Secure Your Deployments with DevSecOps on Azure

Improve the Security of Azure DevOps Deployments

Introduction

“Avoid having a failure or test in development impact the production environment.”

Context

A technology company develops critical web applications for financial institutions. To speed up the delivery of new features, development teams were performing tests directly in production environments. A poorly tested configuration change caused the banking system to go down for 3 hours, affecting thousands of users and damaging the client’s reputation.

The lack of separation between development, testing, and production proved to be a serious operational and reputational risk.

Practical Scenario

A developer deploys a new feature from Visual Studio Code using GitHub Actions. Without a clear separation of environments or prior review, the code is pushed directly to production. The update conflicts with existing configurations, causing massive authentication errors for end users.

Microsoft Defender for Cloud detects the unusual spike in HTTP 500 errors, and Microsoft Sentinel issues alerts regarding the service interruption.

Identified Problems

• Automatic deployments from development environments to production without review.

• Absence of a staging (pre-production) environment.

• Developers having direct access to production databases.

• Insufficient quality controls and testing before releasing new versions.

Implementation Approach

To mitigate these risks, the company redesigns its deployment pipeline using DevSecOps principles:

• Strict separation of environments: development, testing, pre-production, and production isolated with different Azure subscriptions.

• Role-based access controls using Microsoft Entra ID.

• Implementation of staging environments to validate changes under production-like conditions.

• Controlled deployment flows using GitHub Actions and Azure DevOps with manual approval.

• Continuous Integration (CI) and automated tests (CD) before releasing any version.

• Proactive monitoring of each environment with Microsoft Defender for DevOps and Azure Monitor.

Defined Environment Types

• Development (Dev): Experimental environment with no access to real data.

• Testing (Test): Used by QA to validate functionalities.

• Staging (Preprod): Production replica for final testing.

• Production (Prod): Live operation with reinforced controls and minimal access.

Expected Outcome

The company successfully protects its production environment from unintentional errors, ensuring operational stability and service quality. New features are safely validated without disruptions for end users. Regulatory compliance, traceability, and development cycle efficiency are all improved.