Key Settings One-Pager
The essential goal, the features that carry it, the mistake to avoid, and the proof to keep — for each of the ten Brilliant at the Basics requirements. A quick reference to pin up, not a substitute for the full step-by-step guide. Confirm every setting against Azure Government’s own documentation.
Azure Government, paired with GCC High identity, is a purpose-built home for CUI: FedRAMP High and DoD Impact Level 4/5, with data kept in the U.S. and screened U.S.-person operations.
Phishing-Resistant Multi-Factor Authentication
Make a stolen password useless on its own.
Always exclude at least one emergency break-glass account from the policy so a misconfiguration never locks every admin out.
Screenshot of the Conditional Access policy showing Phishing-resistant MFA strength · Authentication methods registration report · Sign-in logs showing MFA method used
Least-Privilege Access Control
Give each person only the access their job needs — and no more.
Avoid assigning roles to individual people; assign to Entra groups instead so access is easy to review and revoke.
Export of role assignments per subscription · PIM eligible-assignment and activation history report · List of custom role definitions
Asset & Account Inventory
Keep a live list of every device, identity, and app you defend.
Tag every resource with an owner and data type when you create it, so your inventory stays meaningful instead of a wall of names.
Dated Azure Resource Graph export of all resources · Defender for Cloud inventory export · Entra All devices and All users lists
Logging, Monitoring & Audit
Record important events and watch for trouble.
Do not forget to log the identity system itself; Entra ID sign-in and audit logs are the most valuable trail an investigator will ask for.
Diagnostic settings configuration for key resources · Sentinel data-connector and analytics-rule list · Log retention setting screenshot
Network Segmentation & Boundary Protection
Keep one compromised thing from reaching everything else.
Start every NSG from a deny-all mindset and open only what you can justify, rather than allowing broad ranges you plan to tighten later.
Network diagram of hub-spoke VNets · Exported NSG and Azure Firewall rule sets · List of private endpoints protecting data services
Vulnerability & Patch Management
Find weak spots and fix the risky ones first.
Do not just patch Azure virtual machines; connect on-premises servers with Azure Arc so Update Manager and Defender cover them too.
Defender for Cloud vulnerability assessment report · Azure Update Manager compliance/patch history · Record of remediation timelines
Data Protection & Encryption
Scramble sensitive data so only the right people can read it.
Turn on soft-delete and purge protection for Key Vault first; losing a key with no recovery can lock you out of your own encrypted data forever.
Key Vault configuration showing purge protection and rotation policy · Storage/disk settings showing customer-managed key encryption · Proof TLS 1.2+ is enforced
Backup & Recovery
Be able to restore your data after an attack or outage.
A backup you have never restored is only a hope; schedule regular restore tests so you know recovery truly works before a real emergency.
Backup policy showing frequency and retention · Recovery Services vault redundancy and immutability settings · Successful test-restore report
Secure Configuration Baseline
Start every service from a known-good, hardened setting.
Use Deny policies for your most critical rules, not just Audit, so risky resources are blocked at creation instead of found later.
Defender for Cloud secure score over time · Regulatory compliance dashboard export for NIST 800-171 / CMMC · Azure Policy assignments and compliance results
Secure AI Adoption & Data Loss Prevention
Use AI and share files without leaking sensitive information.
Turn off or approve-only the abuse-monitoring human review for Azure OpenAI when handling CUI, and never let staff use commercial public AI chatbots for controlled data.
Azure OpenAI deployment showing US Gov region and private networking · Purview DLP policy definitions and match reports · DSPM for AI activity showing sensitive-data interactions