Skip to content

Commit f540f01

Browse files
mbender-msmbender-ms
committed
Replace INCLUDE table format with header+include format and fix links
- Convert 4 service recommendation pages from table format to header+include format matching the Entra docs pattern (each recommendation gets a ### heading followed by the [!INCLUDE] directive) - Update summary page links to point to specific heading anchors on each service page instead of out-of-scope include files - Add Zero Trust recommendations card to index.yml highlighted content
1 parent 84df6eb commit f540f01

6 files changed

Lines changed: 120 additions & 56 deletions

File tree

‎articles/networking/security/index.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ highlightedContent:
2525
itemType: overview # controls the icon image and super-title text
2626
url: /azure/networking/security/network-security
2727
# Card
28+
- title: Azure network security Zero Trust recommendations
29+
itemType: concept
30+
url: /azure/networking/security/zero-trust-network-security
31+
# Card
2832
- title: Azure best practices for network security
2933
itemType: concept
3034
url: ../../security/fundamentals/network-best-practices.md

‎articles/networking/security/zero-trust-application-gateway-waf.md‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,37 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Application Gateway WAF is enabled in prevention mode](includes/25541.md)] | High | Low | Low |
23-
| [!INCLUDE [Request body inspection is enabled in Application Gateway WAF](includes/26879.md)] | High | Low | Low |
24-
| [!INCLUDE [Default rule set is enabled in Application Gateway WAF](includes/26881.md)] | High | Low | Low |
25-
| [!INCLUDE [Bot protection rule set is enabled and assigned in Application Gateway WAF](includes/26882.md)] | High | Low | Low |
26-
| [!INCLUDE [HTTP DDoS protection rule set is enabled in Application Gateway WAF](includes/27015.md)] | High | Low | Low |
27-
| [!INCLUDE [Rate limiting is enabled in Application Gateway WAF](includes/27016.md)] | High | Low | Medium |
28-
| [!INCLUDE [JavaScript challenge is enabled in Application Gateway WAF](includes/27017.md)] | Medium | Low | Low |
29-
| [!INCLUDE [Diagnostic logging is enabled in Application Gateway WAF](includes/26888.md)] | High | Low | Low |
20+
### Application Gateway WAF is enabled in prevention mode
21+
22+
[!INCLUDE [Application Gateway WAF is enabled in prevention mode](includes/25541.md)]
23+
24+
### Request body inspection is enabled in Application Gateway WAF
25+
26+
[!INCLUDE [Request body inspection is enabled in Application Gateway WAF](includes/26879.md)]
27+
28+
### Default rule set is enabled in Application Gateway WAF
29+
30+
[!INCLUDE [Default rule set is enabled in Application Gateway WAF](includes/26881.md)]
31+
32+
### Bot protection rule set is enabled and assigned in Application Gateway WAF
33+
34+
[!INCLUDE [Bot protection rule set is enabled and assigned in Application Gateway WAF](includes/26882.md)]
35+
36+
### HTTP DDoS protection rule set is enabled in Application Gateway WAF
37+
38+
[!INCLUDE [HTTP DDoS protection rule set is enabled in Application Gateway WAF](includes/27015.md)]
39+
40+
### Rate limiting is enabled in Application Gateway WAF
41+
42+
[!INCLUDE [Rate limiting is enabled in Application Gateway WAF](includes/27016.md)]
43+
44+
### JavaScript challenge is enabled in Application Gateway WAF
45+
46+
[!INCLUDE [JavaScript challenge is enabled in Application Gateway WAF](includes/27017.md)]
47+
48+
### Diagnostic logging is enabled in Application Gateway WAF
49+
50+
[!INCLUDE [Diagnostic logging is enabled in Application Gateway WAF](includes/26888.md)]
3051

3152
## Related content
3253

‎articles/networking/security/zero-trust-azure-firewall.md‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,25 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](includes/25535.md)] | High | Low | Medium |
23-
| [!INCLUDE [Threat intelligence is enabled in deny mode on Azure Firewall](includes/25537.md)] | High | Low | Low |
24-
| [!INCLUDE [IDPS inspection is enabled in deny mode on Azure Firewall](includes/25539.md)] | High | Low | Low |
25-
| [!INCLUDE [Inspection of outbound TLS traffic is enabled on Azure Firewall](includes/25550.md)] | High | Low | Low |
26-
| [!INCLUDE [Diagnostic logging is enabled in Azure Firewall](includes/26887.md)] | High | Low | Low |
20+
### Outbound traffic from VNet-integrated workloads is routed through Azure Firewall
21+
22+
[!INCLUDE [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](includes/25535.md)]
23+
24+
### Threat intelligence is enabled in deny mode on Azure Firewall
25+
26+
[!INCLUDE [Threat intelligence is enabled in deny mode on Azure Firewall](includes/25537.md)]
27+
28+
### IDPS inspection is enabled in deny mode on Azure Firewall
29+
30+
[!INCLUDE [IDPS inspection is enabled in deny mode on Azure Firewall](includes/25539.md)]
31+
32+
### Inspection of outbound TLS traffic is enabled on Azure Firewall
33+
34+
[!INCLUDE [Inspection of outbound TLS traffic is enabled on Azure Firewall](includes/25550.md)]
35+
36+
### Diagnostic logging is enabled in Azure Firewall
37+
38+
[!INCLUDE [Diagnostic logging is enabled in Azure Firewall](includes/26887.md)]
2739

