Azure Penetration Testing
Find What Microsoft Defender Misses.

Microsoft Entra ID (formerly Azure Active Directory) is the authentication backbone of every Azure environment and the primary target for cloud-focused attackers. We test every stage of the identity attack chain — from initial access through privilege escalation to lateral movement across tenants.

Entra ID Attack Techniques We Test

• Password spray attacks — testing for weak passwords across the tenant while staying below lockout thresholds, using techniques that bypass Smart Lockout
• Token theft and replay — extracting and reusing OAuth tokens, refresh tokens, and Primary Refresh Tokens (PRT) to maintain persistent access
• Application consent abuse — exploiting OAuth consent flows to grant malicious applications access to user data, mailboxes, and Azure resources
• Conditional Access bypass — identifying gaps in Conditional Access policies that allow authentication from untrusted locations, unmanaged devices, or legacy protocols
• Privilege escalation through role assignments — testing for overprivileged users, excessive Global Admin accounts, and dangerous role combinations that enable vertical escalation
• Cross-tenant access exploitation — testing B2B collaboration settings, guest user permissions, and cross-tenant synchronization for unauthorized access paths

Azure Storage accounts are frequently the ultimate target of cloud attacks — they contain the data attackers want. Misconfigured storage access is one of the most common findings in Azure security assessments.

• Blob container enumeration — discovering publicly accessible containers, anonymous access misconfigurations, and overly permissive SAS tokens that expose sensitive data
• Storage account key exposure — testing for leaked access keys in code repositories, environment variables, application settings, and key vault references
• Shared Access Signature abuse — testing SAS token scope, expiration, IP restrictions, and whether overprivileged SAS tokens can be used to escalate access
• Data exfiltration testing — demonstrating whether an attacker with limited access can exfiltrate data from storage accounts, databases, or file shares through legitimate Azure APIs
• Encryption verification — confirming encryption at rest (customer-managed keys vs. platform-managed), encryption in transit enforcement, and key rotation policies

Azure Functions, Logic Apps, and container services (AKS, Container Instances) introduce attack surfaces that traditional infrastructure testing does not address.

• Azure Functions exploitation — testing for injection vulnerabilities in function inputs, overprivileged managed identities, environment variable exposure, and insecure function key management
• Logic App abuse — testing for insecure trigger URLs, connector credential exposure, workflow manipulation, and data leakage through integration connectors
• AKS cluster testing — Kubernetes-specific testing including RBAC bypass, pod escape, secret enumeration, container image vulnerabilities, and network policy enforcement
• Container escape testing — attempting to break out of containerized workloads to access the underlying host, adjacent containers, or the Kubernetes control plane
• API Management testing — testing API gateways for authentication bypass, rate limit evasion, subscription key exposure, and backend API direct access

Azure virtual networking provides segmentation capabilities, but misconfigured NSGs, overpermissive peering, and hybrid connectivity gaps create lateral movement opportunities.

• Network Security Group analysis — testing for overly permissive inbound/outbound rules, service tag misuse, and rules that allow broader access than intended
• VNet peering exploitation — testing whether peered networks provide unintended access paths between workloads that should be isolated
• ExpressRoute and VPN testing — assessing hybrid connectivity for routing leaks, split tunneling risks, and on-premises-to-cloud lateral movement paths
• Private Endpoint verification — confirming that PaaS services (Storage, SQL, Key Vault) are only accessible through private endpoints and not through public internet paths
• Azure Firewall and WAF bypass — testing web application firewall rules, Azure Firewall policies, and DDoS protection configurations for bypass techniques

Defense contractors and government agencies using Azure Government (GCC/GCC High) face unique penetration testing requirements under CMMC and DFARS 252.204-7012. As a CMMC Registered Practitioner, Craig Petronella understands the specific controls that assessors evaluate.

• CMMC practice validation — testing the specific security controls required by CMMC Level 2, with findings mapped to the 110 NIST 800-171 practices that CMMC assessors evaluate
• CUI boundary testing — verifying that Controlled Unclassified Information (CUI) is properly segmented, encrypted, and access-controlled within the GCC High environment
• Conditional Access and FIPS compliance — testing authentication controls, encryption requirements, and boundary protections specific to GCC High environments
• Cross-environment isolation — verifying that commercial Azure and GCC/GCC High environments are properly isolated with no data leakage paths or authentication crossover
• Audit logging verification — confirming that security events are properly logged, retained, and protected from tampering as required by NIST 800-171 AU controls