Authorized AWS resources appear in Defender for Cloud inventory with current posture assessments. That would be evidence for the separate situation: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.

Defender findings and independent Kubernetes access tests confirm both monitoring and preventive controls. That would be evidence for the separate situation: A security team onboards Defender for Containers but assumes the plan automatically replaces all Kubernetes network and RBAC hardening.

The final inventory distinguishes compliance findings from whether runtime workload protection plans are enabled. That would be evidence for the separate situation: A manager assumes all resources are protected because Microsoft Cloud Security Benchmark checks report high compliance.

Container security monitoring must preserve workload logs and relevant control-plane events across ephemeral lifecycles. This mechanism is associated with a different case: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring.

Azure Bastion provides managed browser-based or native-client connectivity to VMs through private networking. This mechanism is associated with a different case: A production VM must be administered without exposing RDP or SSH over a public IP address.

Customer-managed keys for Azure Storage depend on the key service and managed identity authorized for encryption operations. This mechanism is associated with a different case: An Azure Storage account uses platform-managed encryption but the customer requires control over the key lifecycle.

Point-to-site VPN security depends on controlled client authentication and credential or identity revocation. This mechanism is associated with a different case: Remote users connect to Azure via point-to-site VPN, but a legacy certificate remains accepted after an employee departure.

NSGs associated to subnets and network interfaces both contribute security rules to traffic evaluation. This mechanism is associated with a different case: A subnet has NSG allow rules that seem correct, but connectivity to an application is still denied after a VM NIC NSG change.

TLS protects API endpoint confidentiality and server identity when certificates and trust chains are valid. This mechanism is associated with a different case: A company publishes an API through API Management but a developer uses an untrusted self-signed public-facing certificate.

A route entry outside the subnet's effective routing context cannot force desired network traffic inspection. This hazard concerns another scenario: A team creates a user-defined route sending egress traffic toward a firewall but sees the default system route still used for a workload subnet.

Detection-only WAF rules log attack patterns but do not enforce a request block. This hazard concerns another scenario: An Application Gateway WAF policy starts in detection mode, but administrators assume identified attack patterns are already blocked.

Equating service endpoints with Private Link can lead to incorrect network isolation and DNS assumptions. This hazard concerns another scenario: A developer enables a virtual network service endpoint for Storage and assumes the storage account now has a private IP inside the subnet.

Verify that the exposed scope, client request, token audience and required consent align with the API registration. This is a valid action in another context: A web API publishes an OAuth scope but an authorized client repeatedly receives insufficient-scope errors.

Use Privileged Identity Management to configure eligible Azure RBAC role assignments with approval and time-bound activation. This is a valid action in another context: An incident response team needs elevated Azure resource access only during approved investigations, but administrators have standing Owner access all week.

Verify that PIM eligibility and activation are scoped to the intended subscription or resource group rather than assuming cross-subscription inheritance. This is a valid action in another context: A security operator is granted PIM eligibility to an Azure role but the role never appears when viewing another subscription.

Enable appropriate blob versioning and retention capabilities, then test restore of previous content. This is a valid action in another context: A Blob container has soft delete enabled, but accidental overwrites still destroy access to earlier versions needed for audit.

Configure appropriate SQL auditing settings and an approved Log Analytics, Event Hubs or storage destination. This is a valid action in another context: An Azure SQL administrator enables auditing only for successful authentication but investigators need failed login and sensitive activity evidence.

Enable relevant vulnerability assessment and image security monitoring in supported Defender for Containers capabilities. This is a valid action in another context: An AKS node pool runs outdated vulnerable images, but the team assumes Kubernetes cluster health means software supply-chain security.

Overbroad incident automation can destroy response workflow visibility or incorrectly suppress active threats. This hazard concerns another scenario: A SOC automation rule should tag high-severity incidents but instead closes every incident before investigation.

Assuming all server security features are agentless can omit controls that require agents or other integrations. This hazard concerns another scenario: A security team wants vulnerability coverage of Azure virtual machines without deploying a traditional scanning agent on every host.

Deploying a playbook alone does not provide the permissions needed to act on protected security cases. This hazard concerns another scenario: A Sentinel playbook successfully invokes a Logic App but cannot update an incident because its managed identity lacks rights.

Enable relevant vulnerability assessment and image security monitoring in supported Defender for Containers capabilities. This is a valid action in another context: An AKS node pool runs outdated vulnerable images, but the team assumes Kubernetes cluster health means software supply-chain security.

Assign an appropriate Azure Storage Blob Data Reader role at a justified scope if data access is authorized. This is a valid action in another context: A user has the Azure Reader management-plane role on a storage account and assumes it can download all blob contents.

Deploy Azure Bastion on a supported virtual network and use authorized private management sessions to the VM. This is a valid action in another context: A production VM must be administered without exposing RDP or SSH over a public IP address.

A path trace and firewall log show the matching connection traversing the intended inspection device. That would be evidence for the separate situation: An Azure Firewall is deployed but a workload egress connection bypasses it through an existing default route.

A controlled network test permits approved jump-subnet management and denies internet-origin SSH attempts. That would be evidence for the separate situation: A VM subnet has an NSG that allows inbound SSH from any internet address despite a requirement for administrative access from one jump subnet.

Only approved subnet-origin requests succeed under the service's network access rules. That would be evidence for the separate situation: A virtual network service endpoint is active for Azure Storage, but the storage account still permits traffic from every public source.

The selected VM and disk SKU complete encryption provisioning and the policy confirms required protection. That would be evidence for the separate situation: A team attempts to enable Azure Disk Encryption on a confidential VM using unsupported combinations of encryption features.

An authorized domain identity opens allowed files while another account lacking share or file permission is denied. That would be evidence for the separate situation: An Azure Files share uses SMB but the organization requires on-premises identity integration and per-user permissions.

Authorized responders receive relevant instance operation and security logs for the expected execution interval. That would be evidence for the separate situation: An Azure Container Instance is deployed for short-lived jobs but emits no useful security events to central monitoring.

Microsoft Entra app registration platform settings constrain legitimate OAuth redirect locations. This mechanism is associated with a different case: A developer configures redirect URIs for a production application using a broad wildcard and an untrusted host.

Conditional Access named locations use network or country signals as one condition in a broader risk-based policy. This mechanism is associated with a different case: A remote workforce frequently travels, and an engineer proposes blocking all countries without distinguishing trusted named locations and actual sign-in risk.

Azure role-based access control combines a role definition with an assignment scope and inherits permissions down the resource hierarchy. This mechanism is associated with a different case: A resource administrator assigns Reader at a subscription and expects the recipient to edit network security groups in one resource group.