The Sitecore hardening guide describes this in detail. All tasks can be found [here][1].

An overview of all hardening measured for each role has been documented over there, together with an example whether or not it has been implemented on PaaS or via SIF:

example:

**Applies to**: All [core roles][2]

**Sitecore Installation Framework**: Administrator password parameter available (SitecoreAdminPassword). In 9.0.2 and earlier, SIF does not enforce changing the administrator password. In 9.1 and later, SIF will generate a random password if you do not change the default value.

**Azure Toolkit**: Administrator password is changed by default - enforced by ARM template.


  [1]: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/security-tasks.html
  [2]: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/roles-overview.html