Azure penetration testing
Entra ID actor tokens, PRT replay, managed-identity over-privilege.
Entra ID actor-token impersonation (CVE-2025-55241), Primary Refresh Token replay via roadtx, device-code phishing through phantom device registration, managed-identity over-scope chained from IMDS SSRF, workload-identity federation issuer tampering, and Azure Monitor SSRF to token theft (CVE-2025-62207), tested by hand. Every finding ships with a working proof-of-exploit, code-level fix guidance, and a re-test.
Entra-first
Actor tokens, PRT replay, device-code phishing, tested against your tenant by hand.
Identity to Owner
Managed-identity over-scope and federation tampering chained to subscription Owner.
Re-test included
We verify your fixes at no extra cost. One engagement, closed loop.
The window from vulnerability discovery to exploitation has gone from weeks to hours.
Trusted by security teams across Fintech, SaaS & Education, Enterprise & Telecom, Security & Critical Infrastructure
On record
What we test
Six surfaces. Six named bug classes.
These are not generic categories, they are the primitives our Azure pentesters chain into engagement findings.
- Entra ID actor tokens
- Undocumented service-to-service actor tokens accepted by legacy AAD Graph without source-tenant validation, cross-tenant Global Admin (CVE-2025-55241).
- Primary Refresh Token replay
- Extract CloudAP-protected PRTs from a joined host, replay via roadtx to mint MSGraph tokens that satisfy MFA and conditional access.
- Device-code & CA bypass
- Device-code phishing chained with phantom-device DRS registration marks the attacker workstation compliant, conditional-access policy waved through.
- Managed identity over-privilege
- Workload SSRF reaches IMDS, lifts a system-assigned identity with Contributor at subscription scope, then pivots tenant-wide (CVE-2025-62207).
- Workload identity federation
- Swap the federated-credential issuer URL on an Entra app, persistent service-principal access without a stored secret, no rotation signal.
- Subscription & KeyVault RBAC
- Owner or User Access Administrator at subscription scope plus permissive KeyVault access policies, reveals secrets, cert private keys, AKV-stored SAS tokens.
Beyond config
One phish becomes tenant Owner.
Most Azure security tooling stops at the config-audit layer, checks IAM bindings, surfaces misconfigurations, emits a CSV. That's where a real pentest begins. A phished employee gives up a Primary Refresh Token; using roadtx and CloudAP, the pentester mints a fresh access token that satisfies MFA and conditional access because a phantom DRS registration makes the device look compliant. From an internal workload SSRF (the same primitive that produced CVE-2025-62207 in Azure Monitor), the team reaches IMDS and lifts a system-assigned Managed Identity scoped Contributor at the subscription. That identity rotates a KeyVault access policy, swaps the issuer on a privileged Entra app's Workload Identity Federation credential, and the chain closes at subscription Owner, the same class of trust abuse behind CVE-2025-55241. One starting credential, four primitives, tenant-wide compromise. Config audits don't catch chains; pentests do.
Meet your Azure lead
Hands on every Azure engagement.
John Dill
vCISO at SecureLayer7
15+
Years in offensive security
150+
Engagements led to date
99.99%
On-time engagement delivery
John scopes Azure engagements against your Entra tenant, subscription topology, and hybrid-identity boundary. He sits in the room from kick-off through findings review and re-test.
- Scopes Entra ID, conditional access, and managed-identity paths against your real risk model.
- Walks every AKS, Key Vault, and workload-identity finding live with your team.
- Drives remediation review and re-test until every tenant-wide path is closed.
Ready to scope an Azure pentest? Book 30 minutes with John to walk through your Entra tenant, subscription layout, and timeline.
Book a 30-min callAZURE PENTEST ENGAGEMENT.
How we run an Azure pentest. Tenant-wide, closed-loop.
Threat-modelled to your tenant, Entra graph, and subscription topology. Aligned with Microsoft's pentest rules-of-engagement, not a template we run against every cloud.
- 01Scope & rules-of-engagement
- 02Read-only access provisioning
- 03Tenant reconnaissance
- 04RBAC review
- 05Active exploitation
- 06Post-exploitation & blast-radius
- 07Reporting & remediation
- 08Re-test & closure
Insights
Azure security Resources.
Field notes on Entra ID abuse paths, Storage blob exposure, and managed-identity privilege drift, written by the reviewers who run Azure pentests.
Tested by industry.
The bug classes named below come from real engagements in each sector. Pick the closest fit.
Tech SaaS
Multi-tenant SaaS on Azure, Entra ID drift, conditional-access bypasses.
FinTech
Banking workloads on Azure, Key Vault boundaries, M365 + Defender attack paths.
HealthTech
HIPAA-aligned Azure tenants, PHI in Storage, Healthcare APIs on Azure.
Built for United Arab Emirates engagements
What changes when we deliver here.
Compliance scoping
Findings cite UAE IAS v2 T8 + CIS Azure benchmark rows
Regulatory framework
ADGM cloud guidance mapping for FSRA-regulated tenants
Local engagements
Tested an ADGM family office Azure estate ahead of FSRA review
Local pricing
AED quotes; UAE North + Central testing keeps data local
Compliance scoping
Entra ID Conditional Access and PIM coverage in default scope
Azure UAE questions enterprises ask.
Are UAE North and Central both covered?
Yes. Subscriptions in either region test in one window. Findings list region per resource. Federal Decree-Law 45/2021 residency stays intact.
Which Entra ID checks run?
Conditional Access gaps, legacy auth, app-registration consent abuse, and PIM role elevation. Findings cite UAE IAS v2 T8 identity sub-controls.
Does the test touch Microsoft 365?
Only with scope. M365 surface is a separate engagement letter. ADGM data subjects are flagged before any mailbox or SharePoint check.
Is Microsoft notified?
Microsoft does not require notice for most services. We log the test for your record so ADGM Financial Services Regulatory Authority reviewers see it.
Delivery in United Arab Emirates
Azure UAE North + Central. UAE IAS T8.
Entra ID, Sentinel, Defender, and Storage findings cite UAE IAS v2 T8 and ADGM cloud guidance. The test runs from UAE-resident jump hosts.
- Direct line
- +971-4-123-4567
- Office
- Dubai, UAE
Frameworks scoped: UAE IAS · NESA · ADHICS · PCI DSS · ISO/IEC 27001.
Sample engagement report
See what arrives in your inbox.
A pre-vetted Azure engagement sample: full vulnerability narrative, working proof-of-exploit traces, and Bicep, ARM, or Terraform fix guidance you can hand to your platform team. Sent on request after a 5-minute scoping call.