LIVE Threat Watch 40 actively exploited vulnerabilities in the last 30 days. Newest (10 Nov): CVE-2026-124194 in Microsoft Office See all live vulnerabilities
+44 1865 950 828 Secure Your Business
Azure Penetration Testing

Azure penetration testing that finds the attack paths in your cloud.

  • Could one compromised account take control of your Azure estate?
  • Which identities, roles and secrets give attackers the most reach?
  • What should your team fix first?

Cybergen® Azure penetration testing combines hands-on testing of Microsoft Entra ID, Azure RBAC and your workloads with configuration review, so you see both the gaps and how an attacker would chain them.

Every engagement is run within Microsoft's penetration testing rules of engagement and scoped around your subscriptions, services and risk.

Get my Azure pen test quote See what we test
CREST accredited: Penetration Testing

CREST accredited for penetration testingIndependently assessed for the quality of our methodology, people and processes.

AZURE ATTACK PATHIllustrative example
  1. Phished user with no MFA on a legacy protocolInitial access to the tenant
    MEDIUM
  2. User owns an app with a client secretActs as the app's service principal
    HIGH
  3. Service principal holds Contributor on a subscriptionControl of production resources
    HIGH
  4. Key Vault secret readable via the same identityDatabase credentials recovered
    MEDIUM
  5. Read access to the customer databaseBusiness impact demonstrated
    OBJECTIVE
Small identity and permission gaps add up. We show the chain, and the one change that breaks it.
Why it matters

Microsoft secures the cloud. You secure what you build in it.

Under the shared responsibility model, Microsoft protects the underlying platform. Your identities, permissions, data, network rules and workloads are yours to get right.

Most Azure breaches do not start with a zero-day. They start with a phished account, an over-privileged service principal, a forgotten SAS token or a secret left in a deployment. Azure penetration testing finds those gaps and shows how they connect.

We test as an attacker would, from the internet and from an assumed-breach position inside your tenant, and explain what we found in terms your engineers and leadership can act on.

WHAT YOU RECEIVE

Verified findings, attack-path evidence, prioritised fixes and retesting of the issues you close.

Cybergen helps you:

  • Find identity and Conditional Access gaps in Microsoft Entra ID.
  • Uncover privilege escalation paths across roles, subscriptions and managed identities.
  • Confirm what is really exposed to the internet.
  • Check whether sensitive data in storage and databases can be reached.
  • Find leaked secrets, keys and credentials before attackers do.
  • Produce evidence for ISO 27001, SOC 2, PCI DSS and customer security reviews.

Running AWS too? See our guide to cloud penetration testing in AWS, or ask us to scope both together.

What we test

What our Azure penetration testing covers

Choose the areas that matter to you, or let us scope the right mix for your environment.

Microsoft Entra ID and identity testing

Identity is the front door to Azure. We test how well it is locked.

We assess how your tenant's identities, roles and applications could be abused to gain or extend access, including:

  • Conditional Access gaps and MFA bypass conditions
  • Privileged role assignments and PIM configuration
  • App registrations, service principals and their credentials
  • Illicit consent grants and over-privileged API permissions
  • Guest and external collaboration settings
  • Password spray and legacy authentication exposure
YOU RECEIVE

A map of the identity paths that could lead to privileged access, with the specific changes that close them.

Request a quote for this area

Azure RBAC, subscription and management group review

Find the permissions that turn one compromised account into control of your estate.

We trace how role assignments across management groups, subscriptions and resource groups could be chained, looking at:

  • Owner, Contributor and User Access Administrator sprawl
  • Custom roles with dangerous actions
  • Managed identities with more access than they need
  • Automation accounts, runbooks and Logic Apps that run as privileged identities
  • Paths from Entra ID roles to Azure resource control
YOU RECEIVE

Privilege escalation paths with evidence, ranked by how easily they could be reached.

Request a quote for this area

External attack surface testing

See your Azure estate the way an attacker on the internet does.

We enumerate and test what is reachable from outside, including:

  • Public IP addresses, load balancers and Application Gateway
  • Management ports and remote access exposure
  • App Service, Functions and API Management endpoints
  • Misconfigured network security groups and firewall rules
  • Tenant and resource discovery through public DNS and metadata
YOU RECEIVE

A verified list of exposed services and the weaknesses an attacker could exploit from the internet.

Request a quote for this area

Storage and data exposure testing

Check whether sensitive data is one URL away from the internet.