2840
## Related content
2941

‎articles/networking/security/zero-trust-ddos-protection.md‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,17 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [DDoS Protection is enabled for all public IP addresses in VNets](includes/25533.md)] | High | Low | Low |
23-
| [!INCLUDE [Metrics are enabled for DDoS-protected public IPs](includes/26885.md)] | Medium | Low | Low |
24-
| [!INCLUDE [Diagnostic logging is enabled for DDoS-protected public IPs](includes/26886.md)] | Medium | Low | Low |
20+
### DDoS Protection is enabled for all public IP addresses in VNets
21+
22+
[!INCLUDE [DDoS Protection is enabled for all public IP addresses in VNets](includes/25533.md)]
23+
24+
### Metrics are enabled for DDoS-protected public IPs
25+
26+
[!INCLUDE [Metrics are enabled for DDoS-protected public IPs](includes/26885.md)]
27+
28+
### Diagnostic logging is enabled for DDoS-protected public IPs
29+
30+
[!INCLUDE [Diagnostic logging is enabled for DDoS-protected public IPs](includes/26886.md)]
2531

2632
## Related content
2733

‎articles/networking/security/zero-trust-front-door-waf.md‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,37 @@ For a summary of all Azure network security Zero Trust recommendations, see [Azu
1717

1818
## Recommendations
1919

20-
| Recommendation | Risk level | User impact | Implementation cost |
21-
|---|---|---|---|
22-
| [!INCLUDE [Azure Front Door WAF is enabled in prevention mode](includes/25543.md)] | High | Low | Low |
23-
| [!INCLUDE [Request body inspection is enabled in Azure Front Door WAF](includes/26880.md)] | High | Low | Low |
24-
| [!INCLUDE [Default rule set is assigned in Azure Front Door WAF](includes/26883.md)] | High | Low | Low |
25-
| [!INCLUDE [Bot protection rule set is enabled and assigned in Azure Front Door WAF](includes/26884.md)] | High | Low | Low |
26-
| [!INCLUDE [Rate limiting is enabled in Azure Front Door WAF](includes/27018.md)] | High | Low | Medium |
27-
| [!INCLUDE [JavaScript challenge is enabled in Azure Front Door WAF](includes/27019.md)] | Medium | Low | Low |
28-
| [!INCLUDE [CAPTCHA challenge is enabled in Azure Front Door WAF](includes/27020.md)] | Medium | Low | Low |
29-
| [!INCLUDE [Diagnostic logging is enabled in Azure Front Door WAF](includes/26889.md)] | High | Low | Low |
20+
### Azure Front Door WAF is enabled in prevention mode
21+
22+
[!INCLUDE [Azure Front Door WAF is enabled in prevention mode](includes/25543.md)]
23+
24+
### Request body inspection is enabled in Azure Front Door WAF
25+
26+
[!INCLUDE [Request body inspection is enabled in Azure Front Door WAF](includes/26880.md)]
27+
28+
### Default rule set is assigned in Azure Front Door WAF
29+
30+
[!INCLUDE [Default rule set is assigned in Azure Front Door WAF](includes/26883.md)]
31+
32+
### Bot protection rule set is enabled and assigned in Azure Front Door WAF
33+
34+
[!INCLUDE [Bot protection rule set is enabled and assigned in Azure Front Door WAF](includes/26884.md)]
35+
36+
### Rate limiting is enabled in Azure Front Door WAF
37+
38+
[!INCLUDE [Rate limiting is enabled in Azure Front Door WAF](includes/27018.md)]
39+
40+
### JavaScript challenge is enabled in Azure Front Door WAF
41+
42+
[!INCLUDE [JavaScript challenge is enabled in Azure Front Door WAF](includes/27019.md)]
43+
44+
### CAPTCHA challenge is enabled in Azure Front Door WAF
45+
46+
[!INCLUDE [CAPTCHA challenge is enabled in Azure Front Door WAF](includes/27020.md)]
47+
48+
### Diagnostic logging is enabled in Azure Front Door WAF
49+
50+
[!INCLUDE [Diagnostic logging is enabled in Azure Front Door WAF](includes/26889.md)]
3051

