Security Setup Checklist

• Sign in to Entra admin centerOpen the Microsoft Entra admin center for government (entra.microsoft.us) and sign in as a Conditional Access Administrator or Global Administrator.
• Open authentication methodsGo to Entra ID > Authentication methods > Policies and enable FIDO2 security key and Certificate-based authentication so users can register them.
• Register CAC/PIV or keysHave each user register a FIDO2 key or their CAC/PIV smart card before you enforce the rule, so no one gets locked out.
• Create a Conditional Access policyIn the Entra admin center, go to Entra ID > Conditional Access > Policies and select New policy, then give it a clear name.
• Target users and appsUnder Assignments pick your users (exclude a break-glass emergency account), and under Target resources choose All resources (formerly all cloud apps).
• Require phishing-resistant strengthUnder Access controls > Grant, choose Require authentication strength and pick the built-in Phishing-resistant MFA strength, then Select.
• Test then turn onSet Enable policy to Report-only first to check impact, then switch it to On once it looks correct.

Evidence to keep: Screenshot of the Conditional Access policy showing Phishing-resistant MFA strength · Authentication methods registration report · Sign-in logs showing MFA method used

• Open a resource's access pageIn the Azure Government portal (portal.azure.us), open a subscription or resource group and select Access control (IAM).
• Review who has accessOn the Role assignments tab, look for anyone with Owner or Contributor who does not need it and remove extra access.
• Assign a narrow built-in roleSelect Add > Add role assignment and pick the smallest role that fits the job, such as Reader or a specific service role.
• Create a custom role if neededIn the subscription, choose Access control (IAM) > Add > Add custom role to build a role with only the exact permissions required.
• Open Privileged Identity ManagementIn the Entra admin center (entra.microsoft.us), go to Identity Governance > Privileged Identity Management.
• Make admin roles eligibleUnder PIM, set powerful roles like Global Administrator to Eligible instead of Active so they must be activated when needed.
• Require approval and MFAIn the role settings, require MFA, justification, and approval for activation, and set a short activation time such as a few hours.

Evidence to keep: Export of role assignments per subscription · PIM eligible-assignment and activation history report · List of custom role definitions

• Open Resource Graph ExplorerIn the Azure Government portal (portal.azure.us), search for Resource Graph Explorer to query every resource across your subscriptions.
• List all resourcesRun a simple query like 'resources | project name, type, location, resourceGroup' and export the results to a file.
• Open Defender for Cloud inventorySearch for Microsoft Defender for Cloud, then select Inventory to see all machines, storage, and databases with their health.
• Filter for unmonitored assetsIn Inventory, filter by Defender status to find resources that are not yet protected and add them.
• Review Entra devicesIn the Entra admin center (entra.microsoft.us), go to Devices > All devices to see every enrolled and registered computer.
• Review user accountsIn the Entra admin center, go to Users > All users and check for stale or unknown accounts to disable.
• Schedule regular exportsSave your Resource Graph query and re-run it monthly, keeping each export as a dated inventory record.

Evidence to keep: Dated Azure Resource Graph export of all resources · Defender for Cloud inventory export · Entra All devices and All users lists

• Create a Log Analytics workspaceIn the Azure Government portal (portal.azure.us), search for Log Analytics workspaces and create one in a US Gov region.
• Turn on diagnostic settingsOpen a resource, go to Monitoring > Diagnostic settings, select Add diagnostic setting, and send logs to your workspace.
• Cover the whole subscriptionIn Azure Monitor > Activity log > Export Activity Logs, send subscription-level activity to the same workspace.
• Enable Microsoft SentinelSearch for Microsoft Sentinel, add it, and connect it to your Log Analytics workspace.
• Connect data sourcesIn Sentinel, go to Content hub / Data connectors and connect Entra ID sign-in logs, Azure activity, and Defender for Cloud.
• Turn on analytics rulesIn Sentinel > Analytics, enable built-in rule templates so suspicious sign-ins and changes create alerts.
• Set a retention periodIn the workspace settings, set log retention to meet your policy (defense rules commonly expect at least 90 days readily available and longer archived).

Evidence to keep: Diagnostic settings configuration for key resources · Sentinel data-connector and analytics-rule list · Log retention setting screenshot

• Create virtual networksIn the Azure Government portal (portal.azure.us), search for Virtual networks and create separate VNets and subnets for different tiers of work.
• Add network security groupsSearch for Network security groups, create one, and write rules that allow only the ports and sources each subnet truly needs.
• Attach NSGs to subnetsOpen each subnet in your VNet and associate the matching NSG so its rules take effect.
• Deploy a hub firewallSearch for Firewalls, deploy Azure Firewall in a central hub VNet, and route spoke traffic through it.
• Connect hub and spokesUse VNet peering to link each workload (spoke) VNet to the central hub for shared inspection and control.
• Add Private LinkSearch for Private Link and create private endpoints so services like storage are reached over your private network, not the public internet.
• Deny by defaultReview NSG and firewall rules to confirm everything is blocked unless explicitly allowed.

