Mitigations

Mitigations represent security concepts and classes of technologies that can be used to prevent a technique or sub-technique from being successfully executed.

ID	Name
MS-M7039	Avoid logging sensitive data
MS-M7030	Centralize logs to protected accounts
MS-M7043	Configure cost guardrails and spending alerts
MS-M7006	Deploy a web application firewall (WAF)
MS-M7011	Disable basic authentication
MS-M7036	Disable legacy metadata endpoints
MS-M7034	Enable versioning and recovery mechanisms
MS-M7009	Enforce code review and approval workflows
MS-M7019	Enforce credential rotation policies
MS-M7016	Enforce input validation and sanitization
MS-M7012	Enforce multi-factor authentication (MFA)
MS-M7031	Enforce strong password policies
MS-M7007	Follow secure coding practices
MS-M7005	Implement application security testing
MS-M7041	Implement backup and recovery plans
MS-M7002	Implement domain ownership verification
MS-M7017	Implement least-privilege access
MS-M7032	Implement rate limiting
MS-M7044	Implement resource quotas and concurrency limits
MS-M7014	Implement role-based access control (RBAC)
MS-M7010	Image assurance policy
MS-M7023	Install trusted extensions only
MS-M7004	Maintain up-to-date dependencies
MS-M7001	Remove DNS records on resource deletion
MS-M7022	Require approval for promotions
MS-M7028	Require session-based metadata access
MS-M7025	Require signed commits
MS-M7033	Restrict access to configuration endpoints
MS-M7015	Restrict access to event sources
MS-M7027	Restrict access to metadata services
MS-M7040	Restrict delete and write permissions
MS-M7042	Restrict deployment permissions
MS-M7021	Restrict environment management permissions
MS-M7029	Restrict logging configuration permissions
MS-M7013	Restrict network access to sensitive services
MS-M7037	Restrict outbound network access
MS-M7024	Restrict write access to code repositories
MS-M7008	Secure CI/CD pipelines
MS-M7045	Use compute reservations
MS-M7018	Use conditional access policies
MS-M7026	Use workload identities instead of static credentials
MS-M7038	Use parameterized queries
MS-M7035	Use private networking for service communication
MS-M7003	Use randomized service endpoints
MS-M7020	Use secrets management solutions