Securing Agentic Azure: Detection, Automation, and Cloud-Native Resilience

The session begins with foundational principles including shared responsibility, Zero Trust alignment, and structured threat modeling using STRIDE, MITRE ATT&CK for Cloud, and OWASP guidance. It then examines how security teams can combine control-plane, data-plane, and management-plane telemetry to create stronger detection pipelines and improve visibility across distributed workloads. Detection-as-code, rule lifecycle management, contextual enrichment, and prioritization are discussed as practical ways to make security operations more scalable while reducing alert fatigue. The architecture also explores machine learning-augmented detection, automated response orchestration, identity anomaly detection, runtime workload protection, and federated multi-account patterns. These capabilities become particularly relevant as Azure environments grow more autonomous and interconnected. Security teams need mechanisms that can recognize anomalous behavior quickly, coordinate response consistently, and preserve operational control as automation expands. Incident response for ephemeral resources and threat intelligence integration are incorporated into the broader operational model.