Securing Your Azure Data Platform: A Checklist

Why security can't be an afterthought

Data platforms are among the most valuable and sensitive assets in any organisation. They contain customer records, financial transactions, proprietary analytics and personally identifiable information. A security breach doesn't just mean regulatory fines — it means eroded trust, damaged reputation and lost business.

Yet too many teams treat security as something to add later — once the platform is working and the pressure to deliver features has eased. That 'later' rarely comes, and by the time security becomes a priority, retrofitting it is expensive, disruptive and incomplete.

This checklist covers the essential security controls every Azure data platform should have. It's not exhaustive, but it represents the non-negotiable foundations.

Identity and access management

• Use Managed Identities for all service-to-service authentication — never store credentials in code, configuration files or Key Vault secrets where a managed identity would suffice
• Implement least-privilege access — grant the minimum permissions required for each role, reviewed regularly through access reviews
• Enforce MFA for all human accounts with access to the platform, including developers, analysts and administrators
• Use Azure AD groups for role assignment rather than individual users — this simplifies management and ensures access is revoked promptly when people change roles
• Implement Privileged Identity Management (PIM) for administrative roles — just-in-time access reduces the attack surface from standing privileges

Network security

• Use private endpoints for all Azure services — Azure Data Factory, Databricks, Synapse, Storage — to ensure traffic never traverses the public internet
• Implement network segmentation — separate development, staging and production environments into different virtual networks with controlled connectivity
• Configure NSG rules to restrict inbound and outbound traffic to known sources and destinations
• Enable Azure Firewall or Databricks secure cluster connectivity to control egress traffic from compute clusters

Data protection

• Encrypt data at rest using customer-managed keys (CMK) in Azure Key Vault — this gives you control over key rotation and revocation
• Encrypt data in transit using TLS 1.2 or above for all connections
• Implement column-level encryption for highly sensitive data such as national insurance numbers or financial account details
• Enable dynamic data masking in Synapse or Databricks Unity Catalog to protect sensitive columns from unauthorised viewers
• Implement data retention policies — automatically archive or delete data that's no longer needed, reducing the scope of what you're protecting

Monitoring and threat detection

• Enable diagnostic logging for all Azure services — send logs to a central Log Analytics workspace for correlation and alerting
• Configure Azure Sentinel (Microsoft Defender for Cloud) for threat detection — it uses AI to identify suspicious activity across your Azure estate
• Set up alerting for anomalous access patterns — unusual query volumes, access from unfamiliar locations or bulk data exports
• Implement audit logging for all data access — who queried what, when and from where, retained for compliance purposes

Governance and compliance

• Implement Microsoft Purview for data governance and cataloguing — understand what data you have, where it lives and what sensitivity classifications apply
• Apply sensitivity labels to classify data by sensitivity level — public, internal, confidential, restricted
• Conduct regular security reviews — penetration testing, access reviews and configuration audits at least annually
• Document your security posture — maintain an up-to-date record of controls, responsibilities and compliance status for audit purposes

Security is not a one-time project — it's an ongoing discipline. Start with the foundations, review regularly and treat every new service or dataset as an opportunity to strengthen your posture.