Back to Details

azure-security

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Azure Security Skill

Azure Security 技能

This skill provides expert guidance for Azure Security. Covers best practices, decision making, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.
本技能为Azure Security提供专业指导，涵盖最佳实践、决策制定、安全防护、配置、集成与编码模式以及部署相关内容。它结合了本地快速参考内容与远程文档获取能力。

How to Use This Skill

如何使用本技能

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., 
L35-L120
), use 
read_file
with the specified lines. For categories with file links (e.g., 
[security.md](security.md)
), use 
read_file
on the linked reference file
IMPORTANT for Agent: If 
metadata.generated_at
is more than 3 months old, suggest the user pull the latest version from the repository. If 
mcp_microsoftdocs
tools are not available, suggest the user install it: Installation Guide
This skill requires network access to fetch documentation content:
  • Preferred: Use 
    mcp_microsoftdocs:microsoft_docs_fetch
    with query string 
    from=learn-agent-skill
    . Returns Markdown.
  • Fallback: Use 
    fetch_webpage
    with query string 
    from=learn-agent-skill&accept=text/markdown
    . Returns Markdown.
Agent 重要提示：使用下方的分类索引定位相关章节。对于带有行范围的分类（例如：
L35-L120
），使用
read_file
工具读取指定行内容。对于带有文件链接的分类（例如：
[security.md](security.md)
），使用
read_file
工具读取链接的参考文件
Agent 重要提示：如果
metadata.generated_at
距今超过3个月，建议用户从仓库拉取最新版本。如果
mcp_microsoftdocs
工具不可用，建议用户安装该工具：安装指南
本技能需要网络访问权限来获取文档内容：
  • 首选方式：使用
    mcp_microsoftdocs:microsoft_docs_fetch
    工具，查询字符串为
    from=learn-agent-skill
    ，返回Markdown格式内容。
  • 备用方式：使用
    fetch_webpage
    工具，查询字符串为
    from=learn-agent-skill&accept=text/markdown
    ，返回Markdown格式内容。

Category Index

分类索引

CategoryLinesDescription
Best PracticesL34-L58End-to-end Azure security guidance: hardening IaaS/PaaS, identity and access, network and operational security, backups and ransomware resilience, secrets management, and service-specific checklists.
Decision MakingL59-L64Guidance on choosing Azure security options, including comparing security features in US Gov clouds and selecting appropriate key management (Key Vault, managed keys, BYOK).
SecurityL65-L97Platform-level and workload security: threat modeling mitigations, AKS image validation, crypto/authz/session hardening, Azure infra/network/SQL security, keys, Lockbox, Secure/Measured Boot, and integrity monitoring.
ConfigurationL98-L108Configuring Azure security features: antimalware, container scanning (Dependabot/Copacetic), firewall rules, CMK encryption, logging/auditing, TLS changes, ransomware protections, and Customer Lockbox alerts.
Integrations & Coding PatternsL109-L114Guides for generating signed SBOMs for container images and scripting Microsoft Antimalware configuration in Azure using PowerShell.
DeploymentL115-L120Guides for signing and verifying container images with Notation in Azure Pipelines/GitHub Actions, plus comparing security feature availability in Azure vs Azure Government.
分类行范围描述
最佳实践L34-L58端到端Azure安全指导：加固IaaS/PaaS、身份与访问管理、网络与运维安全、备份与勒索软件韧性、密钥管理、以及服务特定检查清单。
决策制定L59-L64Azure安全选项选择指导，包括对比美国政府云的安全功能、选择合适的密钥管理方案（Key Vault、托管密钥、BYOK）。
安全防护L65-L97平台级与工作负载安全：威胁建模缓解措施、AKS镜像验证、加密/授权/会话加固、Azure基础架构/网络/SQL安全、密钥管理、Lockbox、Secure/Measured Boot、以及完整性监控。
配置L98-L108Azure安全功能配置：反恶意软件、容器扫描（Dependabot/Copacetic）、防火墙规则、CMK加密、日志/审计、TLS变更、勒索软件防护、以及Customer Lockbox告警。
集成与编码模式L109-L114为容器镜像生成签名SBOM的指南，以及使用PowerShell在Azure中配置Microsoft Antimalware的脚本指导。
部署L115-L120在Azure Pipelines/GitHub Actions中使用Notation签名和验证容器镜像的指南，以及对比Azure与Azure Government的安全功能可用性。

