Azure penetration testing
Entra ID actor tokens, PRT replay, managed-identity over-privilege.
Entra ID actor-token impersonation (CVE-2025-55241), Primary Refresh Token replay via roadtx, device-code phishing through phantom device registration, managed-identity over-scope chained from IMDS SSRF, workload-identity federation issuer tampering, and Azure Monitor SSRF to token theft (CVE-2025-62207), tested by hand. Every finding ships with a working proof-of-exploit, code-level fix guidance, and a re-test.
Entra-first
Actor tokens, PRT replay, device-code phishing, tested against your tenant by hand.
Identity to Owner
Managed-identity over-scope and federation tampering chained to subscription Owner.
Re-test included
We verify your fixes at no extra cost. One engagement, closed loop.
The window from vulnerability discovery to exploitation has gone from weeks to hours.
Trusted by security teams across Fintech, SaaS & Education, Enterprise & Telecom, Security & Critical Infrastructure
On record
What we test
Six surfaces. Six named bug classes.
These are not generic categories, they are the primitives our Azure pentesters chain into engagement findings.
- Entra ID actor tokens
- Undocumented service-to-service actor tokens accepted by legacy AAD Graph without source-tenant validation, cross-tenant Global Admin (CVE-2025-55241).
- Primary Refresh Token replay
- Extract CloudAP-protected PRTs from a joined host, replay via roadtx to mint MSGraph tokens that satisfy MFA and conditional access.
- Device-code & CA bypass
- Device-code phishing chained with phantom-device DRS registration marks the attacker workstation compliant, conditional-access policy waved through.
- Managed identity over-privilege
- Workload SSRF reaches IMDS, lifts a system-assigned identity with Contributor at subscription scope, then pivots tenant-wide (CVE-2025-62207).
- Workload identity federation
- Swap the federated-credential issuer URL on an Entra app, persistent service-principal access without a stored secret, no rotation signal.
- Subscription & KeyVault RBAC
- Owner or User Access Administrator at subscription scope plus permissive KeyVault access policies, reveals secrets, cert private keys, AKV-stored SAS tokens.
Beyond config
One phish becomes tenant Owner.
Most Azure security tooling stops at the config-audit layer, checks IAM bindings, surfaces misconfigurations, emits a CSV. That's where a real pentest begins. A phished employee gives up a Primary Refresh Token; using roadtx and CloudAP, the pentester mints a fresh access token that satisfies MFA and conditional access because a phantom DRS registration makes the device look compliant. From an internal workload SSRF (the same primitive that produced CVE-2025-62207 in Azure Monitor), the team reaches IMDS and lifts a system-assigned Managed Identity scoped Contributor at the subscription. That identity rotates a KeyVault access policy, swaps the issuer on a privileged Entra app's Workload Identity Federation credential, and the chain closes at subscription Owner, the same class of trust abuse behind CVE-2025-55241. One starting credential, four primitives, tenant-wide compromise. Config audits don't catch chains; pentests do.
Meet your Azure lead
Hands on every Azure engagement.
John Dill
vCISO at SecureLayer7
15+
Years in offensive security
150+
Engagements led to date
99.99%
On-time engagement delivery
John scopes Azure engagements against your Entra tenant, subscription topology, and hybrid-identity boundary. He sits in the room from kick-off through findings review and re-test.
- Scopes Entra ID, conditional access, and managed-identity paths against your real risk model.
- Walks every AKS, Key Vault, and workload-identity finding live with your team.
- Drives remediation review and re-test until every tenant-wide path is closed.
Ready to scope an Azure pentest? Book 30 minutes with John to walk through your Entra tenant, subscription layout, and timeline.
Book a 30-min callAZURE PENTEST ENGAGEMENT.
How we run an Azure pentest. Tenant-wide, closed-loop.
Threat-modelled to your tenant, Entra graph, and subscription topology. Aligned with Microsoft's pentest rules-of-engagement, not a template we run against every cloud.
- 01Scope & rules-of-engagement
- 02Read-only access provisioning
- 03Tenant reconnaissance
- 04RBAC review
- 05Active exploitation
- 06Post-exploitation & blast-radius
- 07Reporting & remediation
- 08Re-test & closure
Insights
Azure security Resources.
Field notes on Entra ID abuse paths, Storage blob exposure, and managed-identity privilege drift, written by the reviewers who run Azure pentests.
Tested by industry.
The bug classes named below come from real engagements in each sector. Pick the closest fit.
Tech SaaS
Multi-tenant SaaS on Azure, Entra ID drift, conditional-access bypasses.
FinTech
Banking workloads on Azure, Key Vault boundaries, M365 + Defender attack paths.
HealthTech
HIPAA-aligned Azure tenants, PHI in Storage, Healthcare APIs on Azure.
Built for Singapore engagements
What changes when we deliver here.
Compliance scoping
MAS TRM Cloud Annex identity-clause mapping
Regulatory framework
PDPA §26 cross-border check on geo-redundancy
Local engagements
Healthcare CII — closed conditional-access bypass before HealthTech audit
Local pricing
SGD per-tenant band with subscription-count tiers
Compliance scoping
CCoP 2.0 §6 identity-management evidence on every report
Azure pentest questions from SG buyers.
How is Entra ID tested for MAS TRM Cloud Annex fit?
We exercise conditional-access bypasses, app-consent abuse, and guest-account paths against the Cloud Annex identity and access clauses MAS examiners read.
Do you cover Southeast Asia region residency?
Yes. We verify Storage, SQL, and Key Vault are pinned to Southeast Asia and flag any geo-redundancy that crosses PDPA §26 cross-border lines.
Does the report cite CCoP 2.0 §6 identity controls?
Yes. Each identity finding maps to CCoP 2.0 §6 control text so CII operators can attach the audit pack to their CSA sectoral submission.
Will you test M365 and Azure together?
Yes. We follow the trust between Entra tenants, M365 apps, and Azure subscriptions, including service-principal sprawl across Defender for Cloud findings.
Delivery in Singapore
Azure AD + MAS TRM Cloud Annex.
Azure test inspects Entra ID, conditional access, and subscription guardrails against MAS TRM Cloud Annex and CSA CCoP 2.0 §6 identity-management expectations.
- Direct line
- +65-6000-0000
- Office
- Singapore
Frameworks scoped: MAS TRM · PDPA · PCI DSS · ISO/IEC 27001.
Sample engagement report
See what arrives in your inbox.
A pre-vetted Azure engagement sample: full vulnerability narrative, working proof-of-exploit traces, and Bicep, ARM, or Terraform fix guidance you can hand to your platform team. Sent on request after a 5-minute scoping call.