Consulting · Microsoft 365 & Azure
Cloud security assessment for Microsoft 365 and Azure
An in-depth security analysis of your Microsoft cloud: we find misconfigurations in Microsoft 365 and Azure before attackers do, and show concrete measures for hardening.
Configuration check
Tenant: beispiel-gmbh.at
Scope Microsoft 365 · Entra ID · Azure
| Control | Finding | Status |
|---|---|---|
| Legacy authenticationEntra ID | Enabled, basic auth bypasses MFA | critical |
| MFA for admin rolesEntra ID | 3 privileged accounts without MFA | critical |
| Guest accessEntra ID | Guests can invite further guests | high |
| Conditional AccessEntra ID | Exclusions for entire user groups | high |
| Storage accountsAzure | Anonymous read access to a container | high |
| External sharingSharePoint | Anyone links without expiry | medium |
| Unified audit logMicrosoft 365 | Enabled, 90-day retention | medium |
| Defender for Office 365Exchange Online | Safe Links and Safe Attachments enabled | ok |
- 2 critical
- 3 high
- 2 medium
- 1 ok
Overview
What is a cloud security assessment?
In Microsoft 365 and Azure, configuration decides who can access what. The assessment evaluates it from an attacker's point of view: which setting actually opens a path, and which measure closes it?
The cloud security assessment by snapSEC GmbH from Vorchdorf, Austria (also known as a cloud risk assessment) combines a security review, a misconfiguration audit and pentest elements for Microsoft 365 and Azure. It examines identities, permissions, logging and sharing, and shows where misconfigurations open attack paths. Mid-sized and large companies in Austria, Germany and Switzerland receive a report with risk ratings, attack vectors and hardening measures.
At a glance
Cloud Security Assessment- Platforms
- Microsoft 365 (Exchange Online, SharePoint, Teams, Entra ID) and Microsoft Azure
- Method
- Security review, misconfiguration audit and pentest elements, with optional active attack simulation
- Access
- We agree the access and roles required with you during scoping
- Result
- Report with a risk rating per finding, attack vectors and hardening measures
- For whom
- Mid-sized and large companies that run Microsoft 365 and Azure in production and do not want to leave their security to chance
- Provider
- snapSEC GmbH, Vorchdorf (Upper Austria), for companies in Austria, Germany and Switzerland
Scope
What we check in your cloud
In the Microsoft cloud, identities, permissions and sharing decide who can access what. Misconfigurations there open paths that a traditional network pentest does not see.
Microsoft 365 & Entra ID
Identities, email and sharing
How accounts sign in, who holds which rights and what is shared externally decide who gets into your tenant.
- Account and identity security: MFA, Conditional Access, legacy authentication, guest access
- Over-privileged users, shadow administrators and inactive accounts
- Audit logs and unified audit logging: activation and configuration
- Exchange Online Protection and Defender for Office 365
- Sharing policies in OneDrive and SharePoint: external links, link types, expiry
Microsoft Azure
Roles, resources and network
In Azure we check who can control resources, how keys and data are protected and whether access is logged.
- Azure RBAC: role assignments and privilege-escalation paths
- Key Vaults, storage accounts, managed identities and access policies
- Network security groups, firewalls and access control
- Logging and monitoring: Azure Monitor, Log Analytics, Microsoft Defender for Cloud
- Service principals and app registrations: exposed credentials and permissions
Add-on · optional
Active attack simulation
On request we do not only check misconfigurations statically, but simulate how an attacker would exploit them.
- Token theft, credential replay, consent phishing and MFA bypass where misconfigured
- Abuse of OAuth applications and orphaned enterprise apps
- Privilege escalation through gaps in Conditional Access policies
- Attacks on hybrid configurations: AD sync and pass-through authentication
Shared responsibility model
What Microsoft secures and what you configure
Microsoft runs the platform securely. How identities, permissions and sharing are configured, however, is up to you. That is exactly where the assessment focuses.
The cloud security assessment evaluates the configuration on your side of the responsibility boundary.
You are responsible for
- Identities, MFA and Conditional Access policies
- Permissions, roles and app registrations
- Sharing, email protection and logging configuration
Assessment scope
Microsoft is responsible for
- Data centres and physical security
- Availability and patching of the platform services
- Security of the underlying infrastructure
Result
Clear advice, not raw data
You do not get a tool export but an interpreted report that your team can work with straight away.
