Skip to main content
Network security controls are the measures and configurations you implement to protect cloud and on‑premises networks. This lesson explains the essential controls, why they matter, and how they map to cloud security guidance and tooling so you can design a layered, auditable defense. The core controls
  • Establish network segmentation boundaries — divide your network into smaller segments (subnets, VNets, virtual networks, or security zones) to limit lateral movement and contain incidents.
  • Secure cloud services with network controls — use access restrictions, Network Security Groups (NSGs) or ACLs, private endpoints, and service-level controls to reduce exposure and restrict who can reach resources.
  • Deploy perimeter and internal firewalls — inspect and filter traffic at the edge and between segments; enforce consistent policy across zones.
  • Use IDS and IPS — intrusion detection systems (IDS) identify suspicious activity; intrusion prevention systems (IPS) can block or mitigate malicious traffic before workloads are impacted.
  • Defend against large-scale availability attacks — use DDoS protection services to absorb or mitigate volumetric attacks that aim to overwhelm your applications.
  • Deploy a Web Application Firewall (WAF) — place a WAF in front of web-facing applications to block application-layer threats like SQL injection and cross-site scripting.
  • Use policy and guardrails — implement built-in security policies, role-based access control (RBAC), and automation to apply controls consistently across subscriptions and tenants.
  • Continuously discover and remediate — perform regular scans and inventory to find weak, misconfigured, or out-of-date services and either remediate or decommission them.
  • Use secure private connectivity — when handling sensitive traffic, prefer Private Link, ExpressRoute, or dedicated circuits; use VPNs for encrypted transit when private circuits are unavailable.
These controls together form a layered defense for on‑premises, cloud, and hybrid environments.
The image lists nine network security controls, including establishing network segmentation, securing cloud services, deploying firewalls, intrusion detection, DDOS protection, and connecting networks privately.
Mapping controls to common Azure services These mappings help you choose the right Azure features when implementing each control. These controls are not just best practices — they are the elements that Microsoft Defender for Cloud evaluates to produce security and compliance recommendations and reports.
Microsoft Defender for Cloud assesses these network controls and provides prioritized recommendations, continuous posture monitoring, and compliance insights.
The Microsoft Cloud Security Benchmark (MCSB) is a curated set of high‑impact, actionable security recommendations designed to secure cloud environments consistently across services and teams.
The image features a graphic illustrating a shield with clouds, symbolizing cloud security, alongside text describing the Microsoft Cloud Security Benchmark (MCSB) as providing security recommendations for cloud services.
How the MCSB organizes guidance The MCSB groups security guidance into controls — these are service‑agnostic, high‑level recommendations describing what to protect and which teams should be involved. Controls help you plan, approve, and coordinate security improvements across teams and workloads.
The image outlines the Microsoft Cloud Security Benchmark's security controls, emphasizing their definition and purpose with a focus on planning, approval, and implementation processes.
Service baselines: turning controls into actionable configurations Service baselines take an MCSB control and specify how it should be implemented for a particular Azure service. A baseline lists concrete configurations, settings, and practices you must apply to meet the control for that service — providing auditable, repeatable guidance.
The image illustrates "Microsoft Cloud Security Benchmark – Service Baselines" with an icon of a shield and cloud representations, accompanied by a brief description of service baselines.
Summary and practical guidance
  • Control = high-level security requirement (for example, protect data-in-transit).
  • Baseline = specific implementation for a given service (for example, Azure SQL baseline listing network and configuration requirements).
Understanding this distinction helps you translate organizational security objectives into service-level configurations and compliance checks. Use Defender for Cloud and the MCSB as tools to continuously measure, prioritize, and enforce these controls across subscriptions and workloads. Microsoft Defender for Cloud uses controls and baselines to generate recommendations and compliance reports that help you track remediation progress and demonstrate improved security posture. For more details, see the Defender for Cloud documentation and the Microsoft Cloud Security Benchmark.

Watch Video