Evidence to keep: Network diagram of hub-spoke VNets · Exported NSG and Azure Firewall rule sets · List of private endpoints protecting data services

• Open Defender for CloudIn the Azure Government portal (portal.azure.us), search for Microsoft Defender for Cloud.
• Turn on Defender plansGo to Environment settings, pick your subscription, and enable the Defender for Servers plan that includes vulnerability scanning.
• Review findingsIn Recommendations, review the vulnerability findings and sort by severity to fix the worst ones first.
• Open Azure Update ManagerSearch for Azure Update Manager to see which machines are missing operating-system updates.
• Check for missing updatesIn Update Manager, select Machines and run a Check for updates to get a current compliance picture.
• Schedule patchingIn Update Manager, create a maintenance configuration so updates install automatically on a regular schedule.
• Confirm and trackAfter patching, re-check compliance and record which fixes were applied and which remain.

Evidence to keep: Defender for Cloud vulnerability assessment report · Azure Update Manager compliance/patch history · Record of remediation timelines

• Create a Key VaultIn the Azure Government portal (portal.azure.us), search for Key vaults and create one in a US Gov region with purge protection turned on.
• Generate a keyIn the Key Vault, go to Keys > Generate/Import and create a key to use for encrypting your data.
• Turn on customer-managed keysOpen a storage account, go to Encryption, choose Customer-managed keys, and point it at your Key Vault key.
• Encrypt virtual machine disksOpen a disk or VM, go to the encryption settings, and apply your customer-managed key for disk encryption.
• Enforce secure transferIn each storage account's Configuration, enable Secure transfer required and set the minimum TLS version to 1.2.
• Restrict key accessIn the Key Vault Access control (IAM), give only specific services and admins permission to use the keys.
• Enable key rotationIn the Key Vault, set a rotation policy so keys are automatically replaced on a schedule.

Evidence to keep: Key Vault configuration showing purge protection and rotation policy · Storage/disk settings showing customer-managed key encryption · Proof TLS 1.2+ is enforced

• Create a Recovery Services vaultIn the Azure Government portal (portal.azure.us), search for Recovery Services vaults and create one in a US Gov region.
• Choose redundancyIn the vault's Properties > Backup Configuration, select Geo-redundant storage so copies exist in a second Gov region.
• Turn on soft deleteIn the vault Properties > Security settings, confirm soft delete is on so deleted backups can still be recovered.
• Back up a resourceIn the vault, select Backup, pick the workload such as an Azure VM or Azure Files share, and choose the item.
• Set a backup policyCreate or pick a policy that sets how often backups run and how long they are kept (daily with multi-week retention is common).
• Enable immutabilityIn vault settings, turn on immutable vault so backups cannot be changed or deleted early by an attacker.
• Test a restoreUse Restore to recover a test item and confirm your backups actually work.

Evidence to keep: Backup policy showing frequency and retention · Recovery Services vault redundancy and immutability settings · Successful test-restore report

• Open Defender for CloudIn the Azure Government portal (portal.azure.us), search for Microsoft Defender for Cloud and open the Overview.
• Review your secure scoreCheck the Secure Score and open Recommendations to see prioritized fixes that raise your score.
• Open regulatory complianceIn Defender for Cloud, select Regulatory compliance to view your posture against built-in standards.
• Add NIST/CMMC standardsChoose Manage compliance policies and assign the NIST SP 800-171 and CMMC (or DoD IL) built-in initiatives to your subscription.
• Open Azure PolicySearch for Policy, go to Definitions, and pick a built-in initiative that matches your required baseline.
• Assign the policySelect Assign, scope it to your subscription or management group, and choose Audit or Deny effects.
• Fix and remediateWork through non-compliant items and use Policy remediation tasks to correct existing resources.

Evidence to keep: Defender for Cloud secure score over time · Regulatory compliance dashboard export for NIST 800-171 / CMMC · Azure Policy assignments and compliance results

• Create an Azure OpenAI resourceIn the Azure Government portal (portal.azure.us), search for Azure OpenAI and create the resource in usgovvirginia or usgovarizona.
• Deploy an approved modelOpen the resource in Azure AI Foundry and deploy a regional or USGov DataZone model so data stays in Gov regions.
• Lock down accessRestrict the resource with Private Link and RBAC so only approved apps and users can call the model.
• Open the Purview portalGo to the Microsoft Purview portal for your government tenant and sign in as a compliance admin.
• Label sensitive dataIn Purview, create sensitivity labels (for example, CUI) under Information Protection so files and emails can be marked.
• Create a DLP policyIn Purview > Data Loss Prevention > Policies, create a policy that blocks or warns when labeled CUI is shared externally, including Endpoint DLP.
• Review AI data risksIn Purview, open Data Security Posture Management (DSPM) for AI to see and control how AI apps touch sensitive data.

Evidence to keep: Azure OpenAI deployment showing US Gov region and private networking · Purview DLP policy definitions and match reports · DSPM for AI activity showing sensitive-data interactions