Best Practices

最佳实践

TopicURL
Harden Azure Marketplace images before publishinghttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-marketplace-images
Design Azure backup and restore plans against ransomwarehttps://learn.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware
Implement Azure security best practices and patternshttps://learn.microsoft.com/en-us/azure/security/fundamentals/best-practices-and-patterns
Apply Azure data security and encryption best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices
Use Azure SQL database security checklisthttps://learn.microsoft.com/en-us/azure/security/fundamentals/database-security-checklist
Secure Azure IaaS workloads and virtual machineshttps://learn.microsoft.com/en-us/azure/security/fundamentals/iaas
Apply Azure identity and access control best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
Implement incident response processes for Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/incident-response-overview
Apply Azure network security best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
Apply Azure operational security best practiceshttps://learn.microsoft.com/en-us/azure/security/fundamentals/operational-best-practices
Secure Azure App Service PaaS applicationshttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-app-services
Secure PaaS databases with Azure SQL and Synapsehttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-sql
Secure PaaS applications using Azure Storagehttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-storage
Design and operate secure Azure PaaS deploymentshttps://learn.microsoft.com/en-us/azure/security/fundamentals/paas-deployments
Detect and respond to ransomware in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-detect-respond
Prepare Azure environments for ransomware resiliencehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-prepare
Harden Azure Firewall Premium for ransomware defensehttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-protection-with-azure-firewall
Protect and manage secrets in Azure workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/secrets-best-practices
Harden Azure Service Fabric clusters and securityhttps://learn.microsoft.com/en-us/azure/security/fundamentals/service-fabric-best-practices
Implement Microsoft Entra identity security checklisthttps://learn.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity
Prevent Azure subdomain takeover via DNS hygienehttps://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
主题URL
发布前加固Azure Marketplace镜像https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-marketplace-images
设计抵御勒索软件的Azure备份与恢复计划https://learn.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware
实施Azure安全最佳实践与模式https://learn.microsoft.com/en-us/azure/security/fundamentals/best-practices-and-patterns
应用Azure数据安全与加密最佳实践https://learn.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices
使用Azure SQL数据库安全检查清单https://learn.microsoft.com/en-us/azure/security/fundamentals/database-security-checklist
保护Azure IaaS工作负载与虚拟机https://learn.microsoft.com/en-us/azure/security/fundamentals/iaas
应用Azure身份与访问控制最佳实践https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
实施Azure事件响应流程https://learn.microsoft.com/en-us/azure/security/fundamentals/incident-response-overview
应用Azure网络安全最佳实践https://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
应用Azure运维安全最佳实践https://learn.microsoft.com/en-us/azure/security/fundamentals/operational-best-practices
保护Azure App Service PaaS应用https://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-app-services
使用Azure SQL和Synapse保护PaaS数据库https://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-sql
使用Azure Storage保护PaaS应用https://learn.microsoft.com/en-us/azure/security/fundamentals/paas-applications-using-storage
设计并运行安全的Azure PaaS部署https://learn.microsoft.com/en-us/azure/security/fundamentals/paas-deployments
在Azure中检测并响应勒索软件https://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-detect-respond
为Azure环境准备勒索软件韧性https://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-prepare
加固Azure Firewall Premium以防御勒索软件https://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-protection-with-azure-firewall
在Azure工作负载中保护并管理密钥https://learn.microsoft.com/en-us/azure/security/fundamentals/secrets-best-practices
加固Azure Service Fabric集群与安全https://learn.microsoft.com/en-us/azure/security/fundamentals/service-fabric-best-practices
实施Microsoft Entra身份安全检查清单https://learn.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity
通过DNS防护防止Azure子域名接管https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover

