We have setup a Paas enviroment with Sitecore 9.0.1 XP scaled. The problem is that Sitecore login and admin tools are available on the Content Delivery server. My understanding is that Security hardening should be done by default on the Paas.
The role is defined as ContentDelivery in webconfig The package used is Sitecore 9.0.1 rev. 171219 (Cloud)_cd.scwdp.zip
Does anyone know where the Security hardening should take place? Is it in the Arm templates or should it be done by PS scripts?