The Sitecore hardening guide describes this in detail. All tasks can be found here.
An overview of all hardening measured for each role has been documented over there, together with an example whether or not it has been implemented on PaaS or via SIF:
example:
Applies to: All core roles
Sitecore Installation Framework: Administrator password parameter available (SitecoreAdminPassword). In 9.0.2 and earlier, SIF does not enforce changing the administrator password. In 9.1 and later, SIF will generate a random password if you do not change the default value.
Azure Toolkit: Administrator password is changed by default - enforced by ARM template.