Configuring security baselines for workloads in an Azure Landing Zone (ALZ) relies on policy-driven governance. Rather than manually configuring individual resources, you enforce security controls at the Management Group level using Azure Policy, Microsoft Defender for Cloud, and Infrastructure as Code (IaC) modules.

1. Implement Policy-Driven Guardrails

In an Enterprise-Scale Landing Zone, security baselines inherit automatically based on where a subscription sits in the Management Group hierarchy (Corp, Online, or Platform).

Key Policy Definitions to Assign

Assign built-in policy initiatives (like the Microsoft cloud security benchmark (MCSB)) to the Intermediate Root Management Group:

• Enforce Encryption in Transit: Block storage accounts or web apps that allow HTTP or TLS versions below 1.2 (Deny).
• Disable Public Access: Prevent PaaS resources (SQL Server, Key Vault, Storage) from exposing public IP endpoints (Deny or Modify).
• Auto-Provision Diagnostics: Stream all resource activity, audit, and diagnostic logs to the central Log Analytics workspace in the Management subscription using DeployIfNotExists (DINE) policies.

2. Deploy Automated Security via IaC (Bicep / Terraform)

When provisioning workload landing zones, use ALZ Bicep or Terraform modules to apply security baselines dynamically upon subscription creation.

Example: Bicep Policy Assignment for Security Baseline

Code snippet

targetScope = 'managementGroup'
param managementGroupId string = 'alz-landing-zones'
// Assign Microsoft Cloud Security Benchmark Initiative
resource mcsbAssignment 'Microsoft.Authorization/policyAssignments@2022-06-01' = {
  name: 'mcsb-baseline-assignment'
  scope: managementGroup(managementGroupId)
  properties: {
    displayName: 'Enforce Microsoft Cloud Security Benchmark'
    description: 'Applies baseline security controls across all landing zone subscriptions.'
    policyDefinitionId: '/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8'
    enforcementMode: 'Default'
  }
}

3. Configure Microsoft Defender for Cloud at Scale

To ensure all workload subscriptions automatically inherit Defender plans:

1. Enable Defender Plan Auto-Provisioning: Configure continuous policy assignments at the Management Group level so any new subscription placed in Corp or Online automatically enables plans for Servers, Containers, Databases, and Storage.
2. Auto-Deploy Endpoint Protection: Enable auto-provisioning for Microsoft Defender for Endpoint extensions on all Linux and Windows VMs.
3. Agentless Vulnerability Scanning: Activate agentless scanning for VMs and container registries across all subscriptions.

4. Operational Checklist for Workload Onboarding

1.Subscription Placement:Placement.

Move the workload subscription under the appropriate Management Group archetype (Corp for internal hybrid workloads, Online for internet-facing apps).

Verification: Verify that inherited policy assignments appear under Subscription > Policies.

2.Enforce Perimeter Isolation:Network.

Provision Private Endpoints for all PaaS services and attach a Network Security Group (NSG) to every subnet. Route outbound traffic through the Central Azure Firewall.

Verification: Ensure public network access is disabled on the resource overview blade in the portal.

3.Configure Managed Identities:Identity.

Configure System-Assigned or User-Assigned Managed Identities for app-to-service authentication, eliminating hardcoded keys or credentials.

Verification: Check Entra ID enterprise applications to confirm Managed Identity registration.