Azure Defense-in-Depth Layers

The defense-in-depth model in Azure includes several distinct layers, each focusing on a different area of security. The physical security layer protects the data center buildings and hardware from unauthorized physical access. The identity and access management layer uses tools like Microsoft Entra ID (formerly Azure Active Directory) and Azure role-based access control (RBAC) to verify who users are and what they can do. Perimeter security secures the network's outer boundaries with firewalls and other technologies, while network security controls traffic inside the virtual network using services such as Network Security Groups (NSGs) and Azure Firewall. The compute security layer ensures virtual machines and other compute resources are hardened against attacks. Application security involves secure coding practices and regular assessments to protect applications from exploits. Finally, the data security layer encrypts data both at rest and in transit, using tools like Azure Storage Service Encryption and Azure Key Vault to keep sensitive information safe. Together, these layers create overlapping controls that provide comprehensive coverage.