Launched in October 2008, Microsoft Azure has become one of the prime cloud hosting services for application management, boasting over 20,000 customers in 2019.
According to a survey,79% of companiesexperienced a cloud data breach in the past 18 months. This has made cloud security one of the top issues to invest in for all service providers.
With one of the highest adoption rates, Azure needs additional security layers to prevent internal and external cyber attacks like any other cloud service provider. Microsoft invests over$1B annuallyto protect customer data from cyber threats which helps to keep Azure secure, but you still need to do your part.
Why is Azure Security Important?
An average organization gets about17,000 security alertsin a week. However, as per the global cyber security data, it takes anaverage of 287 daysto detect and solve a breach.
Today, around21% of files are not securedby any security measure, and Azure security automatically becomes the first line of defense. With Microsoft pumping north of a billion dollars every year into cybersecurity, including Azure, you can understand why it is essential.
To take it a step further from Azure’s security suite, you can implement azero-trust frameworkinto your network architecture. Zero trust is based on the principle of “never trust, always verify,” and hence doesn’t allow the user into the network or to access any data until they are authorized or verified.
Zero-trust security principles use the segmentation of networks as one line of defense. It simplifies user access to block and isolate any suspicious activity, preventing threats to the organizational data.
What are the Best Security Practices for Azure?
Azure has been designed to work seamlessly withVMWare,Kubernetes, andDockerfor added scalability and faster provisioning cycles in an IaaS environment. However, to prevent any cyber threats to the Azure cloud environment, you can use the following security practices:
Use Dedicated Workstations With Privileged Access For Admins
Instead of using workstations for personal tasks like social media or checking email, or shared business purposes, we recommend using a dedicated workstation with administrative privileges.
Doing this allows admins to separate sensitive tasks and accounts to prevent malicious software or bad actors from gaining elevated privileges by compromising a shared-use PC.
These admin workstations should be set up with USB mass storage and other external storage devices disabled, should be hardwired instead of wireless, and should have no other software installed other than those required to perform administrative tasks.
Restrict the Administrator Access
With the introduction of SaaS apps and personal devices, the organizational network security parameter of just observing the entry and exit has become obsolete. With Azure AD, around 99.9% of cyber attacks can be prevented by privileged administrative control granted to users in your organization.
With your rights as the Global Administrator on Azure, you should restrict the other administrator accounts’ access to perform non-administrative tasks like personal emailing, etc. Deploy 2FA or MFA on all administrator accounts (Privileged Role Administrator, Exchange Administrator, SharePoint Administrator) to ensure security in accessing and sharing the data.
Using the principles of zero trust, you should consider further restricting administrators within your network to limit them within their job scope. For example, an administrator in End-User Computing (EUC) should only have admin privileges to desktops, laptops and mobile devices uses by employees through their regular course of business. These admins would not have access to cloud resources, code repositories, security monitoring tools or other administrative functions. Similarly, a Cloud Admin would not need access to EUC admin functions and would be limited in scope of their admin role.
Use Multi-Factor Authentication (MFA)
To prevent malicious access to its accounts and data, Meta has implemented 2FA across all its products, including Facebook and Instagram. Azure can do the same via OTP, SMS, or phone calls to better mitigate any risks of a data breach. To ensure this security, you will have to set up Azure AD MFA.
In some cases implementing MFA or 2FA can cause barriers for users as it slows down their ability to do their job. MFA/2FA can be selectively applied to apps and services within your organization based on the sensitivity of the information being accessed throughConditional Accesspolicies
Restrict User Access
One of the easiest ways to prevent unwanted access to sensitive data is limiting the users’ access to Microsoft Azure. Using the Global Administrator or Privileged Administrator rights, you can set up security gates to prevent unauthorized access to data. Furthermore, you can set boundaries for external users about the information they have access to.
Security measures likezero trustcome in handy as they do not trust any user, network, or device accessing the data while continuously monitoring and verifying each of them. Furthermore, if we can automatically detect suspicious behavior on the cloud, we can isolate them when needed to prevent any data breach.
Manage and Limit Network Access within Azure
Microsoft Azure allows the admins to use Network Segmentation Groups (also called subnets). This prevents network zones from interfacing with others that do not need it. Admins for each subnet can still access the RDP and SSH protocols for all the subnets.
