--- title: "Azure Blue Team Learning Path - Cybr" description: "Azure Blue Team learning path at Cybr with Hands-On Labs in real Microsoft Azure environments. Learn how to investigate, assess, and harden Azure environments." url: https://cybr.com/learning-path/azure-blue-team-learning-path/ --- # Azure Blue Team Learning Path - Azure - Blue Team 13 hands-on labs ## Path Overview Learn to defend Microsoft Azure environments with our defensive-focused blue team learning path. Every step is a hands-on lab in a real Azure environment. Start with the Azure portal and CLI, then investigate unauthorized changes in the Activity Log and API access in Application Insights, assess Blob Storage exposure with Prowler, and harden identity with Microsoft Entra and managed identities. Finish by deploying and securing Azure infrastructure as code with Bicep, Terraform, private endpoints, and Checkov. ## What You’ll Learn - Azure Fundamentals: tenants, subscriptions, resource groups, and roles - Azure Management Roles vs. Data Roles - Least Privilege with Azure RBAC - Investigations with the Azure Activity Log - Detection with Application Insights, KQL, and Azure Monitor Alerts - Security Assessments with Prowler - Microsoft Entra Authentication and Managed Identities - Private Networking with Private Endpoints - Infrastructure as Code Security with Bicep, Terraform, and Checkov ## Prerequisites - Basic security concepts (authentication, authorization, encryption, etc…) - Comfort running commands in a terminal No prior Azure experience is needed. The path starts with your first day inside the Azure portal. ## Content 13 items 1. ### Your First Day Inside the Azure Portal Hands-On Lab Your first day on the job as a Junior Cloud Analyst, you've been handed an Azure account and access to two resource groups without a whole lot of onboarding. Find your bearings, do the work, and figure out your permissions. View Content [Your First Day Inside the Azure Portal](https://cybr.com/hands-on-labs/lab/your-first-day-inside-the-azure-portal/) 2. ### Getting Started with the Azure CLI Hands-On Lab Learn the Azure CLI by investigating a missing update for a progress site. The deployment note did not reach the team, so nobody knows where the release evidence is stored or whether the update is ready to publish. View Content [Getting Started with the Azure CLI](https://cybr.com/hands-on-labs/lab/getting-started-with-the-azure-cli/) 3. ### Troubleshoot Azure Storage Permissions with the Azure CLI Hands-On Lab Azure rejects every website upload from the deployment service principal, even though the identity can find the storage account. Use the Azure CLI to find the missing permission and restore the upload. Give the identity access to the website files only for least privilege. View Content [Troubleshoot Azure Storage Permissions with the Azure CLI](https://cybr.com/hands-on-labs/lab/troubleshoot-azure-storage-permissions-with-the-azure-cli/) 4. ### Intro to Azure Enumeration Hands-On Lab You have credentials for a client's Azure environment, but no resource inventory. Where do you start? In this beginner-friendly lab, you'll use the Azure CLI to discover resources, investigate permissions, and test access to stored data... View Content [Intro to Azure Enumeration](https://cybr.com/hands-on-labs/lab/intro-to-azure-enumeration/) 5. ### Investigate Unauthorized Changes in the Azure Activity Log Hands-On Lab Learn how to investigate an unapproved website change with the Azure CLI. Compare the site files, examine role-assignment events in the Azure Activity Log, and review access to the storage account to identify who could change the site... View Content [Investigate Unauthorized Changes in the Azure Activity Log](https://cybr.com/hands-on-labs/lab/investigate-unauthorized-changes-in-the-azure-activity-log/) 6. ### Investigate API Access Logs with Azure Application Insights Hands-On Lab Get hands-on with Azure Application Insights as you investigate requests to an API. You’ll generate successful and blocked requests, then use KQL to see which requests the API allowed and which it denied. We’ll walk through connecting application logs to HTTP request records, building alerts for repeated denials... View Content [Investigate API Access Logs with Azure Application Insights](https://cybr.com/hands-on-labs/lab/investigate-api-access-logs-with-azure-application-insights/) 7. ### Hunt and Remediate Azure Blob Exposure with Prowler Hands-On Lab Your manager wants you to run a quick security assessment to make sure that your data stored in Azure is not publicly exposed, and that your resource configurations are following security best practices. In this lab, you’ll hunt down and remediate Azure Blob exposure using the popular open source Prowler. View Content [Hunt and Remediate Azure Blob Exposure with Prowler](https://cybr.com/hands-on-labs/lab/hunt-and-remediate-azure-blob-exposure-with-prowler/) 8. ### Require Microsoft Entra sign-in for an Azure App Hands-On Lab Your Azure Static Web App is open to everyone. Lock it down with Microsoft Entra authentication, grant access through a custom role, and prove that only authorized users can get in. View Content [Require Microsoft Entra sign-in for an Azure App](https://cybr.com/hands-on-labs/lab/require-microsoft-entra-sign-in-for-an-azure-app/) 9. ### Harden Azure Functions with Managed Identity Hands-On Lab Long-term client secrets are not a good solution whenever we can avoid them. In this lab, you'll harden a Node.js Azure Functions API by replacing its client secret with a system-assigned managed identity, make sure the application still works, and then disable storage account key access... View Content [Harden Azure Functions with Managed Identity](https://cybr.com/hands-on-labs/lab/harden-azure-functions-with-managed-identity/) 10. ### Deploying Azure resources with Bicep Hands-On Lab Manual cloud changes are difficult to review, repeat, and restore. In this lab, you will learn how to manage Azure infrastructure with Azure Bicep, an infrastructure-as-code (IaC) programming language. You will preview and deploy serverless Cosmos DB for storing incident history. View Content [Deploying Azure resources with Bicep](https://cybr.com/hands-on-labs/lab/deploying-azure-resources-with-bicep/) 11. ### Deploying Azure resources with Terraform Hands-On Lab Deploy a serverless Cosmos DB database with Terraform to learn how to deploy resources on Azure using Infrastructure as Code. This lab explains how Terraform works, how to initialize it, and how it tracks the state of your environments... View Content [Deploying Azure resources with Terraform](https://cybr.com/hands-on-labs/lab/deploying-azure-resources-with-terraform/) 12. ### Secure Azure Resources with Private Endpoints Hands-On Lab Learn how Azure virtual networks, subnets, private endpoints, and private DNS work together to protect access to important cloud resources. Starting with an application backed by Cosmos DB, you’ll build a private connection to the database, disable its public network access, and verify that the application can still save and retrieve data... View Content [Secure Azure Resources with Private Endpoints](https://cybr.com/hands-on-labs/lab/secure-azure-resources-with-private-endpoints/) 13. ### Scan and secure Azure Terraform with Checkov Hands-On Lab Review a proposed CloudOps Terraform change before it reaches Azure. Find and repair security misconfigurations with Checkov, then write custom policies that encode your organization's requirements as repeatable checks. View Content [Scan and secure Azure Terraform with Checkov](https://cybr.com/hands-on-labs/lab/scan-and-secure-azure-terraform-with-checkov/) [\+ these Hands-On Labs](https://cybr.com/hands-on-labs/?category=azure) ## Ready to advance your cloud security skills? Join thousands of security professionals who are building their skills with our practical cloud security training [Start Learning](https://cybr.com/auth/register)