We assess how data in your Azure estate could be reached or leaked, covering:

  • Anonymous blob access and public containers
  • Long-lived or over-permissive SAS tokens
  • Storage account keys and shared key access
  • Azure SQL, Cosmos DB and database firewall rules
  • Backups, snapshots and disk exports
YOU RECEIVE

Evidence of any data that could be reached without proper authorisation, and how to lock it down.

Request a quote for this area

Key Vault and secrets handling

Find the credentials that should never have been left where they are.

We look for secrets that could hand an attacker further access, including:

  • Key Vault access policies versus RBAC permissions
  • Secrets in app settings, ARM templates and deployment history
  • Credentials in VM extensions and custom script logs
  • Instance metadata (IMDS) abuse from compromised workloads
  • Certificate and key rotation weaknesses
YOU RECEIVE

Every exposed credential we find, where it was, what it unlocks and how to rotate and protect it.

Request a quote for this area

Workload, container and AKS testing

Test the systems your services actually run on.

We test the compute and container layer for routes to escape, escalate or move laterally, including:

  • Virtual machines and scale sets
  • Azure Kubernetes Service cluster and pod security
  • Azure Container Registry access and image hygiene
  • Network segmentation between workloads and private endpoints
  • Workload identities and their reach into other resources
YOU RECEIVE

Findings that show how a compromised workload could affect the rest of your environment.

Request a quote for this area

Hybrid identity and on-premises to cloud paths

Close the routes between your data centre and your cloud.

Where your Azure estate connects to on-premises systems, we assess:

  • Entra Connect and synchronisation accounts
  • Pass-through and federated authentication
  • Paths from on-premises Active Directory to cloud admin roles
  • Site-to-site VPN and ExpressRoute boundaries
  • Azure Arc-connected servers
YOU RECEIVE

A clear view of how a breach on one side could cross into the other, and how to stop it.

Request a quote for this area

DevOps pipeline and infrastructure-as-code review

Make sure the way you deploy to Azure is not the way an attacker gets in.

We review the pipelines and code that build and change your environment, including:

  • Azure DevOps and GitHub service connections
  • Pipeline secrets and variable groups
  • Bicep, ARM and Terraform templates for insecure defaults
  • Who can change pipelines and what they could deploy
YOU RECEIVE

Risks in your delivery chain, ranked by impact, with practical fixes for your engineering team.

Request a quote for this area

Azure configuration review

Benchmark coverage alongside hands-on testing.

Alongside testing, we can review your configuration against recognised baselines so nothing obvious is missed:

  • CIS Microsoft Azure Foundations Benchmark
  • Microsoft cloud security benchmark
  • Logging, Defender for Cloud and alerting coverage
  • Policy and governance controls
YOU RECEIVE

A prioritised configuration report that sits alongside the penetration test findings.

Request a quote for this area
Testing approach

Choose the right testing approach

Black box penetration testing

Testing begins with limited information about the target environment.

This shows what an external attacker could discover about your tenant and exploit from the internet.

INFORMATION SHARED

Grey box penetration testing

Testing begins with some access, such as a standard Entra ID user or a reader role on the subscriptions in scope (an assumed-breach starting point).

This allows more focused investigation of authenticated functionality, permissions and potential attack paths.

INFORMATION SHARED

White box penetration testing

Testing begins with detailed information, such as architecture diagrams, infrastructure-as-code templates and read access across the tenant.

This approach supports deeper assessment within the available testing time.

INFORMATION SHARED

We help select the approach that best answers your questions. The right choice depends on your objectives, environment and required depth of coverage.

Our process

How our Azure penetration testing works

  1. Scope the tenant and subscriptions

    We agree which tenant, subscriptions, resources and identities are in scope, what you most need answered and any services that need special care.

  2. Agree authorisation and rules of engagement

    We document permissions, test accounts, contacts and testing windows, and confirm the work sits within Microsoft's penetration testing rules of engagement.

  3. Enumerate identities and resources

    We map your Entra ID objects, role assignments, exposed services and resource relationships to find where attack paths could exist.

  4. Test and validate attack paths

    We test the weaknesses we find by hand and, where authorised, prove whether they can be chained into privilege escalation or data access.

  5. Report and debrief

    You receive an executive summary, technical evidence, attack-path narratives and remediation steps written for Azure engineers, followed by a debrief.

  6. Retest agreed fixes

    Once your team has made changes, we retest the agreed findings and confirm which are closed.