The report contains
- A risk rating per finding, prioritised by criticality
- Technical details and concrete attack vectors
- Practical measures to harden your environment
- Optionally a presentation and walkthrough with your IT team
Report · excerpt
Cloud security assessment
beispiel-gmbh.at
- M365-01
Legacy authentication enabled
- Risk
- critical
- Attack vector
- Password spraying via basic authentication, bypassing MFA
- Remediation
- Block legacy authentication with Conditional Access
- M365-02
Admin accounts without MFA
- Risk
- critical
- Attack vector
- Takeover of a privileged account with a single stolen password
- Remediation
- Enforce phishing-resistant MFA for all admin roles
- M365-03
Unrestricted guest access
- Risk
- high
- Attack vector
- Guests invite further external accounts and gain access to Teams and files
- Remediation
- Restrict guest invitations to authorised roles and review them regularly
Process
How a cloud security assessment works
We scope the assessment individually and agree each step with your team, including which access the configuration analysis needs.
Scoping
Together we define which tenants and subscriptions are in scope and whether the active attack simulation is included.
Access
You provide the agreed access. We clarify exactly which roles those are in advance.
Configuration analysis
We examine identities, permissions, logging and sharing in Microsoft 365, Entra ID and Azure.
Attack simulation (optional)
On request we actively exploit misconfigurations to demonstrate real attack paths.
Report and walkthrough
You receive the report with risk ratings, attack vectors and hardening; on request we walk your IT team through it.
FAQ
Questions about the assessment
What exactly do you check in Microsoft 365 and Azure?
In Microsoft 365 and Entra ID we check identities, permissions, logging, email protection and sharing: MFA, Conditional Access, legacy authentication, guest access, over-privileged and inactive accounts, unified audit logging, Exchange Online Protection and Defender for Office 365. In Azure we look at RBAC and privilege-escalation paths, Key Vaults, storage, managed identities, network security groups, logging and monitoring, and service principals and app registrations.
Is this a penetration test?
Partly: it combines a security review and a misconfiguration audit with elements of a penetration test. The focus is on analysing configuration and permissions. Active attack simulations such as token theft, credential replay, consent phishing or MFA bypass where misconfigured are available as an add-on. If you need a conventional network or web pentest, our penetration testing service is the right fit; the two combine well.
What access do you need for the assessment?
Which access and roles are needed depends on the scope and is set out transparently during scoping. For the optional active attack simulation we agree the framework separately. We confirm the exact role model with you before we start, so you can always see what we have access to.
Do you also check hybrid environments?
Yes. Many organisations run Microsoft 365 alongside an on-premises Active Directory. As part of the optional attack simulation we examine hybrid configurations, in particular directory synchronisation (AD sync) and pass-through authentication. These interfaces are a popular attack path, because a compromised local account or a manipulated sync service can have effects reaching into the cloud. For deep Active Directory analysis our penetration testing service is a useful addition.
How does this differ from continuous cloud checks with blacklens.io?
The cloud security assessment is a deep, manual snapshot with attack simulation and an interpreted report. blacklens.io, the platform of snapSEC GmbH, checks your cloud accounts continuously and automatically, for example for vulnerabilities and misconfigurations, and makes changes over time visible. The two complement each other: the assessment provides the thorough initial evaluation, and the platform keeps the state under review afterwards.
How do you run the assessment without disrupting operations?
By planning every step in advance and agreeing it with your team. Which access the configuration analysis needs and what is checked is set during scoping. For the optional active attack simulation we agree the scope, time window and contacts in advance, so it is always clear what is being tested. We document the approach transparently. That keeps the assessment predictable for your team.
Who carries out the cloud security assessment?
The assessment is carried out by the consulting team of snapSEC GmbH from Vorchdorf, Austria. Our team brings more than 20 years of experience in IT security. That is why we do not just check configurations against recommendations but assess them from an attacker's point of view: which misconfiguration actually opens a path, and which measure closes it most effectively?
Do we get support implementing the measures?
Yes. The report contains concrete, prioritised hardening measures that your team can implement directly. On request we walk through the results together and prioritise the next steps. For ongoing monitoring of your cloud accounts you can then use blacklens.io; if you also need 24/7 detection and response, the Active Cyber Defense Center (ACDC) is the right next step.
Read on
Related services
First conversation
Get your Microsoft cloud into a secure state.
We analyse your Microsoft 365 and Azure environment efficiently and thoroughly and show you where to start.
Destination: snapSEC, Vorchdorf
Asamerstraße 1b
4655 Vorchdorf, Austria 47°59′ N · 13°55′ E
Personal, without obligation and confidential.