Azure Hardening Lab: Policy, Storage, Key Vault, NSG
You harden a fictional Azure estate decision by decision. Structure the management groups, enforce guardrails with Azure Policy, make logs arrive by default, close a public storage account, move Key Vault to Azure RBAC without an outage and read a network security group the way Azure does. Want the full picture? Read the Secure Azure Architecture guide or score your own estate with the Azure Security Checklist.
You are Alex Moreno, the cloud security lead at Contoso Retail, a fictional company (contoso.example) that has just taken over an Azure estate of 14 subscriptions with no structure. Across 10 decisions you set up management groups and Azure Policy, read Defender for Cloud recommendations, close a public storage account, move Key Vault to Azure RBAC, fix a network security group and add private endpoints. Everything is fictional: the company, the subscriptions and the resource names. No commands or templates appear. Each call is scored 0 to 10 with the Microsoft Learn page behind the rationale.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab for cloud security engineers: a fictional company (contoso.example) takes over an Azure estate of 14 subscriptions with no structure, and you harden it step by step.
- You make 10 scored decisions: management group hierarchy and its protection, Azure Policy audit-then-deny rollout, central logging, Defender for Cloud prioritisation, public storage access, Shared Key authorization, Key Vault Azure RBAC, a network security group rule and private endpoints.
- Every rationale cites the Microsoft Learn page behind it, read on 4 November 2026. Where a step is PlayCISO practice rather than a Microsoft statement, the feedback says so.
- Free to play, no sign-up needed to run it. A final score and grade, a shareable scorecard and next-step links.
- Defensive and educational only. No commands or templates appear, and every company, subscription and resource name is fictional.
Frequently asked questions
What does the Azure Hardening Lab teach?
How to turn an unstructured Azure estate into a governed one. You choose a management group hierarchy, protect it, roll out Azure Policy safely, centralise logging, prioritise Defender for Cloud recommendations, close public storage access and Shared Key authorization, move Key Vault to Azure RBAC without an outage, read network security group priorities correctly and add private endpoints.
Why audit before deny in Azure Policy?
The audit effect reports non-compliant resources without blocking requests, while deny prevents creating or changing a resource into a non-compliant state. Microsoft's approach to anonymous blob access starts by detecting who uses it, because disallowing it makes future anonymous requests fail. Audit first shows you the impact; deny then enforces.
Does a higher Defender for Cloud secure score mean lower risk?
Not always. The secure score aggregates findings from built-in Microsoft cloud security benchmark recommendations, excludes preview recommendations, and, per Microsoft's page at the time of reading, is not affected by risk prioritization. Use the score as a trend and order the work by exposure and data sensitivity.
Does the lab need an Azure subscription?
No. It is a decision lab in your browser with fictional resources. You do not connect to Azure or enter any account details.
How is it scored?
Each decision scores 0 to 10 and the final score is the share of the maximum. Grades run from "Wide open" to "Guardrails in place". The debrief shows the best choice and its Microsoft Learn source for every step.
Can I download my debrief?
The debrief is shown on the page for free. Downloading it as Word, PDF or Markdown needs a paid plan.
Sources
Read on 4 November 2026. Written in our own words; no Microsoft text is reproduced.
- Microsoft Learn: Cloud Adoption Framework, Management groups (Azure landing zone design area)
- Microsoft Learn: What is Azure Policy?
- Microsoft Learn: Azure Policy definitions effect basics
- Microsoft Learn: Secure score in Defender for Cloud
- Microsoft Learn: Remediate anonymous read access to blob data (Azure Resource Manager deployments)
- Microsoft Learn: Prevent Shared Key authorization for an Azure Storage account
- Microsoft Learn: Grant permission to applications to access an Azure key vault using Azure RBAC
- Microsoft Learn: Network security groups overview
- Microsoft Learn: What is a private endpoint?
- Microsoft Learn: Log Analytics workspace overview
- Microsoft Learn: Overview of the Microsoft cloud security benchmark v2 (preview)
- Microsoft Learn: Security best practices for application properties in Microsoft Entra ID
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.