Azure Cloud Penetration Testing

Yes. Microsoft's penetration testing rules of engagement no longer require pre-approval for testing your own Azure resources. You are permitted to conduct penetration testing against Azure resources you own without notifying Microsoft, provided you comply with their Acceptable Use Policy and the testing does not target Microsoft's shared infrastructure. Certain activities remain prohibited, including denial-of-service attacks against Azure infrastructure and testing cross-tenant resources you do not own. We are familiar with all Microsoft penetration testing guidelines and structure every engagement to operate within them.

Our Azure penetration testing covers the full Azure estate typically present in enterprise environments: Entra ID (Conditional Access, Privileged Identity Management, AD Connect, Password Hash Sync, Seamless SSO), Azure RBAC (management group, subscription, resource group, and resource-level assignments), Blob Storage (access policies, SAS tokens, public access, CMK encryption), Azure Functions (managed identity, binding configuration, secrets in application settings), AKS (RBAC, pod security, workload identity, admission controllers), Defender for Cloud (Secure Score, NSG rules, alert coverage), Key Vault (access policies versus RBAC mode, CMK key management), and Virtual Networks (Private Endpoint configuration, Azure Bastion, peering topology).

We operate on a read-only access model. Our testers require Reader role and Security Reader role at subscription scope. For Entra ID assessment, we require the Security Reader directory role. These roles provide read access to all resource configurations, RBAC assignments, and security settings without the ability to make changes. We never request Owner, Contributor, or any write-capable role. For hybrid identity assessment involving AD Connect, we may request read access to the on-premises Active Directory synchronisation configuration. All access is provisioned for the duration of the engagement and revoked upon report delivery.

Azure penetration testing starts from £3,750 for a single subscription environment with a standard Entra ID configuration. Multi-subscription environments or complex hybrid identity topologies (multiple AD Connect instances, federated identity providers, PIM extensively configured) typically cost £7,000 to £12,000. Pricing is fixed and confirmed after a scoping call. We do not charge by the day for cloud assessments; pricing reflects the scope of services, subscriptions, and identity configuration complexity.

Defender for Cloud is a continuous configuration monitoring tool. It scans your Azure environment against a set of known-good configuration benchmarks and flags deviations as recommendations. It tells you that a storage account has public access enabled. It does not tell you whether that storage account contains sensitive data, whether an attacker could chain that misconfiguration with an over-permissioned managed identity to pivot to another subscription, or whether the Conditional Access bypass path through legacy authentication provides a route to that same storage account. Azure penetration testing chains these misconfigurations into realistic attack paths, demonstrates actual exploitability, and produces evidence that satisfies compliance auditors. Defender for Cloud Secure Score is an input to our engagement, not a substitute for it.