Through Azure, you set up a site-to-site VPN that can extend the local network within your physical building to the cloud. Considerations should be observed when it comes to how your local network accesses cloud resources to ensure security protocols are followed.
When you want to practice additional control, the admin can use P2P VPN, which can be programmed to work only in the Azure environment. Another way to do this is by adding a VPN machine in the internal network that can be used as a jump box to access all the other machines running in RDP and SSH sessions.
Use a Key Management Solution
One way to keep data safe from cyber threats and malicious users is to employ a Key Management Solution, like Azure Key Vault. The Key Vault can be used as a key management solution that can help in securing keys and secrets like API credentials, passwords, certificates, and other cryptographic keys in hardware security modules (HSM).
During application development, these keys and other sensitive material are not hard-coded within the app or platform itself. Instead, the keys are retrieved from the vault at runtime through API calls or other programmatic access. The keys from the vault cannot be fetched directly, and only the developers that created the keys can grant access for usage in development or testing.
Using Azure, these keys can be stored on the cloud and can be seamlessly accessed globally without the costs of deploying additional HSMs.
A similar secret management tool like Azure Key Vault isHashiCorp Vault, usually deployed in low trust cloud environments. It performs the same functions as Key Vault, with one significant difference. The difference is that Vault by HashiCorp allows a separate team to configure and manage it, while Azure Key Vault can be configured only by the developers.
Encrypt Virtual Disks and Disk Storage
If you have implemented a virtual machine on the cloud, you need to encrypt the virtual disk to safeguard the data. Azure uses BitLocker in Windows to provide volume encryption of the OS and data disk of the virtual machine. This is directly integrated with Azure Key Vault that applies encryption as standard, which can then be managed via the keys generated.
Use a Centralized Security Management System
A centralizedsecurity management systemcomes in handy to monitor both your cloud and on-premise servers and devices from a central dashboard.
Services like Microsoft Defender for Cloud (Formally Azure Defender and Azure Security Center) provide real-time security health status, compliance monitoring, and mitigation solutions.
Monitor Activity Logs Regularly
One of the critical aspects of discovering a breach is locating the source. Activity logs can prove a tremendous asset as you can determine which system was responsible for the breach. Azure offers the following type of logs:
- Activity logs: A general log report about all the operations performed by the users.
- Azure Resource logs: A log report that gives insight into the operations done by the resource.
- Azure Active Directory reporting: A log report about sign-in and system activity information about users.
- Virtual machines and cloud services: A log report about system data and logging data from virtual machines.
- Azure Storage Analytics: A log report that offers insight into usage trend analysis, trace requests, and problem diagnosis of the account.
- Network security group (NSG) flow logs: A log report about incoming and outgoing IP addresses on an NSG.
- Application insight: A log report about application performance monitoring useful for web developers working on various platforms.
- Process data/security alerts: A log report about security information and alerts.
Watch Cloud Workloads Security
Azure helps faster development time, flexibility, and scalability in app development. Today,50% of all organizationsstore their data on the cloud and work with multiple clouds and hybrid development models. Hence, workload security is also a rising point of concern. This is where aspects like 2FA and MFA come in handy in ensuring only the organization’s users can access the cloud.
By implementing cloud workload security fromproviders like SoftwareONE, you can reduce the risk of a data breach with 24×7 security monitoring and improve compliance with security policies and regulations. Furthermore, it reduces the complexity and increases the transparency of your security structure to aid hassle-free workability across various locations.
What are Some Auditing Tools for Microsoft Azure?
Like financial audits to check if the financial representations are fair and accurate, cloud audits also need to be performed. This is to make sure that the cloud offers the correct details and serves right as per the code of standards set by theCloud Security Alliance.
The purpose of a cloud audit is for companies to reveal their performance and security data to show if the cloud is performing as it is claimed. According to a study,21% of companiesaudit their cloud daily, while 45% skip the audits altogether. Here are some frameworks and other resources to consider.
Security, Trust, Assurance, and Risk (STAR) Security Questionnaire
CSA designedthis to help the customers assess and select a cloud service provider. It uses three analysis steps: self-assessment, third-party audit, and continuous monitoring.
