Request for Guidance on Azure Security, Access Recovery, and Incident Prevention

Use a layered privileged-access model and an incident playbook.

1. Protect privileged accounts
   1. Require MFA for all privileged roles, especially Global Administrator, Privileged Role Administrator, Exchange Online Administrator, SharePoint Online Administrator, tenant admins, and Azure RBAC owners.
   2. Use strong passwords and change credentials immediately for tenant admins and subscription RBAC owners after any suspected compromise.
   3. Do not use privileged accounts for browsing or email. Use dedicated admin workstations for production administration. For higher assurance, use Privileged Access Workstations (PAWs).
   4. Deprovision admin accounts immediately when staff leave.
   5. Regularly test admin accounts and review attack paths.
2. Reduce standing privilege
   1. Use Microsoft Entra PIM so privileged access is just-in-time, time-bound, approval-based, and can require MFA and justification for activation.
   2. Follow least-privilege principles so fewer accounts have permanent Global Admin or subscription owner access.
   3. For hybrid environments, ensure cloud admin accounts are not synchronized from on-premises AD DS.
3. Build tenant-wide protections
   1. Enable Security Defaults or use Conditional Access to enforce MFA and block legacy authentication.
   2. Block legacy authentication protocols because they bypass modern protections and are a common compromise path.
   3. Review risky users and risk reports in Microsoft Entra ID Identity Protection.
4. Prevent one compromised admin from locking out others
   1. Maintain emergency “break glass” accounts for tenant recovery when normal admin access is unavailable.
   2. Store break-glass credentials securely and keep them separate from normal administrator devices.
   3. Use PIM and approval-based activation to reduce the chance that a single always-active admin can change permissions broadly.
   4. Ensure multiple trusted administrators exist and regularly validate recovery procedures.
5. Immediate actions after discovering compromise
   1. Change credentials for tenant admins and Azure subscription RBAC owners immediately.
   2. Verify and update admin password recovery emails and phone numbers in Microsoft Entra ID.
   3. Review Microsoft Entra sign-in logs for unusual sign-in patterns around the incident.
   4. Review Azure Activity Log for unauthorized subscription-level changes, billing changes, usage anomalies, and configuration changes.
   5. Review spending anomalies in Azure Cost Management.
   6. Investigate risky users, tenants, and subscriptions in Microsoft Entra ID Identity Protection.
   7. Identify and evict the threat actor, then disable, deallocate, or delete compromised or unauthorized resources.
   8. Contact Azure support immediately and preserve relevant logs for forensic investigation.
6. Recovery and rebuild safeguards
   1. Keep backups of relevant logs for investigation.
   2. Use incremental snapshots in Azure for managed disks to support forensic investigation and point-in-time recovery.
   3. Protect backup administration with strong authentication, MFA, and PIM. Ensure backup access has a separate recovery path if the tenant is compromised.
   4. Implement a patching plan across operating systems and critical infrastructure.
7. Recommended architecture for Global Admin and subscription access
   1. Separate privileged identities from normal user identities.
   2. Require MFA for all privileged roles.
   3. Use dedicated admin workstations or PAWs for privileged tasks.
   4. Use Microsoft Entra PIM for just-in-time activation of privileged roles.
   5. Enforce tenant-wide protections with Security Defaults or Conditional Access.
   6. Maintain emergency access accounts.
   7. Monitor sign-ins, risky users, activity logs, and cost anomalies continuously.

Given the incident described, the highest-priority improvements are:

• dedicated admin workstations or PAWs
• MFA enforced for all privileged roles
• PIM for all privileged access
• emergency break-glass accounts
• blocking legacy authentication
• continuous review of sign-in logs, activity logs, and cost anomalies
• backup and snapshot strategy for recovery and forensics

References:

• Detect and respond to security alerts
• Implement security breach prevention and recovery infrastructure
• Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID
• Azure identity management and access control best practices
• Secure Configuration Guide