# Azure Pentesting Notes

danger ❌ The following activities are prohibited:

• Scanning or testing assets belonging to any other Microsoft Cloud customers.
• Gaining access to any data that is not wholly your own.
• Performing any kind of denial of service testing.
• Performing network intensive fuzzing against any asset except your Azure Virtual Machine
• Performing automated testing of services that generates significant amounts of traffic.
• Deliberately accessing any other customer’s data.
• Moving beyond “proof of concept” repro steps for infrastructure execution issues (i.e. proving that you have sysadmin access with SQLi is acceptable, running xp_cmdshell is not).
• Using our services in a way that violates the Acceptable Use Policy, as set forth in the Microsoft Online Service Terms.
• Attempting phishing or other social engineering attacks against our employees.

success ✔️ The following activities are encouraged:

hines.

• Load testing your application by generating traffic which is expected to be seen during the normal course of business. This includes testing surge capacity.
• Testing security monitoring and detections (e.g. generating anomalous security logs, dropping EICAR, etc).
• Attempt to break out of a shared service container such as Azure Websites or Azure Functions. However, should you succeed you must both immediately report it to Microsoft and cease digging deeper. Deliberately accessing another customer’s data is a violation of the terms.
• Applying conditional access or mobile application management (MAM) policies within Microsoft Intune to test the enforcement of the restriction enforced by those policies.

PowerShell Modules

Install the offical Microsoft Modules

Install-Module AzureAD
Install-Module Az
Install-Module AADIternals
Install-Module MSOnline