Skip to main content
Network security controls are the foundational measures used to protect enterprise and cloud networks. This guide explains the essential controls, how they fit together into a layered defense, and how Microsoft Defender for Cloud and the Microsoft Cloud Security Benchmark (MCSB) use these controls and service baselines to produce prioritized security recommendations for on‑premises, cloud, and hybrid deployments. Core objectives:
  • Reduce the attack surface
  • Contain lateral movement
  • Protect workloads (VMs, PaaS services, containers)
  • Enforce consistent, auditable configurations
Key network security controls
ControlPurposeExample / Implementation
Network segmentationReduce attack surface and contain lateral movementUse subnets, VLANs, NSGs, and Azure Firewall to separate zones (web, app, DB)
Cloud network controlsEnforce least privilege connectivity and secure access to cloud resourcesNetwork Security Groups (NSGs), Azure Firewall, Private Endpoints
Edge firewallsFilter and inspect inbound/outbound traffic at network boundariesPerimeter firewall clusters (stateful inspection, application rules)
IDS/IPSDetect and (optionally) block suspicious trafficDeploy IDS/IPS appliances or hosted services to alert and block threats
DDoS defensesProtect against volumetric and application-layer attacksUse cloud DDoS protection plans and rate limiting
Web Application Firewall (WAF)Block common web exploits and protect application layerWAF in front of web apps and API gateways to stop SQLi, XSS, etc.
Policy and toolingStandardize configurations and enable automated enforcementAzure Policy, security automation, and centralized logging
Vulnerability hygieneRemove or patch unnecessary services; reduce attack vectorsVulnerability scanning, patching cadence, and hardening baselines
Private connectivityProtect sensitive traffic and avoid the public internetExpressRoute, VPN, and encrypted tunnels for private peering and transit
A slide titled "Network Security Controls" listing nine items (NS-1 to NS-9). It outlines recommended measures like network segmentation, cloud security controls, firewalls/IDS/IPS, DDoS and web application protection, and private network connections.
When you enable Microsoft Defender for Cloud, Defender for Cloud continuously evaluates these network and platform controls across subscriptions and workloads. It produces prioritised compliance and security recommendations, helping you find gaps and plan remediation in order of business impact.
Microsoft Defender for Cloud maps network and platform controls to built-in security recommendations, simplifying continuous compliance monitoring and remediation planning.
Microsoft Cloud Security Benchmark (MCSB) Next, consider the Microsoft Cloud Security Benchmark (MCSB). MCSB defines a set of high-impact security controls intended to help you secure cloud services consistently across single- and multi-cloud environments. It sets expectations for what to protect, who should be involved, and how to prioritize security work.
A presentation slide titled "Microsoft Cloud Security Benchmark" showing a large shield icon alongside several cloud icons. The slide text explains that MCSB provides high-impact security recommendations for securing cloud services in single and multi-cloud environments.
MCSB organizes guidance into security controls — broad, high-level requirements that apply across workloads — and describes stakeholders and the general objective for each control.
A slide titled "Microsoft Cloud Security Benchmark – Security Controls" showing two panels: "Definition" with checklist icons and a note about security recommendations for cloud workloads, and "Purpose" with three gradient bars labeled Planning, Approval, and Implementation plus a caption about stakeholders. The slide includes a small "© Copyright KodeKloud" at the bottom.
Service baselines Service baselines translate an MCSB control into concrete, actionable configuration guidance for a specific cloud service. In other words:
  • Control = the high-level requirement (for example, Data Protection).
  • Baseline = the exact configuration checks and settings for a service (for example, Azure SQL Security Baseline).
Service baselines make it possible to consistently assess and automate compliance checks for each cloud service you use.
A presentation slide titled "Microsoft Cloud Security Benchmark – Service Baselines" showing a shield with slider controls and several cloud icons. The accompanying text explains that service baselines apply security controls to individual cloud services to guide secure configuration.
To summarize the relationship:
  • Control: A high-level security requirement (what to protect).
  • Baseline: The service-specific implementation and checks that satisfy the control (how to configure).
A slide titled "Microsoft Cloud Security Benchmark" showing a three-column table with headings Term, Description, and Example. It defines rows for "Control" and "Baseline" with brief explanations and examples like Data Protection and Azure SQL Security Baseline.
Why this matters for Defender for Cloud Microsoft Defender for Cloud evaluates your subscriptions against MCSB controls and service baselines, then surfaces prioritized recommendations that map to those baselines. Understanding the control → baseline relationship helps you:
  • Interpret recommendations in a business context
  • Identify responsible stakeholders for remediation
  • Implement consistent, repeatable configurations across services
Links and references
Start by mapping high-impact MCSB controls to your most critical services (e.g., databases, web apps, identity systems). Then use Defender for Cloud recommendations and service baselines to implement and automate those controls.

Watch Video