Loading johnnynguyen.cloud portal
Microsoft Azure · initializing blades

Security

Defender-style preview

A mock Microsoft Defender / Azure security blade for the portfolio itself: what is protected, what is planned, and what the project proves.

secureScore 78 /100

Mock score, but the story behind it is real: privacy-by-default content sync now, backend guardrails before the AI goes live.

Identity and access

In progress

Entra ID, RBAC, least privilege, and AZ-104 identity objectives are active study areas.

Data protection

Configured

Public-safe content allowlist, phone-number scrub requirement, and explicit vault denylist.

Application security

Planned

Phase 3 keeps Azure OpenAI secrets server-side in Azure Functions, then moves toward managed identity.

Monitoring

Planned

Future Cloudflare Web Analytics or Azure-native telemetry with no invasive tracking.

Recommendations

  • Enable multi-factor authentication on the account that owns this subscription.
  • Store backend secrets in Azure Key Vault and reach them with a managed identity.
  • Add rate limiting and input validation to the chatbot Function before it goes public.
  • Turn on Microsoft Defender for Cloud and work the secure-score findings.

Security lab backlog 6 labs

Microsoft Sentinel SIEM

Planned

Ingest Entra sign-in logs, write KQL detections for impossible-travel and MFA fatigue, and surface them on a workbook.

Conditional Access gauntlet

Planned

Stand up a set of CA policies, then try to break in from a non-compliant device to prove each one actually blocks.

Entra PIM + access reviews

Planned

Move admin roles to just-in-time activation and run access reviews to show least privilege holding over time.

Defender for Cloud secure score

In progress

Deploy a deliberately misconfigured workload, then remediate the findings and track the secure score climbing.

Key Vault + managed identity

Planned

Pull every secret out of app config into Key Vault, authenticate with managed identity, and rotate keys with zero downtime.

Honeypot VM + alerting

Planned

Expose a decoy box from the VM blade and wire an alert that fires on first unauthorized touch. Ties the labs together.