{"id":25028,"date":"2026-07-14T15:17:56","date_gmt":"2026-07-14T14:17:56","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=25028"},"modified":"2026-07-14T15:27:07","modified_gmt":"2026-07-14T14:27:07","slug":"the-3-azure-security-mistakes-i-see-during-audits","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=25028","title":{"rendered":"The 3 Azure Security Mistakes I See During Audits"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I&#8217;ve performed many Azure audits over the years, both formally and informally while learning new environments. Despite the differences between organisations, the same three security failures appear again and again. I\u2019m going to surprise you here, because my scope is not the defence \u2013 it\u2019s what comes after because we must assume that we have <a href=\"https:\/\/archives.fbi.gov\/archives\/news\/speeches\/combating-threats-in-the-cyber-world-outsmarting-terrorists-hackers-and-spies\">already been breached<\/a>. The three most common reasons that I see failing Azure security are:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Monitoring<\/li>\n\n\n\n<li>Alerting<\/li>\n\n\n\n<li>Response<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Pre-2003 Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most of you assume that cybersecurity should be based on the 1990s movie, The Net. Build a great big firewall and keep the bad guys on the Internet out. That approach has served us all \u201cwell\u201d:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ransomware runs rampant.<\/li>\n\n\n\n<li>Cybercrime is earning countless billions per year \u2013 we only have hints at pockets of the earnings.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The reality is that the bad guys can bypass your firewall, including but not limited to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PCs (that aren\u2019t sufficiently isolated) that are browsing phishing variant sites and opening malware attachments.<\/li>\n\n\n\n<li>Compromised libraries being used by developers or compromised software being installed by system administrators.<\/li>\n\n\n\n<li>External vendors\/partners\/customers are not isolated\/untrusted and they become an attack vector.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">We assume the bad guy will attack non-application ports. But in reality, they will spread through approved channels if they have to (micro-segmentation).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Modern Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">I did an analysis of recommendations by several national cybersecurity agencies in the EU last year. The common thread was a move away from a purely preventative approach and towards rapid detection and response when prevention inevitably fails, mirroring the requirements of the EUs NIS2 regulation:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Defend<\/li>\n\n\n\n<li>Monitor<\/li>\n\n\n\n<li>Response<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">I\u2019m not covering \u201cdefend\u201d in this post. My focus is points 2 and 3. Don\u2019t misunderstand me \u2013 most organisations do a bad job at \u201cDefend\u201d.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Failure 1 \u2013 Monitoring<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine \u2013 you purchase a nice NGFW firewall such as Azure Firewall Premium or something else from the Azure Marketplace. You spend countless hours (hopefully) modelling precise firewall rules to permit only the required traffic, retaining the deny-by-default concept. But, you do not:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Gather logs from the firewall.<\/li>\n\n\n\n<li>Set security features, such as Threat Intelligence or Intrusion Detection and Prevention System (IDPS) to \u201cAlert &amp; Deny\u201d mode.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Elsewhere, the Web Application Firewall is set up:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Without log collection.<\/li>\n\n\n\n<li>In detection (log only) mode, not prevention mode.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In the Virtual Networks, you don\u2019t enable VNet Flow Logs, which see everything, including the bad guy probing and attempting to move east\/west.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All these tripwires to catch the bad guy inside of your network are commonly ignored. We spend so much time (hopefully) on building a defence, but we ignore the fact that the bad guy <em>will<\/em> get in and our job is to detect that as soon as possible so we can act.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Failure 2 \u2013 Alerting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Assume that we have enabled monitoring to gather the data. Now we need to do something with that data. Having that data sitting around is great for investigations \u2013 but how are you going to trigger an investigation:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Wait for the ransomware demand after you\u2019ve been shut down?<\/li>\n\n\n\n<li>Detect the bad guy before he does (too much) damage?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">I\u2019d prefer the latter option. But, I see two situations:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Customers who focus on the obvious things like networks, site-to-site connections, firewall appliances, but don\u2019t think about the critical small stuff like what to generate an alert on or where to send it.<\/li>\n\n\n\n<li>Giant repositories of monitoring data but no alerts that use that data to trigger a human\/automated response.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Failure 3 \u2013 Response<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is easily the most ignore aspect of cybersecurity. We\u2019ve detected a bad guy or an attack \u2013 now what?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can break this down to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Immediate response<\/strong>: How do we immediately act, including fast investigation, shutting things down, requesting assistance, etc?<\/li>\n\n\n\n<li><strong>Recovery<\/strong>: What do we do to recover from the attack, such as restoring backups, triggering failover, etc?<\/li>\n\n\n\n<li><strong>Investigation<\/strong>: Determine the entry point and method, how the attack spread, how did our processes work, what can we do to prevent this from repeating, how can we improve our processes, etc?