# Azure Security Best Practices
The below list introduces the best Practices for Azure Security.
- MFA should be enabled on accounts with read permissions on your subscription
- External accounts with read permissions should be removed from your subscription
- Non-internet-facing virtual machines should be protected with network security groups
- Access to storage accounts with firewall and virtual network configurations should be restricted
- Qualys guard and Cylance endpoint protection software should be installed on all the ability virtual machines
- Storage accounts should be migrated to new Azure Resource Manager resources
- Virtual machines should be migrated to new Azure Resource Manager resources
- All the security updates should be installed on Virtual machines