I'm looking for a production-friendly way to apply hardening baselines to Windows and Linux VMs joined only to Entra ID. The Azure security baseline appears to audit settings, but I'm not sure how to enforce or remediate them without domain GPOs. What options are worth considering?
How are you hardening Entra ID joined servers in Azure?
Asked by
KINDLY IGNORE THE BELL
Answers
CIS-hardened images from Azure Marketplace are a reasonable starting point if you don't want to build a baseline from scratch. Check the image and benchmark settings against your application's requirements before putting it into production.
You can layer organization-specific changes on top with scripts, such as Azure Automation for Windows registry settings. That still leaves you responsible for maintaining those customizations and checking for drift.
Reply to this answer
For Linux, another option is to use OpenSCAP to generate an Ansible hardening playbook, then use Packer in an image pipeline to scan, remediate and produce a golden image. It takes more work than picking a marketplace image, but gives you more control over the baseline.
Reply to this answer
Separate Azure resource settings from settings inside the VM. Azure Policy effects such as modify and deployIfNotExists can remediate supported resource configurations. For guest settings, look at Azure machine configuration.
Don't assume an audit policy will fix what it finds, though. Check whether each definition actually includes remediation, or whether you'll need to build and maintain the configuration yourself. That extra management can be a sticking point for a small team.
KINDLY IGNORE THE BELL:
That's the gap I'm running into. The supplied baseline seems useful for monitoring, but I haven't found automatic remediation for its settings.
Reply to this answer
For Windows Server, have a look at OSConfig security baselines as another way to apply settings without relying on a domain GPO. Review the settings first and work out how you'll revert any that don't suit your environment. You can still use Defender for Cloud and Azure Policy to monitor the result.
Reply to this answer
Add your answer
Answers are reviewed before publication.
++squint!at~tomorrow:
The CIS benchmark documents are also useful if you want to understand the settings or build your own image instead.