Close an Azure Security Lab: Evidence Pack, Cost, Cleanup

A security project is finished when two things are true: the people who asked for it have evidence, and nothing you built keeps costing money or becomes a forgotten target. Part 12 closes the SC-500 lab for Pragati Logistics.

Step 1: The evidence pack

Defender for Cloud, Overview: the security posture card shows one critical recommendation left, zero attack paths, no overdue recommendations, and the secure score. Then Regulatory compliance, Download report: standard ISO 27001, format PDF.

Step 2: The cost proof

On the resource group, Cost analysis: a few hundred rupees for the whole course lab, against a ₹3,500 budget. The biggest items were the Application Gateway, the VM, the AI gateway and the firewall, each deleted the same day. Defender plans ran on free trials.

Step 3: Delete in the right order

1. Check that no locks remain; a lock blocks the delete.
2. Delete resource group, type its name, Delete. Do the same for any second group (the EASM group).
3. Clean the soft-deleted items: Foundry and API Management keep a soft-deleted copy you can purge.
4. Subscription level: custom policies, custom roles, and switch the Defender plans off before their trials bill.

Step 4: The one thing that stays

Key vaults, Manage deleted vaults: kv-sc500-pragati is still there, in soft delete, with a scheduled purge date. Because purge protection is on, Azure refuses every purge request, from us and from an attacker with admin rights. It disappears by itself after the retention period, and a deleted vault costs nothing.

What a tech lead should take away

• Boards want three facts: zero attack paths, the high-risk list, and the compliance report.
• One resource group per project makes the cost proof and the cleanup one step each.
• Plan for soft delete: some services keep a copy, and purge protection means waiting by design.