1. Azure Monitor #
Metrics, logs and alerts.
Principles #
// KQL : erreurs HTTP par heure (Application Insights)
requests
| where timestamp > ago(24h) and success == false
| summarize erreurs = count() by bin(timestamp, 1h), resultCode
| order by timestamp descaz monitor diagnostic-settings create --name vers-law --resource <id-ressource> \
--workspace <id-log-analytics> --logs '[{"categoryGroup":"allLogs","enabled":true}]' --metrics '[{"category":"AllMetrics","enabled":true}]'
az monitor metrics alert create -g rg-app -n cpu-eleve --scopes <id-vm> --condition "avg Percentage CPU > 80" --action <id-groupe-actions>2. Security #
Defender, Key Vault, activity logs.
Services #
| Service | Role |
|---|---|
| Microsoft Defender for Cloud | Security posture (score), recommendations, workload protection (servers, containers, databases) |
| Key Vault | Secrets, keys and certificates; access through managed identity and RBAC |
| Activity log | Who did what at the control plane level (90 days, to be exported) |
| Microsoft Sentinel | SIEM and SOAR on Log Analytics |
Key Vault #
az keyvault create -g rg-sec -n kv-app-123 --enable-rbac-authorization true
az keyvault secret set --vault-name kv-app-123 -n db-password --value '<secret>'
az role assignment create --assignee <id-identité-managée> --role "Key Vault Secrets User" --scope <id-key-vault>3. Backup and recovery #
Backup and Site Recovery.
Services #
- Azure Backup: Recovery Services or Backup vaults, retention policies, immutability and soft delete.
- Site Recovery: VM replication to another region for disaster recovery.
- Service Health and Advisor: Azure incidents affecting you and recommendations (costs, security, reliability).
Good practice: Export the activity log to Log Analytics: its default retention is only 90 days.
