Azure cloud security audit

In the cloud, most incidents do not come from a Microsoft flaw but from configuration: an overly broad role, a Conditional Access policy with a forgotten exclusion, open storage. I train teams on Azure architecture (AZ-305), and I apply the same lens to your tenant, from the attacker’s side.

What I assess

Identities: Privileged accounts, guests, MFA, Conditional Access and its exclusions.
Roles and permissions: Azure RBAC and Entra ID assignments, least privilege.
Applications: App registrations, consents, secrets and certificates.
Resources: Storage, key vaults, databases, virtual machines.
Network: Public exposure of resources and filtering.
Logging: What is logged and what would let you detect an incident.

How I work

Configuration review with a read-only account, plus targeted tests from a standard user account.
References: Microsoft recommendations, CIS Benchmarks for Azure and Microsoft 365.
Debrief that separates quick fixes from architecture work.

Full methodology and deliverable

What you get

A PDF report: executive summary, then one entry per vulnerability (proof, CVSS score, impact, fix).
A debrief meeting with your technical team.
A retest of your fixes, offered in the quote.

FAQ

Frequently asked questions

Do you cover AWS and GCP?

My main expertise is Azure and Entra ID, where I also teach. For AWS or GCP, I will tell you honestly during scoping whether your need fits my scope.

Is Microsoft Secure Score not enough?

Secure Score is a good starting point, but it rates settings one by one. The audit looks at how they combine, and what a compromised account would actually allow.

What access do you need?

An account with read rights on the tenant and relevant subscriptions, plus a standard user account for testing. No write access is needed for the configuration review.

Another question? Send me a message