STAR Registry
CSA also offers apublicly accessible registrythat details various cloud service providers with varying STAR levels. This helps the customers to make an informed decision about which service provider they can use for their business.
CSA best practices
For virtual environments, especially the ones in the cloud,CSA has launched best practicesto implement that can help reduce and mitigate the risks of a data breach.
Cloud Controls Matrix (CCM) v4
TheCloud Controls Matrix (CCM)is a cybersecurity control framework aligned to the best practices listed by the CSA. It is effectively considered the baseline for cloud security and privacy. This, along with the STAR questionnaire, can help you understand your areas of improvement for cloud security.
Conclusion
In the immensely populated cloud service provider market, Microsoft Azure might seem to be tooting its own horn withits bold claims. However, while it looks like a plain-Jane cloud service that cannot help protect against cyberattacks, it certainly does hold its own with a sizable monopoly at26% market sharein 2021.
Besides its capability of interfacing with VMWare, Kubernetes, etc., Azure also offersproprietary security solutionsthat provide additional layers of security. Furthermore, it helps lower the costs of scaling operations, allowing it to stand out as one of the best out there.
FAQs
8 Best Practices in Security for Microsoft Azure Cloud Services? ›
Best practice: Segment the larger address space into subnets. Detail: Use CIDR-based subnetting principles to create your subnets. Best practice: Create network access controls between subnets. Routing between subnets happens automatically, and you don't need to manually configure routing tables.
What is the best practice of Azure security groups? ›Best practice: Segment the larger address space into subnets. Detail: Use CIDR-based subnetting principles to create your subnets. Best practice: Create network access controls between subnets. Routing between subnets happens automatically, and you don't need to manually configure routing tables.
How would you ensure security on Microsoft Azure? ›- Identify all sensitive information. ...
- Encrypt data at rest. ...
- Encrypt data in transit. ...
- Have a backup and disaster recovery (DR) plan. ...
- Use a key management solution. ...
- Harden your management workstations. ...
- Use Azure Information Protection.
Security design principles describe a securely architected system hosted on cloud or on-premises datacenters (or a combination of both). Application of these principles dramatically increases the likelihood your security architecture assures confidentiality, integrity, and availability.
Which Microsoft security Service offers recommendations on how to better secure the Azure cloud solutions? ›Microsoft Defender for Cloud helps you prevent, detect, and respond to threats with increased visibility into and control over the security of your Azure resources.
Which service in Azure gives you best practices recommendations? ›Azure Advisor offers actionable recommendations to help you optimize your Azure resources for reliability, security, operational excellence, performance, and cost.
What are the four focus areas of Azure Security Center policy? ›As you can see in Figure 2-4, the Security Center Overview dashboard has four major areas: Secure Score, Regulatory Compliance, Azure Defender and Firewall Manager.
What is Azure Security Center recommendations? ›Recommendations -- provides a list of suggestions for creating Azure security policies based on the security needs of your specific Azure resources. Potential recommendations include deploying a missing system update, provisioning antimalware and using network security groups to control VM traffic.
What are the 5 pillars of cloud security? ›- Identity and access management.
- Infrastructure protection.
- Data protection.
- Detection controls.
- Incident response.
- Protect your data. ...
- Avoid pop-ups, unknown emails, and links. ...
- Use strong password protection and authentication. ...
- Connect to secure Wi-Fi. ...
- Enable firewall protection at work and at home. ...
- Invest in security systems. ...
- Install security software updates and back up your files.
What security options are in Azure? ›
- Microsoft Sentinel.
- Protect your Azure resources from distributed denial-of-service (DDoS) attacks.
- Azure Bastion. Fully managed service that helps secure remote access to your virtual machines.
- Web Application Firewall. ...
- Azure Firewall. ...
- Azure Firewall Manager.
| Service | Description |
|---|---|
| Azure Load Balancer | A TCP/UDP application network load balancer. |
| Azure ExpressRoute | A feature that lets you extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider. |
| Azure Traffic Manager | A DNS-based traffic load balancer. |
Azure secures your data using various encryption methods, protocols, and algorithms, including double encryption. For data at rest, all data written to the Azure storage platform is encrypted through 256-bit AES encryption and is FIPS 140-2 compliant. Proper key management is essential.