Decision Making

决策制定

TopicURL
Compare security feature availability in US Government cloudshttps://learn.microsoft.com/en-us/azure/security/fundamentals/feature-availability
Choose the right Azure key management solutionhttps://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose
主题URL
对比美国政府云的安全功能可用性https://learn.microsoft.com/en-us/azure/security/fundamentals/feature-availability
选择合适的Azure密钥管理解决方案https://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose

Security

安全防护

TopicURL
Enforce AKS image signature validation with Ratify and Azure Policyhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks
Implement auditing and logging mitigations with Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-auditing-and-logging
Implement authentication mitigations with Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authentication
Mitigate authorization threats in Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authorization
Secure communications based on Threat Modeling Tool findingshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-communication-security
Harden configuration management using Threat Modeling Tool mitigationshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-configuration-management
Implement cryptography mitigations from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-cryptography
Secure exception management using Threat Modeling Tool guidancehttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-exception-management
Apply secure input validation mitigations from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-input-validation
Protect sensitive data using Threat Modeling Tool mitigationshttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-sensitive-data
Implement secure session management from Threat Modeling Toolhttps://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-session-management
Apply Azure-specific security best practices for AI workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/ai-security-best-practices
Use Azure Certificate Authority roots and requirementshttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-certificate-authority-details
Enforce platform code integrity in Azure productionhttps://learn.microsoft.com/en-us/azure/security/fundamentals/code-integrity
Understand and configure Azure Customer Lockbox accesshttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-faq
Control Microsoft engineer data access with Customer Lockboxhttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-overview
Identify Azure services supporting customer-managed keyshttps://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-customer-managed-keys-support
Secure Azure hardware, firmware, and supply chainhttps://learn.microsoft.com/en-us/azure/security/fundamentals/firmware
Maintain Azure infrastructure integrity and security controlshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-integrity
Monitor Azure infrastructure for security and vulnerabilitieshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-monitoring
Manage and operate the Azure production network securelyhttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-operations
Understand Azure SQL Database security capabilitieshttps://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-sql
Apply firmware measured boot and host attestation in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/measured-boot-host-attestation
Apply Azure operational security checklist controlshttps://learn.microsoft.com/en-us/azure/security/fundamentals/operational-checklist
Follow Azure penetration testing rules and scopehttps://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
Verify Azure platform integrity and secure host lifecyclehttps://learn.microsoft.com/en-us/azure/security/fundamentals/platform
Secure access to the Azure production networkhttps://learn.microsoft.com/en-us/azure/security/fundamentals/production-network
Control and audit access to customer data in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/protection-customer-data
Use Secure Boot to protect Azure virtual machineshttps://learn.microsoft.com/en-us/azure/security/fundamentals/secure-boot
主题URL
使用Ratify和Azure Policy强制AKS镜像签名验证https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks
使用威胁建模工具实施审计与日志缓解措施https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-auditing-and-logging
使用威胁建模工具实施身份验证缓解措施https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authentication
在威胁建模工具中缓解授权威胁https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-authorization
根据威胁建模工具结果保护通信安全https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-communication-security
使用威胁建模工具缓解措施加固配置管理https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-configuration-management
实施威胁建模工具中的加密缓解措施https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-cryptography
使用威胁建模工具指导保护异常管理https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-exception-management
应用威胁建模工具中的安全输入验证缓解措施https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-input-validation
使用威胁建模工具缓解措施保护敏感数据https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-sensitive-data
实施威胁建模工具中的安全会话管理https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-session-management
为AI工作负载应用Azure特定安全最佳实践https://learn.microsoft.com/en-us/azure/security/fundamentals/ai-security-best-practices
使用Azure证书颁发机构根证书与要求https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-certificate-authority-details
在Azure生产环境中强制平台代码完整性https://learn.microsoft.com/en-us/azure/security/fundamentals/code-integrity
了解并配置Azure Customer Lockbox访问https://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-faq
使用Customer Lockbox控制微软工程师的数据访问https://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-overview
识别支持客户管理密钥的Azure服务https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-customer-managed-keys-support
保护Azure硬件、固件与供应链https://learn.microsoft.com/en-us/azure/security/fundamentals/firmware
维护Azure基础架构完整性与安全控制https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-integrity
监控Azure基础架构的安全与漏洞https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-monitoring
安全管理与运行Azure生产网络https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-operations
了解Azure SQL数据库安全能力https://learn.microsoft.com/en-us/azure/security/fundamentals/infrastructure-sql
在Azure中应用固件测量启动与主机证明https://learn.microsoft.com/en-us/azure/security/fundamentals/measured-boot-host-attestation
应用Azure运维安全检查清单控制https://learn.microsoft.com/en-us/azure/security/fundamentals/operational-checklist
遵循Azure渗透测试规则与范围https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing
验证Azure平台完整性与安全主机生命周期https://learn.microsoft.com/en-us/azure/security/fundamentals/platform
保护Azure生产网络的访问安全https://learn.microsoft.com/en-us/azure/security/fundamentals/production-network
控制并审计Azure中客户数据的访问https://learn.microsoft.com/en-us/azure/security/fundamentals/protection-customer-data
使用Secure Boot保护Azure虚拟机https://learn.microsoft.com/en-us/azure/security/fundamentals/secure-boot

