Security Considerations and Best Practices for Azure Resource Manager

This post comes from George Moore, Principal Program Manager Lead, Azure Compute.

When working with Azure Resource Manager (ARM) and ARM templates for deploying IaaS resources, you want to make sure to bake in enterprise-grade security by considering security best practices. Key security issues to consider when using ARM templates include options and best practices centering around:

This is where Security Considerations for Azure Resource Manager can help you.

In this white paper, you’ll learn:

  • How Azure Key Vault can help protect your keys and secrets
  • Why compartmentalizing templates helps division of responsibility to enhance security
  • How to use a combination of service principals and RBAC for cross-subscription interactions
  • What to consider when configuring network access controls using Network Security Groups
  • When to use custom routes and IP forwarding to support virtualized network appliances

This article is a part of a broader series entitled Best practices for designing Azure Resource Manager templates which covers deployment topologies with t-shirt sizing for different workload demands, RBAC, tagging, etc.  Other documents in this series cover more advanced scenarios:

We hope you enjoy Security Considerations for Azure Resource Manager and find it useful in your planning, design and implementation phases.

George Moore
Principal Program Manager Lead, Azure Compute


Thanks George! We’re looking forward to hearing about more great things from you and your team!

I (Tom Shinder) also want to let you know that I’m back in the security community again, after taking off from a 15 year stint in security and then changing focus to work on private cloud and then hybrid cloud architecture. In the coming months you’ll see more posts in the Azure Security Blog about Azure and cloud security. We have a heady lineup in store and we’re looking forward to getting the information you want out to you. If there are any topics in Azure and cloud security that you’re particularly interested in, let me know and we’ll make sure we get those on the list. Just click on my name below.


Tom Shinder
Program Manager, Azure Security Engineering

Comments (1)

  1. Firstly thank you so much for this article, in my opinion the idea of channel 9 will be very useful in this matter, also Virtual academy we need to be more effective in this matter.

    Thanks in advance,

    Mahmoud Hanafi.

Skip to main content