Azure Security in the Real World: What the Certification Doesn't Teach You

Why I Pursued Azure Security After 9 Years in IT

By 2023, I had been managing IT infrastructure at a global enterprise for nearly a decade. I knew how to keep things running — but I realised I didn't fully understand why the security architecture was designed the way it was, or how to improve it.

Photo: Unsplash

The Azure Security Engineer Associate certification (AZ-500) changed that. But the certification is theory. What follows is practice.

The Modern Threat Landscape for Corporate IT

Before diving into controls, you need to understand what you're defending against. In a multinational IT environment, the real threats are:

Notice that most threats are about identity and device posture — not exotic malware. This is exactly why Zero Trust exists.

Zero Trust: What It Actually Means in Practice

The certification teaches you the definition: "Never trust, always verify."

The practice looks like this:

Step 1: Every Device Must Be Enrolled and Compliant

Using Microsoft Intune, we enforced that no device could access corporate resources unless:

• Enrolled in Intune/Azure AD (Entra ID)
• Running approved OS version
• Encryption enabled (BitLocker / FileVault)
• Antivirus definition current (Defender / Trellix)

# Intune Compliance Policy — Minimum Requirements
OS: Windows 11 22H2+ or macOS 13+
Disk encryption: Required
Firewall: Required  
Defender: Real-time protection ON
Password: Required, min 12 chars, complexity ON

Non-compliant devices got Conditional Access blocks — they could see the sign-in page but couldn't authenticate until they fixed compliance.

Step 2: MFA Everywhere (But Not Annoying)

The classic mistake is enabling MFA and then getting flooded with complaints. The right approach:

• Named locations (corporate office IP ranges) = trusted, no MFA required
• Unknown location + sensitive app = MFA required
• New device + any location = MFA + device registration required
• Executive accounts = FIDO2 security key (no SMS/authenticator)

Step 3: Privileged Access — Minimum Viable Permissions

Every IT admin account had only the permissions needed for their specific role. No permanent Global Admin. Privileged Identity Management (PIM) for time-bound elevated access with audit logs.

Conditional Access — The Most Powerful Tool You're Probably Underusing

Here's a real policy set that protected a few hundred users at a multinational enterprise:

This matrix eliminated 100% of legacy auth attacks in our environment.

Secure Score Progress

What the Certification Exam Won't Tell You

1. Conditional Access conflicts are real. If you have 15 CA policies, the wrong combination will lock users out on a Friday evening. Always test in report-only mode first for 2 weeks.

2. Named locations are your best friend. Get your office IP ranges documented before you deploy anything. The number of support calls drops dramatically when trusted locations are properly configured.

3. Intune rollout requires change management, not just technology. Users react badly to suddenly having their personal phone enrolled in MDM. Communication, FAQ documents, and a soft launch period matter.

4. Defender for M365 Secure Score is addictive. Once you start improving your score, you can't stop. We went from 41% to 78% in 6 months.

My Recommended Security Stack for a Mid-Size Corporate Environment

The Human Layer Is Still the Weakest

After all the technical controls, the most effective security improvement I made was a 30-minute awareness session with each new hire. Not a 2-hour compliance video — a real conversation about:

• What phishing actually looks like (real examples from corporate environments)
• How to report a suspicious email (one click, one button)
• What happens if they click something they shouldn't (no blame, just report)

Humans are the firewall that Intune can't configure. Invest in them.