Azure penetration testing
Entra ID actor tokens, PRT replay, managed-identity over-privilege.
Entra ID actor-token impersonation (CVE-2025-55241), Primary Refresh Token replay via roadtx, device-code phishing through phantom device registration, managed-identity over-scope chained from IMDS SSRF, workload-identity federation issuer tampering, and Azure Monitor SSRF to token theft (CVE-2025-62207), tested by hand. Every finding ships with a working proof-of-exploit, code-level fix guidance, and a re-test.
Entra-first
Actor tokens, PRT replay, device-code phishing, tested against your tenant by hand.
Identity to Owner
Managed-identity over-scope and federation tampering chained to subscription Owner.
Re-test included
We verify your fixes at no extra cost. One engagement, closed loop.
The window from vulnerability discovery to exploitation has gone from weeks to hours.
Trusted by security teams across Fintech, SaaS & Education, Enterprise & Telecom, Security & Critical Infrastructure
On record
What we test
Six surfaces. Six named bug classes.
These are not generic categories, they are the primitives our Azure pentesters chain into engagement findings.
- Entra ID actor tokens
- Undocumented service-to-service actor tokens accepted by legacy AAD Graph without source-tenant validation, cross-tenant Global Admin (CVE-2025-55241).
- Primary Refresh Token replay
- Extract CloudAP-protected PRTs from a joined host, replay via roadtx to mint MSGraph tokens that satisfy MFA and conditional access.
- Device-code & CA bypass
- Device-code phishing chained with phantom-device DRS registration marks the attacker workstation compliant, conditional-access policy waved through.
- Managed identity over-privilege
- Workload SSRF reaches IMDS, lifts a system-assigned identity with Contributor at subscription scope, then pivots tenant-wide (CVE-2025-62207).
- Workload identity federation
- Swap the federated-credential issuer URL on an Entra app, persistent service-principal access without a stored secret, no rotation signal.
- Subscription & KeyVault RBAC
- Owner or User Access Administrator at subscription scope plus permissive KeyVault access policies, reveals secrets, cert private keys, AKV-stored SAS tokens.
Beyond config
One phish becomes tenant Owner.
Most Azure security tooling stops at the config-audit layer, checks IAM bindings, surfaces misconfigurations, emits a CSV. That's where a real pentest begins. A phished employee gives up a Primary Refresh Token; using roadtx and CloudAP, the pentester mints a fresh access token that satisfies MFA and conditional access because a phantom DRS registration makes the device look compliant. From an internal workload SSRF (the same primitive that produced CVE-2025-62207 in Azure Monitor), the team reaches IMDS and lifts a system-assigned Managed Identity scoped Contributor at the subscription. That identity rotates a KeyVault access policy, swaps the issuer on a privileged Entra app's Workload Identity Federation credential, and the chain closes at subscription Owner, the same class of trust abuse behind CVE-2025-55241. One starting credential, four primitives, tenant-wide compromise. Config audits don't catch chains; pentests do.
Meet your Azure lead
Hands on every Azure engagement.
John Dill
vCISO at SecureLayer7
15+
Years in offensive security
150+
Engagements led to date
99.99%
On-time engagement delivery
John scopes Azure engagements against your Entra tenant, subscription topology, and hybrid-identity boundary. He sits in the room from kick-off through findings review and re-test.
- Scopes Entra ID, conditional access, and managed-identity paths against your real risk model.
- Walks every AKS, Key Vault, and workload-identity finding live with your team.
- Drives remediation review and re-test until every tenant-wide path is closed.
Ready to scope an Azure pentest? Book 30 minutes with John to walk through your Entra tenant, subscription layout, and timeline.
Book a 30-min callAZURE PENTEST ENGAGEMENT.
How we run an Azure pentest. Tenant-wide, closed-loop.
Threat-modelled to your tenant, Entra graph, and subscription topology. Aligned with Microsoft's pentest rules-of-engagement, not a template we run against every cloud.
- 01Scope & rules-of-engagement
- 02Read-only access provisioning
- 03Tenant reconnaissance
- 04RBAC review
- 05Active exploitation
- 06Post-exploitation & blast-radius
- 07Reporting & remediation
- 08Re-test & closure
Insights
Azure security Resources.
Field notes on Entra ID abuse paths, Storage blob exposure, and managed-identity privilege drift, written by the reviewers who run Azure pentests.
Tested by industry.
The bug classes named below come from real engagements in each sector. Pick the closest fit.
Tech SaaS
Multi-tenant SaaS on Azure, Entra ID drift, conditional-access bypasses.
FinTech
Banking workloads on Azure, Key Vault boundaries, M365 + Defender attack paths.
HealthTech
HIPAA-aligned Azure tenants, PHI in Storage, Healthcare APIs on Azure.
Built for United Kingdom engagements
What changes when we deliver here.
Compliance scoping
NCSC Cloud Principle 9 identity-and-authentication mapping
Regulatory framework
FCA FG16/5 paragraph 4 outsourcing-access control evidence
Local engagements
UK insurer cleaned 312 Conditional Access gaps post-engagement
Local pricing
GBP per-tenant fee, fixed regardless of subscription count
Compliance scoping
NCSC CAF C1 monitoring-outcome detection coverage
Azure testing, UK detail.
Do you test Entra ID and PIM together?
Yes. Conditional Access bypass, dormant PIM eligible-role abuse and refresh-token theft sit in baseline scope. Findings cite Entra audit-log path.
How does this fit FCA FG16/5?
Cloud outsourcing under FG16/5 paragraph 4 — access, monitoring, exit. Each is a discrete finding section, signed by the engagement lead.
Can you test Sentinel and Defender for Cloud?
Detection-side testing — we trigger findings and check Sentinel rule fires. Detection gaps map to NCSC CAF C1 monitoring outcomes.
Where is tenant data held?
UK South tenancy default. Customer-managed keys, RBAC scoped to the engagement, deleted on close.
Delivery in United Kingdom
Azure pentest. Entra ID and PIM first.
Entra ID, PIM, Conditional Access and Storage findings mapped to NCSC Cloud Principle 9 and FCA FG16/5 paragraph 4. UK South region default.
- Direct line
- +44-20-0000-0000
- Office
- London, United Kingdom
Frameworks scoped: CREST · NCSC CAF · UK GDPR · PCI DSS · ISO/IEC 27001.
Sample engagement report
See what arrives in your inbox.
A pre-vetted Azure engagement sample: full vulnerability narrative, working proof-of-exploit traces, and Bicep, ARM, or Terraform fix guidance you can hand to your platform team. Sent on request after a 5-minute scoping call.