Azure security

Azure security assessment, from the edge and from inside.

Azure spreads a single tenant's attack surface across subscriptions, resource groups, Entra directories, and a dozen distinct URL patterns. Skydra treats that spread as a feature of the discovery, not a bug — probes find exposed resources regardless of which subscription hosts them.

Create a workspace Compare clouds

Blob and dfs storage access
Function and Logic App URL probes
Entra ID and RBAC audit
Key Vault and APIM posture

Two complementary surfaces

URL probes and tenant audits.

Outside-in

What a public URL pattern reveals.

Blob storage URLs (.blob.core.windows.net) — anonymous read, listing, SAS leak detection
DFS URLs (.dfs.core.windows.net) — Data Lake Gen2 posture
Function app URLs (.azurewebsites.net) and code deploy exposure
Logic App callback URLs with embedded signatures
Static Web App URLs — misconfigured auth and private previews
Container Registry URLs (.azurecr.io) — anonymous image pull
Automation Runbook webhook URLs
API Management invocation posture
SCM (Kudu) endpoints exposed on App Service

Inside-tenant

What an auditor-level read sees.

Entra ID posture — guest invitations, admin roles, service principals
Role assignments and inherited scope
Blob storage access tier, firewall rules, lifecycle policies
Key Vault access policies, soft-delete, purge protection
Cosmos DB keys and firewall rules
Azure Functions configuration and app settings
App Service: ARR affinity, FTP deployment, HTTPS-only
Service Bus authorization rules
Container Registry replication, admin user, webhook subscriptions
Azure OpenAI deployments and content filters

Named detectors

Each check is a real file in the action catalog.

Identity

azure.audit
ARM resource posture across the subscription
azure.audit_graph
Microsoft Graph: users, groups, applications, directory roles
azure.key_vault
Key Vault access policies, RBAC, soft-delete, purge protection

Storage

azure.blob_url
Pattern-match Blob and SAS URLs; test anonymous read and listing
azure.blob_cors
CORS misconfiguration on blob storage containers
azure.dfs_url
Data Lake Gen2 URL patterns and access
azure.cosmos
Cosmos DB firewall rules, keys, read regions, replicas

Compute and functions

azure.app_service
App Service plan, FTP, SCM, HTTPS-only, auth integration
azure.functions
Function app config, environment variables, host.json
azure.function_code_url
Exposed .zip code deploy URLs
azure.scm
SCM/Kudu endpoint exposure
azure.swa_url
Static Web App preview URLs

APIs, events, DevOps

apim.invoke
API Management invocation posture
azure.logic_app_sig_url
Logic App callback URL with signature leak
azure.automation_webhook_url
Automation Account webhook token leak detection
azure.devops
Azure DevOps organization visibility and pipeline exposure
azure.search
Azure Cognitive Search index access and query key exposure
azure.openai
Azure OpenAI deployment configuration and content filter audit

A representative runbook

Azure posture across every subscription in the tenant.

azure-tenant-sweep.runbook (pseudo)

inputs:
  tenant: CloudAccount

steps:
  subscriptions:
    action: azure.list_subscriptions
    with: { tenant: inputs.tenant }

  audit:
    action: azure.audit
    forEach: subscriptions.output.items
    with: { subscription: item.id }
    maxConcurrency: 4

  storage_exposure:
    action: azure.blob_url
    forEach: audit.output.findings.filter(item.kind == "Microsoft.Storage/storageAccounts")
    with: { url: item.resource.primaryEndpoints.blob }

  summarise:
    action: slack.post
    condition: storage_exposure.output.findings ne []
    with:
      channel: "#security-ops"
      summary: templates.azure_posture.render(audit.output, storage_exposure.output)

Azure's resource hierarchy — tenant / subscription / resource group / resource — maps to the engine's forEach directly. Nothing special was built for Azure; the engine's existing fan-out is what the runbook composes from.

Known edges

What we are not pretending to do.

Azure's security surface is enormous, and no honest coverage claim leaves out the gaps.

Microsoft Defender for Cloud integration is not shipped. Skydra audits configuration itself; Defender alerts live in their own channel.
Entra Conditional Access policy evaluation is read-only — Skydra enumerates policy, but does not simulate token issuance against them.
App Service traffic analysis (slot swap integrity, deployment slot leakage) is partial — audited at the configuration layer, not at the deployment-pipeline layer.
Azure Policy evaluation is not an inside-channel. Skydra reads policy assignments and reports non-compliance at the resource layer, independent of Policy state.
Azure RBAC path solver (what-if role assignments granting Owner across subscription boundaries) is on the roadmap, not the current build.

Point Skydra at your Azure tenant.

A least-privileged read-only service principal is all the inside audit needs. The outside probes refuse to run against hosts outside the workspace scope.

Create a workspace See GCP coverage