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Most of the above is procedural. There are two technical elements to consider:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Backup<\/li>\n\n\n\n<li>Disaster recovery (DR)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Quite honestly, DR in Azure is a mess right now (capacity issues) unless you use a backup solution such as Veeam that can recover all of your compute and data to another <em>available<\/em> location. There are <em>so many<\/em> conditions in that sentence!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s focus on backup \u2013 unlike many organisations. I bet that most are not retaining backups for very long (to save money), they may use unprotected third-party backup, and I can safely bet that the last test restore was more than 5 years ago, if ever.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the technical stuff isn\u2019t there, then we can bet that the well documented &amp; communicated processes are fictional too.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What You Can Expect<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We should expect that an attacker will eventually gain access. Based on the above, then that experience for most of you will be:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The bad guy moves around without being detected.<\/li>\n\n\n\n<li>You find out about the attack from your users\/customers.<\/li>\n\n\n\n<li>You will panic, take too long to respond, and maybe make destructive mistakes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The time to prevent all this is as-soon-as-possible. Monitoring ingestion will cost money \u2013 that\u2019s just how that works. Alerting is matter of getting organised by deciding what the tripwires are and how notifications should be sent \u2013 alerts are a micro-cost. You should have backups \u2013 we don\u2019t need to say more. Modern backups use differencing-based-retention to keep costs low for keeping data around for months or years. What you really need is time to build processes and implement them \u2013 that may be the biggest cost.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pay Now Or Pay Later<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We can argue costs when it comes to cybersecurity. If you\u2019re doing business in or with the EU then you have no choice but to get compliant:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The GDPR<\/li>\n\n\n\n<li>NIS2<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Other countries\/regions have their own variants that I know little about. The EU has made it clear that cybersecurity is an organisation leadership issue, not an IT issue. NIS2 is pretty clear, really bad non-compliance cases can lead to directors losing the right to be directors for any organisation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can pay the toll now, or you can pay the piper later. Firewalls and security controls may slow attackers down, but monitoring, alerting, and response are what determine whether an intrusion becomes an incident or a disaster.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Find Out Where You Stand<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every failure above was found in a real environment by someone doing exactly this. If you don&#8217;t know whether your monitoring, alerting and response would stand up to a real intrusion, then you already have your answer. Cloud Mechanix runs a <a href=\"https:\/\/cloudmechanix.com\/fixed-rate-cloud-environment-review\/\">Fixed-Rate Cloud Environment Review<\/a>: a fixed price, read-only assessment of your Azure environment, delivered in 5 business days, with a written report and a session to walk you through what we found and what to do about it. No open-ended consulting engagement, and no surprise invoice. Find out what an attacker would find, before they do.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve performed many Azure audits over the years, both formally and informally while learning new environments. Despite the differences between organisations, the same three security failures appear again and again. I\u2019m going to surprise you here, because my scope is not the defence \u2013 it\u2019s what comes after because we must assume that we have &hellip; <a href=\"https:\/\/aidanfinn.com\/?p=25028\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;The 3 Azure Security Mistakes I See During Audits&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":25029,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[5],"tags":[170,148,238,594,190,615],"class_list":["post-25028","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure","tag-azure-backup","tag-azure-monitor","tag-disaster-recovery","tag-security","tag-sentinel"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"AFinn\"\/>\n\t<meta name=\"google-site-verification\" content=\"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/aidanfinn.com\/?p=25028\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro\" \/>\n\t\t<meta property=\"og:description\" content=\"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/aidanfinn.com\/?p=25028\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-14T14:17:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-14T14:27:07+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@joe_elway\" \/>\n\t\t<meta name=\"twitter:title\" content=\"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@joe_elway\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#article\",\"name\":\"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro\",\"headline\":\"The 3 Azure Security Mistakes I See During Audits\",\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/LegoPiedPiper.png\",\"width\":682,\"height\":682,\"caption\":\"Pay the Piper now or later\"},\"datePublished\":\"2026-07-14T15:17:56+01:00\",\"dateModified\":\"2026-07-14T15:27:07+01:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#webpage\"},\"articleSection\":\"Azure, Azure, Azure Backup, Azure Monitor, Disaster recovery, Security, Sentinel\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/aidanfinn.com\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5#listItem\",\"name\":\"Azure\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5#listItem\",\"position\":2,\"name\":\"Azure\",\"item\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#listItem\",\"name\":\"The 3 Azure Security Mistakes I See During Audits\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#listItem\",\"position\":3,\"name\":\"The 3 Azure Security