Azure is Microsoft’s cloud computing platform for building, hosting and managing applications, infrastructure and data services. It provides compute, storage, networking, identity, database and management capabilities across public cloud regions, with controls such as subscriptions, resource groups, role-based access control and policy enforcement.
What Azure is for
Azure is not a single product so much as a control plane for cloud resources. In practice, that means the term can refer to the platform where teams provision compute, storage, databases, networking and identity services, and to the administrative boundary where subscriptions, resource groups and policies determine who can create, change or expose those resources.
How Azure shapes architecture and operations
Because Azure sits across infrastructure, platform and management layers, it changes how organisations design ownership, segmentation and governance. A well-run Azure estate usually depends on clear subscription boundaries, consistent tagging, policy enforcement and role design so that environments remain separable even when workloads and teams move quickly.
That same breadth is why Azure often becomes the place where cloud architecture and access control meet. Cloud Security Guide is useful background for the shared-responsibility, identity, logging and posture decisions that shape a cloud platform like Azure.
Identity, privilege and secret handling in Azure
Azure is especially sensitive to identity and privilege because its administration model is heavily permission-driven. Azure RBAC, managed identities, service principals and vault-backed secrets all influence whether access is short-lived and scoped, or broadly reusable and difficult to audit. The platform is therefore only as safe as the least-privilege design around it.
That is also why credential and secret hygiene matter so much in Azure deployments. Cloud Workload Identity Guide covers the keyless patterns that reduce reliance on static keys, while Azure Key Vault Contributor escalation 2024 shows how excessive vault permissions can turn a supposed protection boundary into a secret-exposure path.
Governance, resilience and multi-cloud context
Azure is often chosen because it gives organisations enough standardisation to enforce guardrails without preventing scale. In mature environments, that means policy as a control layer, logging as a visibility layer and network segmentation as a resilience layer. Azure also sits inside broader multi-cloud and hybrid models, so the operational question is rarely only “can we deploy?” but “can we keep ownership, recovery and exit paths clear?”
For readers comparing cloud control models, the CSA Cloud Controls Matrix provides a cloud-specific control reference, and NIST Cybersecurity Framework 2.0 gives a broader way to think about govern, identify, protect, detect, respond and recover across the platform.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Azure is fundamentally governed through cloud IAM controls and role boundaries. |
| Recommendation — Map Azure access controls and role assignments to IAM requirements and review privileged entitlements regularly. | ||
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Azure is a core cloud platform whose boundaries, ownership and dependencies need governance context. |
| PR.AA-05 — Access Permissions and Authorizations are Managed | Azure relies on RBAC, subscriptions and policy-driven authorization. | |
| Recommendation — Define Azure ownership, scope and dependency boundaries in your governance model. Enforce least-privilege access and periodic entitlement review for Azure resources. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Azure administration depends on controlled account lifecycle and admin assignment. |
| AC-6 — Least Privilege | Azure control-plane and resource permissions should be minimized to reduce blast radius. | |
| Recommendation — Provision, review and revoke Azure administrative accounts with formal lifecycle control. Limit Azure roles and resource permissions to the minimum necessary for each function. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org