u/Secret-Pop-9230

What are people using to harden Linux and Windows servers in Azure that are Entra ID joined only?

I'm looking for a sensible way to apply baseline hardening policies/Settings in a production environment without having to build everything from scratch. In the past, I've always just used Microsoft's baseline GPOs, but obviously that's not really an option here.

I've already applied the Azure security baseline, but as far as I can tell it only audits the settings. I can't find a way to actually remediate or enforce the baseline.

Just interested in hearing what people are using in the real world and what's worked well.