Mistakes I See During Audits\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=5#listItem\",\"name\":\"Azure\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#webpage\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028\",\"name\":\"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro\",\"description\":\"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/LegoPiedPiper.png\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028\\\/#mainImage\",\"width\":682,\"height\":682,\"caption\":\"Pay the Piper now or later\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=25028#mainImage\"},\"datePublished\":\"2026-07-14T15:17:56+01:00\",\"dateModified\":\"2026-07-14T15:27:07+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/\",\"name\":\"Aidan Finn, IT Pro\",\"description\":\"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro","description":"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.","canonical_url":"https:\/\/aidanfinn.com\/?p=25028","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aidanfinn.com\/?p=25028#article","name":"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro","headline":"The 3 Azure Security Mistakes I See During Audits","author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"publisher":{"@id":"https:\/\/aidanfinn.com\/#person"},"image":{"@type":"ImageObject","url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/07\/LegoPiedPiper.png","width":682,"height":682,"caption":"Pay the Piper now or later"},"datePublished":"2026-07-14T15:17:56+01:00","dateModified":"2026-07-14T15:27:07+01:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/aidanfinn.com\/?p=25028#webpage"},"isPartOf":{"@id":"https:\/\/aidanfinn.com\/?p=25028#webpage"},"articleSection":"Azure, Azure, Azure Backup, Azure Monitor, Disaster recovery, Security, Sentinel"},{"@type":"BreadcrumbList","@id":"https:\/\/aidanfinn.com\/?p=25028#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/aidanfinn.com#listItem","position":1,"name":"Home","item":"https:\/\/aidanfinn.com","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=5#listItem","name":"Azure"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=5#listItem","position":2,"name":"Azure","item":"https:\/\/aidanfinn.com\/?cat=5","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=25028#listItem","name":"The 3 Azure Security Mistakes I See During Audits"},"previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=25028#listItem","position":3,"name":"The 3 Azure Security Mistakes I See During Audits","previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=5#listItem","name":"Azure"}}]},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/#person","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=25028#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/?author=1#author","url":"https:\/\/aidanfinn.com\/?author=1","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=25028#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"WebPage","@id":"https:\/\/aidanfinn.com\/?p=25028#webpage","url":"https:\/\/aidanfinn.com\/?p=25028","name":"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro","description":"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/aidanfinn.com\/#website"},"breadcrumb":{"@id":"https:\/\/aidanfinn.com\/?p=25028#breadcrumblist"},"author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"creator":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"image":{"@type":"ImageObject","url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/07\/LegoPiedPiper.png","@id":"https:\/\/aidanfinn.com\/?p=25028\/#mainImage","width":682,"height":682,"caption":"Pay the Piper now or later"},"primaryImageOfPage":{"@id":"https:\/\/aidanfinn.com\/?p=25028#mainImage"},"datePublished":"2026-07-14T15:17:56+01:00","dateModified":"2026-07-14T15:27:07+01:00"},{"@type":"WebSite","@id":"https:\/\/aidanfinn.com\/#website","url":"https:\/\/aidanfinn.com\/","name":"Aidan Finn, IT Pro","description":"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","inLanguage":"en-GB","publisher":{"@id":"https:\/\/aidanfinn.com\/#person"}}]},"og:locale":"en_GB","og:site_name":"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","og:type":"article","og:title":"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro","og:description":"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.","og:url":"https:\/\/aidanfinn.com\/?p=25028","article:published_time":"2026-07-14T14:17:56+00:00","article:modified_time":"2026-07-14T14:27:07+00:00","twitter:card":"summary","twitter:site":"@joe_elway","twitter:title":"The 3 Azure Security Mistakes I See During Audits | Aidan Finn, IT Pro","twitter:description":"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.","twitter:creator":"@joe_elway"},"aioseo_meta_data":{"post_id":"25028","title":null,"description":"Discover the three Azure security failures I find most often in audits: poor monitoring, ineffective alerting, and weak response.","keywords":null,"keyphrases":{"focus":{"keyphrase":"Azure security","score":72,"analysis":{"keyphraseInTitle":{"score":9,"maxScore":9,"error":0},"keyphraseInDescription":{"score":9,"maxScore":9,"error":0},"keyphraseLength":{"score":9,"maxScore":9,"error":0,"length":2},"keyphraseInIntroduction":{"score":9,"maxScore":9,"error":0},"keyphraseInSubHeadings":{"score":3,"maxScore":9,"error":1},"keyphraseInImageAlt":[],"keywordDensity":{"score":0,"type":"low","maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-07-14 14:12:47","updated":"2026-07-14 16:11:23","seo_analyzer_scan_date":null,"focus_keyword":"Azure security","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\/?cat=5\" title=\"Azure\">Azure<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tThe 3 Azure Security Mistakes I See During Audits\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/aidanfinn.com"},{"label":"Azure","link":"https:\/\/aidanfinn.com\/?cat=5"},{"label":"The 3 Azure Security Mistakes I See During Audits","link":"https:\/\/aidanfinn.com\/?p=25028"}],"amp_enabled":true,"jetpack_featured_media_url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2026\/07\/LegoPiedPiper.png","_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/25028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=25028"}],"version-history":[{"count":3,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/25028\/revisions"}],"predecessor-version":[{"id":25032,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/25028\/revisions\/25032"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/media\/25029"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}