Design data security around discovery, classification, threat priorities, encryption, key ownership, platform controls, AI use, and workload-specific monitoring.
Discover and classify first
Data protection depends on knowing what data exists, where it flows, who owns it, and how sensitive it is. Use classification to drive access, encryption, retention, loss prevention, monitoring, and approved AI use.
Choose encryption and key ownership
Protect data in transit and at rest. Decide whether platform-managed or customer-managed keys meet the requirement. Azure Key Vault can protect secrets, keys, and certificates; managed HSM supports scenarios requiring dedicated HSM-backed key control. Key rotation, recovery, separation of duties, and logging are part of the design.
Match controls to the data platform
Azure SQL, Synapse Analytics, Cosmos DB, and Azure Storage have different authorization, network, encryption, audit, and threat-protection capabilities. Use managed identities, private access where required, scoped roles, platform auditing, backup protection, and Defender plans appropriate to the service.
Secure data used by AI
Control which datasets models and agents can retrieve, train on, or send to external services. Protect vector stores, indexes, prompts, outputs, and evaluation data. Prevent an agent's tool permissions from bypassing the user's data authorization.
Prioritize threats to data
Rank exfiltration, corruption, unavailability, privacy harm, and key compromise according to business impact. Encryption does not solve excessive authorization, and classification does not enforce protection until controls consume it.