Securing ILAP Analytics

The ILAP Analytics installation deploys functional Azure resources only; hardening them to your corporate security standards is your responsibility as the operator. This page lists the network- and access-level measures you can apply to lock down the infrastructure after deployment. It is written for the IT administrator responsible for the environment.

In order to make the Ilap Analytics infrastructure more secured there are a few things you could do

• Put all the resources within a organization virtual network.
• Stop public network access for resources like database server and blob storage.
• Enable private endpoint access for the resources.
• Introduce Application gateway.
• Stop direct public network access to the analytics UI and analytics API so that the users have to use the application gateway to access them.
• Allow outgoing TCP on port 443 to timephasing.promineo.com from the Background Jobs Api to allow for timephasing of schedule data.

For a worked, deployable example of these measures — a reference Bicep template (virtual network, private endpoints, optional WAF/firewall/Bastion), plus how to limit sign-ins and require known devices — see Securing ILAP Analytics — reference example. It is an example only; each company is responsible for its own protection.