure Bastion

• Follow Defender for Cloud recommendations

Conclusion

Azure security is not a one-time setup. It requires continuous monitoring, audits, and proactive remediation.

Most of these gaps exist not because of missing tools, but because of missing guardrails. Azure Policy, Defender for Cloud, and Infrastructure as Code can prevent most of them before they reach production.

Quick Security Checklist (≈ 85 Minutes)

• Audit NSG rules for 0.0.0.0/0 (5 min)

• Verify VM backups (10 min)

• Review RBAC assignments (15 min)

• Check SSH password authentication (10 min)

• Enable activity log alerts (20 min)

• Scan for exposed DB ports (10 min)

• Identify HTTP traffic (15 min)

Let’s Discuss

Have you seen similar Azure security issues in production?
What guardrails do you use to prevent them?