---
title: Azure Server Security Checklist (20 Key Items)
description: "### A practical security checklist of hosting servers in Microsoft Azure 1. **Enable Azure Security Center** - Configure Security recommendations and auto-provisioning. 2. **Apply Latest OS and Azure VM Updates** - Keep the server OS and Azure VM extensions up…"
url: "https://techtron.co.za/docs/azure-article-1/"
updated: "2025-08-18"
category: Azure
---

# Azure Server Security Checklist (20 Key Items)

### A practical security checklist of hosting servers in Microsoft Azure

1. **Enable Azure Security Center**
   - Configure Security recommendations and auto-provisioning.
2. **Apply Latest OS and Azure VM Updates**
   - Keep the server OS and Azure VM extensions up to date.
3. **Configure Network Security Groups (NSGs)**
   - Restrict inbound/outbound traffic to only necessary ports and IPs.
4. **Use Just-In-Time (JIT) VM Access**
   - Enable JIT in Azure Security Center to minimize exposed RDP/SSH ports.
5. **Enable Azure Firewall or Azure DDoS Protection**
   - Protect your network perimeter from attacks.
6. **Implement Azure Role-Based Access Control (RBAC)**
   - Grant least privilege access to administrators and users.
7. **Enable Multi-Factor Authentication (MFA)**
   - Enforce MFA for admin accounts and Azure portal access.
8. **Configure Azure Disk Encryption (ADE)**
   - Encrypt disks at rest with Azure Disk Encryption or Azure Storage Service Encryption.
9. **Enable Azure Security Policies & Baselines**
   - Enforce security best practices using Azure Policy.
10. **Configure Diagnostic Settings and Log Analytics**
    - Collect logs for audit, security, and troubleshooting.
11. **Implement Backup and Disaster Recovery**
    - Use Azure Backup to regularly back up VMs and data.
12. **Deploy Antivirus/Endpoint Security**
    - Use Azure Security Center recommended endpoint solutions (e.g., Microsoft Defender for Endpoint).
13. **Disable Unnecessary Services/Ports**
    - Remove or disable any non-essential services and open ports.
14. **Configure Secure Remote Access**
    - Use Bastion Host or VPN for RDP/SSH instead of exposing to the internet.
15. **Limit Public IP Exposure**
    - Use internal load balancers or private endpoints where possible.
16. **Configure Azure Private Link / Service Endpoints**
    - Secure communications to Azure PaaS resources.
17. **Set Up Alerts for Suspicious Activities**
    - Use Security Center and Log Analytics to create alerts for unusual activities.
18. **Use Managed Identities**
    - Utilize Azure Managed Identities for automated and secure resource access.
19. **Audit and Review Access Regularly**
    - Regularly review user access, roles, and audit logs.
20. **Implement Encryption for Data in Transit**
    - Ensure all communications use TLS/SSL (for RDP/SSH, APIs, etc.).