What are the eight principles of security? ›- Minimise attack surface area. ...
- Establish secure defaults. ...
- The principle of Least privilege. ...
- The principle of Defence in depth. ...
- Fail securely. ...
- Don't trust services. ...
- Separation of duties. ...
- Avoid security by obscurity.
The foundation of Microsoft's approach to privacy is built on the following six principles: customer control, transparency, security, strong legal protections for privacy, no content-based targeting, and benefits to customers from any data we collect.
What are the 5 principles of Azure? ›The Microsoft Azure Well-Architected Framework provides technical guidance specifically at the workload level across five pillars - cost optimization, security, reliability, performance efficiency and operational excellence.
What are the 3 uses of Microsoft cloud app security? ›Defender for Cloud Apps can enforce policies, detects threats, and provides governance actions for resolving issues.
How secure is Azure cloud services? ›Continuous Security Monitoring
The security panel on Azure makes it easy for businesses to fit security solutions based on their specific needs. With the continuous monitoring and the security panel, it means that any security threats are easily detected and mitigated without any harmful impact.
Azure Active Directory
It provides identity and protection from 99.9 percent of cyber security attacks. It offers a single sign-on and multi-factor authentication, self-service password reset, application usage monitoring and security monitoring services to users for accessing application running in Microsoft Azure.
This gives users the flexibility to use their preferred tools and technologies. In addition, Azure offers four different forms of cloud computing: infrastructure as a service (IaaS), platform as a service (PaaS), software as a service (SaaS) and serverless functions.
What are the four types of services included in Microsoft Azure Media Services? ›
Encode, store, and stream video and audio at scale
Azure Media Services lets you deliver any media, on virtually any device, to anywhere in the world using the cloud. The collection of services provide encoding, live or on-demand streaming, content protection and indexing for video and audio content.
In this lesson, we will teach you about the four main priorities of Microsoft Azure: system monitoring, application monitoring, log monitoring, and alerting. For section 1 of this course we have four priorities: System monitoring, application monitoring, log monitoring, and alerting.
What are the three most urgent security challenges addressed by Azure Security Center? ›- Firstly, Rapidly changing workloads. It's both a strength and a challenge of the cloud. ...
- Secondly, Increasingly sophisticated attacks. ...
- Lastly, Security skills are in short supply.
Protect your data and code while the data is in use in the cloud. Accelerate time to market, deliver innovative experiences and improve security with Azure application and data modernisation. Seamlessly integrate applications, systems, and data for your enterprise.
What are the roles for security center in Azure? ›Security Center uses Role-Based Access Control (RBAC) based in Azure. By default, there are two roles in Security Center: Security Reader and Security Admin. The Security Reader role should be assigned to all users that need read access only to the dashboard.
How Azure Security Center detects threats and prevents? ›Azure offers built in threat protection functionality through services such as Azure Active Directory (Azure AD), Azure Monitor logs, and Microsoft Defender for Cloud. This collection of security services and capabilities provides a simple and fast way to understand what is happening within your Azure deployments.
What are the 4 C's of cloud native security? ›Code, Container, Cluster, and Cloud.
What are the four areas of cloud security? ›What Are the 4 Areas of Cloud Security? Four cloud security solutions include cloud data visibility, control over cloud data, access to cloud data and applications, and compliance.
What is the 6th cloud security principle? ›Principle 6: Personnel security
where service provider personnel have access to your data and systems, you need a high degree of confidence in their trustworthiness and the technical measures in place that audit and constrain the actions of those personnel.
The types of service models in use by a business define the types of cloud security architectures that are most applicable. The service models are: Infrastructure as a Service (IaaS), Software as a Service (SaaS), and Platform as a Service (PaaS).
What are the 3 major areas of security explain? ›
There are three primary areas or classifications of security controls. These include management security, operational security, and physical security controls.
What are the 7 aspects of security? ›The 7 Elements of Human Security are defined by the United Nations as: Economic, Environmental, Food, Health, Political, Personal and Community. We design projects and initiatives with our partners that holistically address these areas of Human Security.
What are the 4 fundamentals of security? ›It was always about protecting the confidentiality, the integrity, the authenticity, the availability of information.” Here's a closer look at these four security qualities.