Configuration

配置

TopicURL
Configure Dependabot and Copacetic for container securityhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/container-secure-supply-chain-implementation/cssc-depenadabot-quickstart
Configure Microsoft Antimalware for Azure workloadshttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware
Plan firewall rules using Azure domain patternshttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-domains
Configure alternate email notifications for Customer Lockboxhttps://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-alternative-email
Configure Azure security logging and auditinghttps://learn.microsoft.com/en-us/azure/security/fundamentals/log-audit
Adapt to Azure managed TLS feature changeshttps://learn.microsoft.com/en-us/azure/security/fundamentals/managed-tls-changes
Configure Azure-native features for ransomware protectionhttps://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-features-resources
主题URL
配置Dependabot和Copacetic以实现容器安全https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/container-secure-supply-chain-implementation/cssc-depenadabot-quickstart
为Azure工作负载配置Microsoft Antimalwarehttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware
使用Azure域模式规划防火墙规则https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-domains
为Customer Lockbox配置备用邮件通知https://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-alternative-email
配置Azure安全日志与审计https://learn.microsoft.com/en-us/azure/security/fundamentals/log-audit
适配Azure托管TLS功能变更https://learn.microsoft.com/en-us/azure/security/fundamentals/managed-tls-changes
配置Azure原生功能以实现勒索软件防护https://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-features-resources

Integrations & Coding Patterns

集成与编码模式

TopicURL
Create and attach signed SBOMs to container imageshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/attach-sbom
Use PowerShell to configure Microsoft Antimalware in Azurehttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples
主题URL
创建并为容器镜像附加签名SBOMhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/attach-sbom
使用PowerShell在Azure中配置Microsoft Antimalwarehttps://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware-code-samples

Deployment

部署

TopicURL
Sign and verify container images in Azure Pipelines with Notationhttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign
Sign container images with Notation in GitHub Actionshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha
Verify container image signatures with Notation in GitHub Actionshttps://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha
主题URL
在Azure Pipelines中使用Notation签名和验证容器镜像https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign
在GitHub Actions中使用Notation签名容器镜像https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha
在GitHub Actions中使用Notation验证容器镜像签名https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha