Cybersecurity
Azure security
Azure security is tied tightly to Microsoft Entra ID. We review the cloud resources and the identities that control them together, because attackers cross between the two.
The problem this service solves
Azure has two permission systems: Entra ID roles for the directory, and Azure RBAC for resources. Many environments have powerful assignments in both, plus legacy service principals with secrets that never expire. An attacker who compromises an application registration or a managed identity can often reach more than the application owner expects.
We look at both systems together, then at the network, data and logging layers they protect.
What is in scope
-
Tenant and subscription structure
Management groups, subscription ownership, guest access and policy inheritance.
-
Azure RBAC and Entra roles
Owner and contributor assignments, custom roles, PIM usage, role escalation paths.
-
Applications and service principals
Secrets and certificates, permissions to Graph and Azure, consent grants and ownership.
-
Managed identities
Assignments, scope and the workloads that can use them.
-
Network security
NSGs, firewalls, Private Link, public endpoints, peering and DNS.
-
Data
Storage account access, Key Vault access models, SQL and Cosmos DB exposure.
-
Logging and detection
Activity logs, diagnostic settings, Defender for Cloud plans and Sentinel connections.
-
Governance
Azure Policy, blueprints or landing zone patterns, tagging and ownership.
How the work runs
Collect
Gather configuration.
-
1
Reader access
Use read-only roles at the management group level.
-
2
Automated baseline
Run benchmark and posture checks, then validate manually.
Analyze
Map privilege.
-
3
Identity relationship graph
Show how users, groups, service principals and managed identities can reach resources.
-
4
Review high-risk areas
Key Vault access, automation accounts, deployment pipelines.
Improve
Prioritize.
-
5
Remediation plan
Sequenced changes, including Azure Policy to prevent regression.
What you receive
- Executive summary
- Findings by subscription
- Privilege relationship analysis
- Service principal and managed identity review
- Azure Policy recommendations
- Logging and detection recommendations
- Retest
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Reader access at tenant root or management group
- Directory reader for identity review
- Architecture overview and sensitive data inventory
What this service is not
- A licensing review
- Microsoft 365 administration
What changes afterwards
- Service principals and managed identities have clear owners and limited reach
- Policy prevents common misconfigurations
- Logs flow to a central workspace with usable retention
Questions people ask
Do you cover Microsoft 365 as well?
Entra ID and the identity aspects of Microsoft 365 are covered in our Entra security service. This service focuses on Azure resources.
Do you use Microsoft Defender for Cloud?
We review how you use it and what it reports. We do not require a specific plan, and we advise on which plans are useful for your risks.
Related
-
Microsoft Entra security
Review Conditional Access, privileged roles, application consent, authentication methods, sync and monitoring in Microsoft Entra ID.
-
Cloud penetration testing
Starting from a defined foothold, test whether identity, permission and trust paths in AWS, Azure or Google Cloud lead to sensitive data or control.
-
SIEM consulting
Architecture, data onboarding, cost control and migration for Microsoft Sentinel, Splunk, Elastic and Google Security Operations.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response