Zero Public Ingress Network Topology
Isolated all data storage, databases, and container registries behind Azure Private Endpoints inside dedicated VNets. Eliminated all direct public internet gateways.
Healthcare Zero-Trust Cloud Baseline
Comprehensive security re-architecture across 6 Microsoft Azure enterprise subscriptions: Private Endpoints, Azure Policy-as-code, Privileged Identity Management (PIM), and automated HIPAA / SOC 2 compliance guardrails.
100%
SOC 2 Type II audit pass
0
Public IP exposures on databases
100%
Azure Policy automated compliance
< 4 min
PIM just-in-time access approval
Zero-Trust Architecture Flow
Microsoft Entra ID Conditional Access & MFA
→
PIM Approval Time-Bound Just-in-Time Access
→
Azure Private Link Zero Public Endpoints
→
Microsoft Sentinel SIEM Continuous Monitoring
The Challenge
The organisation stores protected health information (PHI) for 1.8M patients. Prior to the project, teams lacked centralised identity governance, storage accounts were partially exposed to the internet, and an upcoming SOC 2 Type II audit risked failure.
The Architectural Solution
Bicep Management Groups & Azure Policy
Defined 48 automated Azure Policies enforced at the Root Management Group level to prevent any engineer from provisioning unencrypted disks or public IPs.
Audit & Incident Automation
Connected Microsoft Sentinel with automated playbooks to quarantine anomalous logins and send real-time Slack alerts to the SecOps team.