3152
## Related content
3253

‎articles/networking/security/zero-trust-network-security.md‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ For more information, see [Zero Trust recommendations for Azure DDoS Protection]
3030

3131
| Recommendation | Risk level | User impact | Implementation cost |
3232
|---|---|---|---|
33-
| [DDoS Protection is enabled for all public IP addresses in VNets](includes/25533.md) | High | Low | Low |
34-
| [Metrics are enabled for DDoS-protected public IPs](includes/26885.md) | Medium | Low | Low |
35-
| [Diagnostic logging is enabled for DDoS-protected public IPs](includes/26886.md) | Medium | Low | Low |
33+
| [DDoS Protection is enabled for all public IP addresses in VNets](zero-trust-ddos-protection.md#ddos-protection-is-enabled-for-all-public-ip-addresses-in-vnets) | High | Low | Low |
34+
| [Metrics are enabled for DDoS-protected public IPs](zero-trust-ddos-protection.md#metrics-are-enabled-for-ddos-protected-public-ips) | Medium | Low | Low |
35+
| [Diagnostic logging is enabled for DDoS-protected public IPs](zero-trust-ddos-protection.md#diagnostic-logging-is-enabled-for-ddos-protected-public-ips) | Medium | Low | Low |
3636

3737
## Azure Firewall
3838

@@ -42,11 +42,11 @@ For more information, see [Zero Trust recommendations for Azure Firewall](zero-t
4242

4343
| Recommendation | Risk level | User impact | Implementation cost |
4444
|---|---|---|---|
45-
| [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](includes/25535.md) | High | Low | Medium |
46-
| [Threat intelligence is enabled in deny mode on Azure Firewall](includes/25537.md) | High | Low | Low |
47-
| [IDPS inspection is enabled in deny mode on Azure Firewall](includes/25539.md) | High | Low | Low |
48-
| [Inspection of outbound TLS traffic is enabled on Azure Firewall](includes/25550.md) | High | Low | Low |
49-
| [Diagnostic logging is enabled in Azure Firewall](includes/26887.md) | High | Low | Low |
45+
| [Outbound traffic from VNet-integrated workloads is routed through Azure Firewall](zero-trust-azure-firewall.md#outbound-traffic-from-vnet-integrated-workloads-is-routed-through-azure-firewall) | High | Low | Medium |
46+
| [Threat intelligence is enabled in deny mode on Azure Firewall](zero-trust-azure-firewall.md#threat-intelligence-is-enabled-in-deny-mode-on-azure-firewall) | High | Low | Low |
47+
| [IDPS inspection is enabled in deny mode on Azure Firewall](zero-trust-azure-firewall.md#idps-inspection-is-enabled-in-deny-mode-on-azure-firewall) | High | Low | Low |
48+
| [Inspection of outbound TLS traffic is enabled on Azure Firewall](zero-trust-azure-firewall.md#inspection-of-outbound-tls-traffic-is-enabled-on-azure-firewall) | High | Low | Low |
49+
| [Diagnostic logging is enabled in Azure Firewall](zero-trust-azure-firewall.md#diagnostic-logging-is-enabled-in-azure-firewall) | High | Low | Low |
5050

5151
## Application Gateway WAF
5252

@@ -56,14 +56,14 @@ For more information, see [Zero Trust recommendations for Application Gateway WA
5656

