The Sitecore hardening guide describes this in detail. All tasks can be found here.

An overview of all hardening measured for each role has been documented over there, together with an example whether or not it has been implemented on PaaS or via SIF:

example:

Applies to: All core roles

Sitecore Installation Framework: Administrator password parameter available (SitecoreAdminPassword). In 9.0.2 and earlier, SIF does not enforce changing the administrator password. In 9.1 and later, SIF will generate a random password if you do not change the default value.

Azure Toolkit: Administrator password is changed by default - enforced by ARM template.

The Sitecore hardening guide describes this in detail. All tasks can be found here.

An overview of all hardening measured for each role has been documented over there, together with an example whether or not it has been implemented on PaaS or via SIF:

example:

Applies to: All core roles

Sitecore Installation Framework: Administrator password parameter available (SitecoreAdminPassword). In 9.0.2 and earlier, SIF does not enforce changing the administrator password. In 9.1 and later, SIF will generate a random password if you do not change the default value.

Azure Toolkit: Administrator password is changed by default - enforced by ARM template.

Edit: In regards to the comment below: Disable "script" and "execute" permissions

find your handler node in the <system.webServer> section:

<system.webServer> <modules>...</modules> <handlers>...</handler>

and change the handler entry to the following: <handlers accessPolicy="Read, Write">

this is change that the IIS manager makes to the web.config when applying that specific change. Other IIS manager specific changes can made as well. What I did?

I made all the changes and used winmerge as comparison tool to see what changes had been made to the web.config and applied those changes to my Azure deployment.