What are the 4 basic security principles? ›There are four basic security principles: access, authentication, authorization, and accounting.
How do I maintain security in Azure? ›- Identify all sensitive information. ...
- Encrypt data at rest. ...
- Encrypt data in transit. ...
- Have a backup and disaster recovery (DR) plan. ...
- Use a key management solution. ...
- Harden your management workstations. ...
- Use Azure Information Protection.
Microsoft Defender for Identity (formerly Azure Advanced Threat Protection, also known as Azure ATP) is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your ...
Which cloud app security is used in Azure? ›Microsoft 365 Defender will be the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. For more information about these changes, see Microsoft Defender for Cloud Apps in Microsoft 365 Defender.
What are the three main components of Azure cloud? ›It has three major components: Compute, Storage and the Fabric Controller. As depicted in Figure 3.16, Windows Azure runs on a large number of machines, all maintained in Microsoft data centers. The hosting environment of Azure is called the Fabric Controller.
How do I secure my Azure infrastructure? ›- Apply OS security settings with recommended configuration rules.
- Identify and download system security and critical updates that might be missing.
- Deploy recommendations for endpoint antimalware protection.
- Validate disk encryption.
- Assess and remediate vulnerabilities.
- Detect threats.
In AIP, a classification label is used to identify data based on its level of sensitivity and the impact to your business. Most common sensitivity levels are categorized as restricted, confidential, official use, and public.
Which of the tool is used to secure MS Azure? ›
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) solution for Azure, on-premises, and multi-cloud resources.
What are the 5 security criteria? ›The U.S. Department of Defense has promulgated the Five Pillars of Information Assurance model that includes the protection of confidentiality, integrity, availability, authenticity, and non-repudiation of user data.
What are the 5 elements of security? ›It relies on five major elements: confidentiality, integrity, availability, authenticity, and non-repudiation.
What are the 6 dimensions of is security? ›The most common security breach for the ecommerce website is concerned with Integrity, Availability, Confidentiality, Non-repudiation, Authenticity, and Privacy.
What are the four focus areas of Azure security Center policy? ›As you can see in Figure 2-4, the Security Center Overview dashboard has four major areas: Secure Score, Regulatory Compliance, Azure Defender and Firewall Manager.
What are the eight types of privacy? ›This analysis enables us to structure types of privacy in a two- dimensional model, consisting of eight basic types of privacy (bod- ily, intellectual, spatial, decisional, communicational, associational, proprietary, and behavioral privacy), with an overlay of a ninth type (informational privacy) that overlaps, but ...
What are the 4 fundamental Azure roles? ›| Azure role | Permissions |
|---|---|
| Owner | Full access to all resources Delegate access to others |
| Contributor | Create and manage all of types of Azure resources Create a new tenant in Azure Active Directory Can't grant access to others |
| Reader | View Azure resources |
| User Access Administrator | Manage user access to Azure resources |
Currently, Azure Firewall policy support two kinds of rule collections which are Filter collection and NAT collection. There are three kinds of rules which are application rule, network rule and nat rule.
What are the six principles of Microsoft? ›At Microsoft, we've recognized six principles that we believe should guide AI development and use — fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability.
Which 3 products are cloud delivered security? ›- Software as a Service (SaaS)
- Platform as a Service (PaaS)
- Infrastructure as a Service (IaaS)
What are two security features used by cloud service providers? ›
- Feature 1: Advanced Perimeter Firewall. ...
- Features 3: Internal Firewalls for Each Application & Databases. ...
- Feature 4: Data-at-Rest Encryption.
The Azure cloud platform is more than 200 products and cloud services designed to help you bring new solutions to life—to solve today's challenges and create the future. Build, run, and manage applications across multiple clouds, on-premises, and at the edge, with the tools and frameworks of your choice.
How do I secure my cloud services? ›- Use a Cloud Service That Encrypts. ...
- Read the User Agreements. ...
- Set Up Your Privacy Settings. ...
- Use Strong Passwords. ...
- Use Two-Factor Authentication. ...
- Don't Share Personal Information. ...
- Don't Store Sensitive Information. ...
- Use a Strong Anti-Malware Program.
