Question

A financial services company is adopting the Azure Well-Architected Framework and Cloud Adoption Framework to standardize how new landing zones are provisioned. Platform engineers deploy all Azure resources through Bicep templates in a CI/CD pipeline. Recently, a misconfigured storage account with public blob access was deployed to production and later exploited. The security architect must design a DevSecOps control that prevents insecure infrastructure definitions from ever reaching production, while giving developers feedback early in the workflow. Which approach best aligns with WAF security and DevSecOps shift-left principles?

Accepted Answer

Integrate infrastructure-as-code (IaC) security scanning (e.g., Microsoft Defender for DevOps / template scanning) into the pull request and build stages, failing the pipeline on high-severity misconfigurations before deployment.

Answer

Enable Microsoft Defender for Cloud runtime scanning and configure email alerts to the security team whenever a public storage account is detected in production.

Answer

Apply an Azure Policy with a deny effect on public storage accounts only after resources are deployed, then remediate flagged resources during the next maintenance window.

Answer

Require a manual security review sign-off by the SOC team on every production release to catch insecure configurations before approval.