Wholesale · IT holding of a group of companies · 30,000 users

Azure security baseline and CSPM for a wholesale group's IT holding with 30,000 users

Shelves in a wholesale warehouse holding copper fittings and brass valves in bins, the aisle receding into the distance.

Users: 30,000
Duration: since December 2025
Role: Security and cloud architecture
Platforms: Azure, AKS, CrowdStrike

Situation

The IT holding of a wholesale group provides cloud services for the group’s companies, around 30,000 users in total. Workloads run on Azure, containerised applications on Azure Kubernetes Service (AKS). The holding wanted one security baseline for the whole group, a central view of the cloud security posture and support for its existing Blue Team in cloud detection.

Approach

WCS has supported the holding in security and cloud architecture since December 2025.

Baseline and CSPM: a group-wide Azure security baseline. AKS and Azure Container Registry are connected to CrowdStrike Falcon Cloud Security as the central cloud security posture management (CSPM) platform for misconfigurations, vulnerabilities and workload risks. Self-hosted registries are covered by Self-Hosted Registry Assessment, and the Falcon Admission Controller runs on AKS.
Pipelines: image scanning, runtime protection and policy enforcement in CI/CD, plus a CSPM concept with responsibilities, escalation paths and reporting.
Infrastructure as code: everything in Terraform, with separate state in GitLab and user-assigned managed identities.
Entra ID, since September 2026: a baseline with custom roles for the Blue Team and platform operations instead of highly privileged built-in roles. Permanent privileged assignments were replaced with just-in-time activation in PIM, and a least-privilege analysis includes rights inherited through nested groups. The baseline is anchored in the ISMS.

Result

The group’s companies work to one baseline for Azure and Entra ID. The CSPM concept states who is responsible for what and how issues are escalated, and reporting runs through defined channels. Administrative rights are granted for a limited time and only as far as the role requires. WCS works within the group’s existing Blue Team on cloud detection and incident handling, and training for the security, platform and DevOps teams gives them the knowledge to run these controls themselves.