For data at rest, all data written to the Azure storage platform is encrypted through 256-bit AES encryption and is FIPS 140-2 compliant. Proper key management is essential. By default, Microsoft-managed keys protect your data, and Azure Key Vault helps ensure that encryption keys are properly secured.
Which Azure security solutions provide general security recommendations? ›Defender for Cloud collects data from your Azure virtual machines (VMs) to monitor for security vulnerabilities and threats.
What are the 4 types of Azure? ›- Azure Blob Storage. Blob is one of the most common Azure storage types. ...
- Azure Files. Azure Files is Microsoft's managed file storage in the cloud. ...
- Azure Queue Storage. ...
- Azure Table. ...
- Azure Managed Disks.
In addition, Azure offers four different forms of cloud computing: infrastructure as a service (IaaS), platform as a service (PaaS), software as a service (SaaS) and serverless functions.
What are the 3 main DevOps tools that Microsoft Azure offers? ›On-premises Azure DevOps Server provides three access levels: Stakeholder, Basic, and Basic + Test Plans.
What are the three kinds of app service in Azure? ›- Web Apps.
- API Apps.
- Logic Apps.
- Function Apps.
The Azure cloud platform is more than 200 products and cloud services designed to help you bring new solutions to life—to solve today's challenges and create the future.
What are Azure security groups used for? ›
You can use an Azure network security group to filter network traffic between Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.
What is the difference between NSG and application security group in Azure? ›A network security group is used to enforce and control network traffic. An application security group is an object reference within an NSG. Controls the inbound and outbound traffic at the subnet level.
What is Azure security groups? ›An azure network security group is merely a set of access control rules that can be wrapped around a virtual network or a subnet; these rules inspect inbound and outbound traffic to determine whether to allow or deny a package.
When should I use Azure firewall vs NSG? ›An NSG is more targeted and is deployed to particular subnets and/or network interfaces, whereas an Azure Firewall monitors traffic more broadly. Applying rules based on IP addresses, port numbers, networks, and subnets is possible with both firewalls and NSG.
What are the three main types of security groups within Active Directory? ›- Universal Group. It can contain users and groups (global and universal) from any domain in the forest. ...
- Global Group. It can contain users, computers, and groups from same domain but NOT universal groups. ...
- Domain Local Group.
vNets also provide the functionality to hook into things like VPN's and Express route. NSG's are your firewalls that determine what traffic is allowed through. The important thing to note is that NSG's can be applied to individual machines, or to subnets.
What is the difference between Azure security Group and 365 group? ›A security group can have users, devices, groups, and service principals as its members, but a Microsoft 365 group can only have users as its members. These groups are also recommended if you are managing access to resources via Intune.
What is the difference between AAD group and security group? ›Types of Active Directory Groups
Distribution groups are simpler in that they would be used if only one-way notifications are required from the central controller. Security groups are more complex, and they are applied when you want to enable users to access and modify data.
- Access Control Assistance Operators.
- Account Operators.
- Administrators.
- Allowed RODC Password Replication.
- Backup Operators.
- Certificate Service DCOM Access.
- Cert Publishers.
- Cloneable Domain Controllers.
Yes. Maximum of 1000 NSG Rules per NSG.
What are Azure Active Directory security? ›
Azure Active Directory (Azure AD), part of Microsoft Entra, is an enterprise identity service that provides single sign-on, multifactor authentication, and conditional access to guard against 99.9 percent of cybersecurity attacks.
What firewall should I use in Azure? ›Azure Firewall is a cloud-native and intelligent network firewall security service that provides the best of breed threat protection for your cloud workloads running in Azure. It's a fully stateful, firewall as a service with built-in high availability and unrestricted cloud scalability.
Do you need a firewall in Azure? ›Yes. Azure Firewall supports inbound and outbound filtering. Inbound protection is typically used for non-HTTP/S protocols such as RDP, SSH, and FTP protocols. For the best inbound HTTP/S protection, use a web application firewall such as Azure Web Application Firewall (WAF).
What are the firewall options in Azure? ›Azure Firewall supports filtering for both inbound and outbound traffic, internal spoke-to-spoke connections, and hybrid connections through Azure VPN and ExpressRoute gateways.