Design security solutions for infrastructure
Contain the network, harden the platform
Design around a hub-and-spoke (or Virtual WAN) topology: shared services, centralized egress through Azure Firewall, spokes peered to the hub. Inside a spoke, use network security groups and application security groups for micro-segmentation between tiers rather than relying on subnets alone. Azure DDoS Protection covers the public edge, Azure Firewall or a partner NVA handles FQDN and L7 egress filtering, NSGs handle L3/L4.
Private connectivity is a recurring theme. Private Endpoints (Azure Private Link) give a service a private IP in your VNet and remove public exposure; Service Endpoints keep traffic on the Microsoft backbone but the service still has a public endpoint. A requirement that says "must not be reachable from the internet" wants Private Endpoint plus public network access disabled.
For administrative access, Azure Bastion removes public RDP/SSH exposure, and Defender for Cloud just-in-time VM access narrows NSG rules to a short window from an approved source. Defender for Servers adds endpoint protection, vulnerability assessment, file integrity monitoring, and adaptive application controls. Azure Arc extends the same policy and Defender coverage to on-premises and multicloud servers.
Encryption: platform-managed keys (SSE) are the default; customer-managed keys in Key Vault give key control and revocation; Azure Managed HSM gives single-tenant FIPS 140-2 Level 3 key custody for the strictest requirements.
Rule of thumb: Azure Policy prevents, Defender for Cloud detects and recommends. "Prevent deployment of public IPs" is a Policy Deny effect, not a recommendation.
Worked example: a storage account holds regulated data and must have no internet path plus customer-controlled keys. Answer: Private Endpoint, public network access disabled, firewall default-deny, customer-managed key in Managed HSM, Defender for Storage enabled.