Azure Penetration Testing: Workloads, Entra ID and Hybrid Identity

Azure penetration testing shows what an attacker could do with a foothold in your Azure estate, such as a leaked secret, a phished user or a vulnerable web app. We test your subscriptions and the Entra ID tenant that controls them, combining a configuration review with hands-on testing, and report every risk we can prove with the evidence and the fix. Microsoft secures the platform; this test covers what you build and configure on top of it.

For multi-cloud estates and Google Cloud, see our cloud penetration testing services; for Amazon Web Services, see AWS penetration testing.

What does an Azure penetration test cover?

An Azure penetration test covers identity, data, applications, containers and network exposure across the subscriptions you put in scope, plus the identity links between Azure and your on-premises network. We test only resources you own and authorise; Microsoft’s own infrastructure is out of scope.

Does Azure penetration testing include Entra ID?

Yes. Every Azure subscription trusts one Entra ID tenant, so a test that ignores identity misses where most cloud risk sits. We review who holds privileged directory roles such as Global Administrator and Privileged Role Administrator, which users, groups and applications hold Owner, Contributor or User Access Administrator rights in Azure, and whether Conditional Access and multi-factor authentication protect sign-ins to Azure management.

Hands-on, we start from an identity you give us, usually a standard user or a workload identity, and test whether its rights can reach something more valuable, such as a subscription, a secret or a production database. The report shows every path we prove, with the setting that breaks it.

If the same tenant runs your email and Teams, add a Microsoft 365 security assessment.

How do you test storage, Key Vault and secrets?

We check whether data and secrets can be reached by people who shouldn’t reach them, from the internet or from inside the tenant. For storage accounts that means network rules, anonymous access, account key use and how long shared access signatures last. For Key Vault it means the access model, network restrictions and which identities can read secrets, keys and certificates. We also hunt for secrets that never reached a vault, in app settings, scripts, templates or repositories.

How do you test App Service, Functions and AKS?

We test the platform settings around your applications, and the application code too if you include it. For App Service and Azure Functions that covers authentication, exposure of deployment and management endpoints, how app settings are protected, and what the app’s managed identity could reach if the app were compromised.

For Azure Kubernetes Service we review how the cluster API is exposed, how Entra ID and Kubernetes RBAC fit together, whether workloads run with more privilege than they need, how secrets reach pods, and who can push images to your container registry. The OWASP Kubernetes Top Ten is a good reference for the issue types we check.

How are network security groups and public endpoints tested?

We map what each subscription exposes to the internet and test it from outside, then review the rules that decide what can talk to what inside your virtual networks. That includes network security group rules, public IP addresses, management ports such as RDP and SSH, and services that should sit behind private endpoints but don’t.

If you use segmentation in Azure to keep a cardholder data environment separate, we test that the controls hold. That is the evidence PCI DSS Requirement 11.4.5 asks for every 12 months, and Requirement 11.4.6 every six months for service providers.

Can attackers move between Azure and on-premises Active Directory?

Yes. Entra Connect synchronises accounts from on-premises Active Directory to Entra ID, so the server that runs it, the service accounts it uses and any privileged accounts that exist in both directories join the two environments. Compromise on one side can lead to control of the other, which is why Microsoft advises protecting the Entra Connect server as carefully as a domain controller.

We review how hybrid identity is set up, whether cloud admin roles are held by synced accounts, how hybrid-joined devices and Azure-managed servers are controlled, and what your VPN or ExpressRoute links allow. To test the on-premises side as well, combine this with internal penetration testing of your Active Directory; our guide to Active Directory penetration testing explains what that covers.

Azure security assessment or penetration test: which do you need?

Most organisations need both, and we deliver them together in one engagement.

Defender for Cloud’s secure score is a useful starting point, but it measures policy compliance rather than proving what an attacker could do.

How does an Azure pentest run?

An Azure pentest runs in six steps, and Microsoft does not need to be told in advance.

1. Scoping. We agree the tenant, subscriptions, workloads and starting identities, then fix the price. Microsoft does not require notice before you test your own resources, but testing must follow its rules of engagement, which our guide to AWS and Azure penetration testing rules explains.
2. Access. You create the read-only roles and test identities we agreed.
3. Configuration review. We review the tenant and subscriptions at scale.
4. Hands-on testing. We confirm which findings are exploitable and test identity paths, exposed services and data access.
5. Report and debrief. We walk your team through the findings, the risk and the fixes.
6. Retest. Once you have fixed the findings, we retest and reissue the report showing them closed.

Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.

What do you receive after an Azure penetration test?

• An executive summary for non-technical stakeholders
• A technical report with each finding, evidence, reproduction steps, a CVSS rating and a prioritised fix
• Attack path write-ups showing how individual findings combine
• Configuration review results against the CIS benchmark
• A retest of fixed findings and an updated report
• An attestation letter for auditors and customers

Which compliance requirements does Azure testing support?

The NCSC’s penetration testing guidance is a good guide to what a well-scoped test and report should look like.

What affects the cost of an Azure penetration test?

Scope drives the price. We quote a fixed price once we know:

Why Sovereign Secure

• Compliance-grade reporting. We are a PCI SSC Qualified Security Assessor (QSA) company, a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028 and ISO 27001 certified, so reports are written to stand as audit evidence.
• One supplier for the whole estate. We also test web applications, APIs, networks, mobile apps and AI systems, and run red team exercises and vulnerability scanning.
• Fixed scope and price. The retest and its window are agreed in your proposal.
• Established UK company. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453) and is based at 16 Whalley Road, Accrington, Lancashire.

Get a fixed quote for Azure penetration testing

Tell us how many subscriptions you run, your main workloads (App Service, AKS, virtual machines, databases), whether you use hybrid identity and what is driving the test, such as PCI DSS, ISO 27001 or a customer request. Send it through our penetration testing quote form or call +44 161 523 5276, and we will come back with a fixed scope and price.