Skip to main content

How to secure access to Azure Management Portal

Migrating an existing system to Microsoft Azure can be a challenge when strong security requirements need to be in place. There are multiple tools and services that help us to provide a secure environments that it is not in our own datacenter.
Often we are focusing to secure the application and systems that are running inside Azure and forgetting about the Azure Portal itself. We can have the most secure application inside Azure if our subscription is compromised and someone is able to access it as admin.
In this post, we will look on some basic mechanisms and policies that enable us to secure access to the Azure Portal and subscription.

There two ways to access an Azure Subscription and to any kind of changes.
1. Azure Portal: The main dashboard used to administrate our Azure Subscription
2. SMAPI: Over the Rest API exposed by Microsoft, command-line interfaces like PowerShell, Batch can be used with success or even custom applications

Multi-factor authentication
One of the first things that can be done to the accounts that are accessing Azure Subscription is to activate multi-factor authentication. Additional to the password, the use will be required to do a second authentication step using SMS, phone number and so on.

Smart Cards
Account can be secured using a Smart Card or similar devices that are based on TPM (Trusted Platform Module) chips. They are using an asymmetric key pair or certificate where the secret (private key) is stored on the device.

Azure Management Certificates
These certificates are generated by Azure and can be used by different system to access and manage Azure Subscription. These certificates enable us to manage the subscription without having to enter a username and password.
They are very powerful especially when you want to use in combination with a Remote Desktop Gateway hosted inside Azure and a VPN.

Connection Authorization Policies
These policies can be used when Remote Desktop Gateway is used and can ensure that the machine that connect to it, it is part of a specific domain and even check and validate the machine name. 

Point-to-Site VPN
To ensure a more secure connection between client machines and Azure, a P2S VPN connection can be used to a machine hosted inside Azure. This would enable us to have a more communication channels between them. This is similar with having a Jump Box machine inside Azure.
Don’t forget that all communication with Azure management endpoints are over TLS.

Site-to-Site VPN
By using S2S VPN, your on-premises system is connected with your VNET network from Azure. As P2S VPN, this offers us a secure tunnel that can be used to communicate with Azure. A jump-box is not needed anymore; it is enough to configure traffic to Azure to goes over the S2S VPN directly.

NSG (Network Security Groups) and IP Restrictions
When a jump box with(out) a VPN connection it is used, NGS and IP Restrictions can be used to restrict access to the jump box.
Express Route
Express route is offering a dedicated and secure communication channel between your on-premises system and Azure. The private connection with Azure ensures are that there are no man in the middles.

Restrict number of users
Try to keep the number of users that have access to the subscription as low as possible. Many times 2-3 people are more than enough to have admin/co-admin rights.

Jump-box with Azure Management Certificates
This enable us to provide limited access to the Azure Portal through Remote Desktop Gateway without sharing with the user the credentials. The certificate that it is installed on the jump-box will provide access to Azure Management API.
This requires of course extra security measure at jump-box level.

Many feature and capabilities enable us to secure access to Azure Portal and Management API. Beside these, don’t forget that in the most of the cases people are the breach and not the system itself.


Popular posts from this blog

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

Today blog post will be started with the following error when running DB tests on the CI machine:
threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration:

TeamCity.NET 4.51EF 6.0.2VS2013
It seems that there …

Fundamental Books of a Software Engineer (version 2018)

More then six years ago I wrote a blog post about fundamental books that any software engineer (developer) should read. Now it is an excellent time to update this list with new entries.

There are 5 different categories of books, that represent the recommended path. For example, you start with Coding books, after that, you read books about Programming, Design and so on.
There are some books about C++ that I recommend not because you shall know C++, only because the concepts that you can learn from it.


Writing solid codeCode completeProgramming Pearls, more programming pearls(recommended)[NEW] Introduction to Algorithms


Refactoring (M. Fowler)Pragmatic ProgrammerClean code[NEW] Software Engineering: A Practitioner's Approach[NEW] The Mythical Man-Month[NEW] The Art of Computer Programming


Applying UML and Patterns (GRASP patterns)C++ coding standards (Sutter, Alexandrescu)The C++ programming language (Stroustrup, Part IV)Object-oriented programming (Peter Coad)P…

Entity Framework (EF) TransactionScope vs Database.BeginTransaction

In today blog post we will talk a little about a new feature that is available on EF6+ related to Transactions.
Until now, when we had to use transaction we used ‘TransactionScope’. It works great and I would say that is something that is now in our blood.
using (var scope = new TransactionScope(TransactionScopeOption.Required)) { using (SqlConnection conn = new SqlConnection("...")) { conn.Open(); SqlCommand sqlCommand = new SqlCommand(); sqlCommand.Connection = conn; sqlCommand.CommandText = ... sqlCommand.ExecuteNonQuery(); ... } scope.Complete(); } Starting with EF6.0 we have a new way to work with transactions. The new approach is based on Database.BeginTransaction(), Database.Rollback(), Database.Commit(). Yes, no more TransactionScope.
In the followi…