The Sitecore hardening guide describes this in detail. All tasks can be found [here][1].

An overview of all hardening measured for each role has been documented over there, together with an example whether or not it has been implemented on PaaS or via SIF:

example:

**Applies to**: All [core roles][2]

**Sitecore Installation Framework**: Administrator password parameter available (SitecoreAdminPassword). In 9.0.2 and earlier, SIF does not enforce changing the administrator password. In 9.1 and later, SIF will generate a random password if you do not change the default value.

**Azure Toolkit**: Administrator password is changed by default - enforced by ARM template.

**Edit:**
In regards to the comment below: [Disable "script" and "execute" permissions][3]

find your handler node in the `<system.webServer> section`:

`<system.webServer>
  <modules>...</modules>
  <handlers>...</handler>
`

and change the handler entry to the following:
`<handlers accessPolicy="Read, Write">`

this is change that the IIS manager makes to the web.config when applying that specific change. Other IIS manager specific changes can made as well. What I did?

I made all the changes and used winmerge as comparison tool to see what changes had been made to the web.config and applied those changes to my Azure deployment.
  



  [1]: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/security-tasks.html
  [2]: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/roles-overview.html
  [3]: https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/secure-the-file-upload-functionality.html