Why zero trust on Azure is different
Azure rewards a clear edge. Front Door for global ingress, API Management as the policy layer, and a strict vnet boundary that everything sensitive lives inside. Public service endpoints are off by default.
The interesting design choice is not the controls, it is the identity model. Entra ID issues tokens for users and workloads alike. Conditional access decides whether a token can be minted in the first place, based on device, location, risk score, and group.
Reference pattern
Requests hit Front Door (WAF + DDoS), proxy to APIM in the home region. APIM enforces rate limits, JWT validation against Entra ID, request schema validation, and IP allowlisting for partner traffic.
APIM is integrated to a private vnet, so backends are not exposed. App Service, Functions, SQL, Storage, and Key Vault are all bound to private endpoints. Outbound DNS resolves to private IPs.
Identity and access
Users authenticate to Entra ID. Conditional access requires managed device, sign in risk low, and group membership matching the API. For privileged operations we use PIM with just in time elevation and approval.
- workload identity federation for github actions (no secrets)
- managed identities for app service and functions
- customer managed keys in key vault, rotated quarterly
- defender for cloud running posture + workload protection
- private dns zones linked to vnet for endpoint resolution
Telemetry
Every layer ships to Log Analytics. We route a subset to Sentinel for detection and Cost Management for budget alerts. The hot path for detection is sign in logs, APIM gateway logs, and Defender alerts.
References
Official documentation and standards we draw on for this pattern.
Microsoft Zero Trust guidance
learn.microsoft.com
Microsoft Cybersecurity Reference Architectures
learn.microsoft.com
Entra ID Conditional Access
learn.microsoft.com
API Management policy reference
learn.microsoft.com
Azure Private Link overview
learn.microsoft.com
NIST SP 800-207 Zero Trust Architecture
csrc.nist.gov
Links open in a new tab
Takeaway
Zero trust on Azure is not a product, it is the combination of identity, network, and policy moving in step. Get the three to agree and the rest follows.