Scope your Azure penetration test
Reporting

An Azure pen test report your team can use

A useful report gives leadership a clear view of risk and gives technical teams enough detail to act.

Discuss reporting and deliverables
PENETRATION TEST REPORTCONTENTS
  1. Executive summaryAn accessible explanation of the key findings, potential business consequences and recommended priorities.
  2. Scope and assessment contextA record of the systems tested, approach taken, testing dates and relevant limitations.
  3. Technical findingsAffected assets, supporting evidence, reproduction details where appropriate and an explanation of potential impact.
  4. Risk prioritisationSeverity ratings supported by contextual analysis, including the access required and likely consequences of exploitation.
  5. Remediation guidancePractical recommendations to help your team address the identified weaknesses.
  6. Attack path narrativeWhere relevant, an explanation of how multiple weaknesses were combined to reach a more significant outcome.
  7. Retest resultsA record of whether agreed findings were resolved, partially addressed or remained reproducible.
Guides and insights

Read our expert guides

GUIDE · 9 MIN READAzure Penetration Testing: A Guide to the Top 5 Attack Vectors

The Azure weaknesses attackers exploit most often, and how to test for each one.

Read the guide GUIDE · 8 MIN READCloud Pentest Reporting: What to Show Clients and Why

What a useful cloud penetration test report should contain, and why it matters to your stakeholders.

Read the guide GUIDE · 14 MIN READHow Much Does a Penetration Test Cost? Pen Testing Prices for 2026

Realistic price ranges by test type and how to cut cost without cutting quality.

Read the guide
FAQs

Frequently asked questions about Azure penetration testing

Can't find your answer? Email [email protected].

Do we need Microsoft's permission to penetration test Azure?

No. Microsoft no longer requires you to notify it before testing your own Azure resources, but all testing must follow the Microsoft Cloud Unified Penetration Testing Rules of Engagement. These prohibit, for example, denial of service testing and any attempt to access other customers' data. We plan every engagement within those rules.

What does an Azure penetration test cover?

It depends on your scope. Most engagements include Microsoft Entra ID, Azure role-based access control, exposed services, storage, Key Vault and secrets, network boundaries and the workloads you run, such as virtual machines, App Service, Functions or AKS. Hybrid identity and DevOps pipelines can be added where they connect to your Azure estate.

Is an Azure penetration test the same as a configuration review?

No. A configuration review checks settings against a benchmark such as the CIS Microsoft Azure Foundations Benchmark or the Microsoft cloud security benchmark. A penetration test goes further and investigates whether weaknesses can be exploited and chained into an attack path. We often combine the two so you get both coverage and evidence of impact.

Can you test Microsoft Entra ID and Microsoft 365 as well?

Yes. Identity is the most common route into Azure, so we can assess Entra ID configuration, Conditional Access, privileged roles, app registrations, service principals and consent grants. Microsoft 365 services can be included where they share the same tenant and are in scope.

How much does an Azure penetration test cost?

Cost depends on the number of subscriptions, the services in use, the depth of identity testing and whether a configuration review is included. We scope this with you before quoting. Our penetration testing cost guide sets out typical price ranges.

Will testing disrupt our Azure services?

Testing is planned to avoid disruption. We agree the subscriptions, resources and techniques in scope, avoid denial of service and resource-exhausting activity, and set escalation contacts and testing windows before work starts.

What access do you need from us?

Usually a scoped set of test identities, such as a standard user and a reader role on the subscriptions in scope, plus written authorisation. For an assumed-breach or white box assessment we may ask for additional roles or architecture information. We confirm the exact requirements during scoping.

Is retesting included?

Your proposal sets out the retesting included, the findings covered and the timeframe. Retesting confirms that specific fixes have closed the weaknesses we reported.

Request a quote

Know where your Azure estate stands before an attacker tests it

Whether you need to test a single subscription, your Entra ID tenant or a full landing zone, Cybergen can help define the right scope.

Tell us roughly how many subscriptions you run, which services matter most and which assurance requirements you need to meet.

  1. Share your requirementsWhat needs testing, what has changed and any assurance needs.
  2. We confirm the scopeAssets, boundaries, approach and operational constraints.
  3. You receive a scoped proposalA clear engagement with defined deliverables and practical next steps.
Prefer to talk? Call +44 (0) 1865 950 828 Or email [email protected]

Request an Azure penetration testing quote

Tell us about the Azure environment you want tested. A security specialist will reply to discuss your scope.

Which areas of Azure? (choose any)
Also interested in (choose any)