Security Migration -- vSphere Security to Azure Security¶

# Assign Azure RBAC role to a user
az role assignment create \
  --assignee user@contoso.com \
  --role "Virtual Machine Contributor" \
  --scope /subscriptions/{sub}/resourceGroups/rg-migrated-vms

# Create custom role for AVS administrators
az role definition create --role-definition '{
  "Name": "AVS Administrator",
  "Description": "Manage AVS private clouds and VMs",
  "Actions": [
    "Microsoft.AVS/*",
    "Microsoft.Network/virtualNetworks/read",
    "Microsoft.Compute/virtualMachines/read"
  ],
  "NotActions": [],
  "AssignableScopes": ["/subscriptions/{sub}"]
}'

# Enable IDPS on Azure Firewall Premium
az network firewall policy create \
  --name fw-policy-prod \
  --resource-group rg-network \
  --location eastus2 \
  --sku Premium \
  --idps-mode Deny

# Configure TLS inspection
az network firewall policy update \
  --name fw-policy-prod \
  --resource-group rg-network \
  --key-vault-secret-id https://kv-certs.vault.azure.net/secrets/fw-tls-cert \
  --transport-security-certificate-authority /subscriptions/{sub}/resourceGroups/rg-network/providers/Microsoft.Network/firewallPolicies/fw-policy-prod/certificateAuthority/default

# Enable Defender for Cloud (subscription level)
az security pricing create \
  --name VirtualMachines \
  --tier Standard

# Enable specific Defender plans
az security pricing create --name SqlServers --tier Standard
az security pricing create --name AppServices --tier Standard
az security pricing create --name StorageAccounts --tier Standard
az security pricing create --name KeyVaults --tier Standard
az security pricing create --name Dns --tier Standard
az security pricing create --name Containers --tier Standard

# Create Key Vault for disk encryption keys
az keyvault create \
  --name kv-diskenc-eastus2 \
  --resource-group rg-security \
  --location eastus2 \
  --enabled-for-disk-encryption true

# Enable Azure Disk Encryption on a VM
az vm encryption enable \
  --name migrated-vm-01 \
  --resource-group rg-migrated-vms \
  --disk-encryption-keyvault kv-diskenc-eastus2 \
  --volume-type All

# Create disk encryption set with customer-managed key
az disk-encryption-set create \
  --name des-cmk-prod \
  --resource-group rg-security \
  --location eastus2 \
  --source-vault /subscriptions/{sub}/resourceGroups/rg-security/providers/Microsoft.KeyVault/vaults/kv-diskenc-eastus2 \
  --key-url https://kv-diskenc-eastus2.vault.azure.net/keys/disk-enc-key/version

# Apply to existing disks
az disk update \
  --name disk-vm01-os \
  --resource-group rg-migrated-vms \
  --disk-encryption-set des-cmk-prod

# Create Log Analytics workspace
az monitor log-analytics workspace create \
  --name law-sentinel-eastus2 \
  --resource-group rg-security \
  --location eastus2 \
  --retention-time 90

# Enable Sentinel on the workspace
az sentinel onboarding-state create \
  --resource-group rg-security \
  --workspace-name law-sentinel-eastus2 \
  --name default

# Assign built-in policy initiative (NIST 800-53 Rev 5)
az policy assignment create \
  --name nist-800-53-r5 \
  --scope /subscriptions/{sub} \
  --policy-set-definition "/providers/Microsoft.Authorization/policySetDefinitions/179d1daa-458f-4e47-8086-2a68d0d6c38f"

# Assign policy to enforce disk encryption
az policy assignment create \
  --name require-disk-encryption \
  --scope /subscriptions/{sub} \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d"

# Create VM with Trusted Launch
az vm create \
  --name vm-trusted-01 \
  --resource-group rg-migrated-vms \
  --location eastus2 \
  --image Win2022Datacenter \
  --security-type TrustedLaunch \
  --enable-secure-boot true \
  --enable-vtpm true \
  --size Standard_D4s_v5