An Azure subscription is a logical container for provisioned resources such as virtual machines, databases, AKS clusters, and storage accounts. It also forms a useful management and security boundary: operations on resources, service health, and application changes can be examined in subscription-scoped services and logs. section 9.1.2 section 9.1
For security operations, treat each subscription as a scope that must be onboarded, governed, and monitored. Microsoft Defender for Cloud is enabled at the subscription level; organizing subscriptions under management groups can make Defender deployment and management easier at scale. section 6.2.1 section 6.2.1
A subscription-level Defender for Cloud setup includes these steps:
- Ensure the operator has the Contributor or Owner role on the subscription before registering the security resource provider. section 6.2.1
- Register the Microsoft.Security provider to onboard the subscription to Microsoft Defender for Cloud. section 6.2.1
- Assign the Microsoft Cloud Security Benchmark (MCSB) policy initiative so Defender for Cloud can provide security recommendations. section 6.2.1
- Use least-privileged Defender roles where appropriate: Security Reader can view recommendations and alerts, while Security Admin supports daily operational tasks. section 6.2.1
az provider register --namespace 'Microsoft.Security' #1
Register the Microsoft.Security resource provider from Azure Cloud Shell to onboard the current subscription to Microsoft Defender for Cloud. section 6.2.1
Subscription activity is also an audit boundary. The Azure activity log records Azure Resource Manager operations on resources and can answer who performed an action, what they did, when they did it, and which resource was affected. Activity-log events are deleted after 90 days unless diagnostic settings stream them elsewhere. section 9.1.2 section 9.1.2
Investigating a deleted production VM
If a production VM is deleted, open the subscription’s Azure activity log and locate the delete operation tracked by Azure Resource Manager. Use the recorded operation details to determine who deleted the VM, when it occurred, and the affected resource. For longer investigations or compliance retention, configure diagnostic settings to send activity-log events to another location before the 90-day deletion window. section 9.1.2 section 9.1.2
Subscription-level visibility complements resource and application monitoring. Azure Service Health provides information about Azure service health within a subscription, and Azure Change Analysis provides insights into Azure application changes. section 9.1.2 section 9.1.2