5757
| Recommendation | Risk level | User impact | Implementation cost |
5858
|---|---|---|---|
59-
| [Application Gateway WAF is enabled in prevention mode](includes/25541.md) | High | Low | Low |
60-
| [Request body inspection is enabled in Application Gateway WAF](includes/26879.md) | High | Low | Low |
61-
| [Default rule set is enabled in Application Gateway WAF](includes/26881.md) | High | Low | Low |
62-
| [Bot protection rule set is enabled and assigned in Application Gateway WAF](includes/26882.md) | High | Low | Low |
63-
| [HTTP DDoS protection rule set is enabled in Application Gateway WAF](includes/27015.md) | High | Low | Low |
64-
| [Rate limiting is enabled in Application Gateway WAF](includes/27016.md) | High | Low | Medium |
65-
| [JavaScript challenge is enabled in Application Gateway WAF](includes/27017.md) | Medium | Low | Low |
66-
| [Diagnostic logging is enabled in Application Gateway WAF](includes/26888.md) | High | Low | Low |
59+
| [Application Gateway WAF is enabled in prevention mode](zero-trust-application-gateway-waf.md#application-gateway-waf-is-enabled-in-prevention-mode) | High | Low | Low |
60+
| [Request body inspection is enabled in Application Gateway WAF](zero-trust-application-gateway-waf.md#request-body-inspection-is-enabled-in-application-gateway-waf) | High | Low | Low |
61+
| [Default rule set is enabled in Application Gateway WAF](zero-trust-application-gateway-waf.md#default-rule-set-is-enabled-in-application-gateway-waf) | High | Low | Low |
62+
| [Bot protection rule set is enabled and assigned in Application Gateway WAF](zero-trust-application-gateway-waf.md#bot-protection-rule-set-is-enabled-and-assigned-in-application-gateway-waf) | High | Low | Low |
63+
| [HTTP DDoS protection rule set is enabled in Application Gateway WAF](zero-trust-application-gateway-waf.md#http-ddos-protection-rule-set-is-enabled-in-application-gateway-waf) | High | Low | Low |
64+
| [Rate limiting is enabled in Application Gateway WAF](zero-trust-application-gateway-waf.md#rate-limiting-is-enabled-in-application-gateway-waf) | High | Low | Medium |
65+
| [JavaScript challenge is enabled in Application Gateway WAF](zero-trust-application-gateway-waf.md#javascript-challenge-is-enabled-in-application-gateway-waf) | Medium | Low | Low |
66+
| [Diagnostic logging is enabled in Application Gateway WAF](zero-trust-application-gateway-waf.md#diagnostic-logging-is-enabled-in-application-gateway-waf) | High | Low | Low |
6767

6868
## Azure Front Door WAF
6969

@@ -73,14 +73,14 @@ For more information, see [Zero Trust recommendations for Azure Front Door WAF](
7373

7474
| Recommendation | Risk level | User impact | Implementation cost |
7575
|---|---|---|---|
76-
| [Azure Front Door WAF is enabled in prevention mode](includes/25543.md) | High | Low | Low |
77-
| [Request body inspection is enabled in Azure Front Door WAF](includes/26880.md) | High | Low | Low |
78-
| [Default rule set is assigned in Azure Front Door WAF](includes/26883.md) | High | Low | Low |
79-
| [Bot protection rule set is enabled and assigned in Azure Front Door WAF](includes/26884.md) | High | Low | Low |
80-
| [Rate limiting is enabled in Azure Front Door WAF](includes/27018.md) | High | Low | Medium |
81-
| [JavaScript challenge is enabled in Azure Front Door WAF](includes/27019.md) | Medium | Low | Low |
82-
| [CAPTCHA challenge is enabled in Azure Front Door WAF](includes/27020.md) | Medium | Low | Low |
83-
| [Diagnostic logging is enabled in Azure Front Door WAF](includes/26889.md) | High | Low | Low |
76+
| [Azure Front Door WAF is enabled in prevention mode](zero-trust-front-door-waf.md#azure-front-door-waf-is-enabled-in-prevention-mode) | High | Low | Low |
77+
| [Request body inspection is enabled in Azure Front Door WAF](zero-trust-front-door-waf.md#request-body-inspection-is-enabled-in-azure-front-door-waf) | High | Low | Low |
78+
| [Default rule set is assigned in Azure Front Door WAF](zero-trust-front-door-waf.md#default-rule-set-is-assigned-in-azure-front-door-waf) | High | Low | Low |
79+
| [Bot protection rule set is enabled and assigned in Azure Front Door WAF](zero-trust-front-door-waf.md#bot-protection-rule-set-is-enabled-and-assigned-in-azure-front-door-waf) | High | Low | Low |
80+
| [Rate limiting is enabled in Azure Front Door WAF](zero-trust-front-door-waf.md#rate-limiting-is-enabled-in-azure-front-door-waf) | High | Low | Medium |
81+
| [JavaScript challenge is enabled in Azure Front Door WAF](zero-trust-front-door-waf.md#javascript-challenge-is-enabled-in-azure-front-door-waf) | Medium | Low | Low |
82+
| [CAPTCHA challenge is enabled in Azure Front Door WAF](zero-trust-front-door-waf.md#captcha-challenge-is-enabled-in-azure-front-door-waf) | Medium | Low | Low |
83+
| [Diagnostic logging is enabled in Azure Front Door WAF](zero-trust-front-door-waf.md#diagnostic-logging-is-enabled-in-azure-front-door-waf) | High | Low | Low |
8484

8585
## Related content
8686

0 commit comments

Comments
 (0)