Capability

Azure and cloud posture

Azure estates accumulate exposure quietly. Nobody decides to leave a management port open, it just ends up that way.

Cloud posture problems are rarely dramatic. They are a subscription somebody stood up for a proof of concept in 2022 that still holds production data, a service principal with Contributor across the tenant because scoping it properly was hard on the day, and a set of Azure Policy assignments that audit diligently and enforce nothing.

What we assess

  • Defender for Cloud. Which plans are enabled, which recommendations have been open longest, and what your regulatory compliance coverage genuinely looks like.
  • Access and RBAC. Standing Owner and Contributor assignments, subscription sprawl, and service principals holding considerably more than the job needs.
  • Policy and guardrails. What is enforced against what is audit-only, plus every exemption, who granted it, and whether it was ever meant to be permanent.
  • Exposure. Public endpoints, storage reachable from anywhere, and management ports open to the internet.
  • Secrets and keys. Credentials in code or pipeline variables, certificates approaching expiry, and Key Vault access that is broader than it looks.
  • Landing zone drift. Whether the guardrails designed at the start are still in place, or have been worked around since.

What we do

  • Defender for Cloud enablement and recommendation triage, so the list becomes a work queue rather than a wall of noise
  • Azure Policy reworked into real guardrails, with the audit-only assignments either enforced or removed
  • RBAC redesign and Privileged Identity Management for Azure resources, replacing standing access with just-in-time
  • Network exposure reduction, including the storage accounts and management ports that should never have been public
  • Key and secret management, moving credentials into Key Vault with rotation that actually happens
  • Landing zone remediation, bringing existing subscriptions back to the standard you designed

Found: A storage account holding database backups was reachable from any network, protected by a shared access signature with no expiry that had been issued to a contractor eighteen months earlier.

Fixed: Public network access removed in favour of a private endpoint, the signature revoked, and a policy assignment added that prevents storage accounts being created with public access enabled.

Nobody made a bad decision here. It was a reasonable temporary arrangement that outlived the reason for it, which describes most of what we find in Azure.

The rest of the stack

This does not sit on its own

The findings that matter most usually cross between these areas. We look at all of them, whether or not that is what you asked us to look at.

Identity

Identity and access

Entra ID, Conditional Access, privileged access, authentication methods, guest access and app consent. If an attacker gets in, this is almost always how.

Learn more → Detection

Threat protection and detection

Defender across endpoint, identity and Office 365, and Microsoft Sentinel. Coverage, tuning, detection quality, and what your log ingestion is actually costing you.

Learn more → Data

Data protection and endpoint

Purview sensitivity labels, DLP and retention, plus Intune, device compliance and endpoint hardening. Protecting the data itself, and the devices it lands on.

Learn more →

Want a look at your azure and cloud posture?

An assessment can be scoped to this area alone, or to the whole estate. Tell us what is worrying you and we will tell you which is worth paying for.

Get in touch