What security baseline does a new Azure subscription need?

A new Azure subscription needs four things on day one: a place in a landing zone design, least privilege role assignments at narrow scopes, the free Foundational cloud security posture checks turned on, and a written list of who owns the subscription. Everything else, such as networking and logging, builds on those.

Where should the subscription sit?

Microsoft's Cloud Adoption Framework describes an Azure landing zone as an architecture for governing, securing and scaling a multi subscription environment. It has two parts: a platform landing zone, the centralised foundation for governance, security and shared resources, and workload landing zones, the environments for each workload. Each workload gets its own landing zone, with typical environments such as development, test and production, each made of one or more subscriptions.

For a small company, the lesson is to avoid one giant subscription. A constructed starting layout: one subscription for shared identity and logging, one for production workloads, one for non production. Policies applied at a parent level then reach new subscriptions automatically.

How should you assign access?

The Azure role based access control best practices page says to grant users the least privilege needed to get their work done, to avoid broader roles at broader scopes even when it seems convenient, and, when creating custom roles, to include only the permissions users need. Limiting roles and scopes limits what resources are at risk if a principal is compromised.

Applied to day one:

• Give people the narrowest built in role at resource group scope, not at subscription scope.
• Keep very few accounts with the highest privileges, and keep those separate from daily accounts.
• Prefer groups to individual assignments, so offboarding is one change.
• Give automation its own identity instead of a person's account.

Which posture checks are free?

Defender for Cloud offers two cloud security posture management plans. The documentation says Foundational CSPM is available at no cost, and Defender CSPM is a paid plan with advanced capabilities. With Foundational CSPM, the Microsoft cloud security benchmark standard produces recommendations, and a secure score based on some of those recommendations helps you monitor compliance. A higher score indicates lower identified risk.

Turn on the free plan for every subscription and read the first recommendations list. Work through the ones that touch identity, public exposure and encryption before anything cosmetic. Whether you need the paid plan depends on your size and risk; check the current plan details on the Microsoft page before deciding.

What is the benchmark?

The Microsoft cloud security benchmark gives security controls and recommendations for Azure. The page we fetched describes version 2 as a preview, so confirm which version your tooling reports. Use the control families as a checklist structure: identity management, network security, data protection, logging and threat detection, posture and vulnerability management, and so on.

How to check or apply this

1. Decide the landing zone layout before creating workloads, even if it is only three subscriptions.
2. Assign roles to groups at the lowest practical scope and review them monthly.
3. Name an owner and a backup owner for the subscription.
4. Enable the free Foundational CSPM plan and review the first recommendations.
5. Turn on activity logging to a central place the workload teams cannot edit.
6. Write down the exceptions, such as a public storage endpoint, with a reason and a review date.
7. Scan application dependencies and container images before they deploy, because the posture checks look at cloud settings, not at the libraries inside your apps.

Quick check

Sources

• Microsoft Learn, Azure landing zones
• Microsoft Learn, Azure RBAC best practices
• Microsoft Learn, Cloud security posture management in Defender for Cloud
• Microsoft Learn, Microsoft cloud security benchmark

Last reviewed: 18 October 2026.