A full-spectrum Azure cloud infrastructure security assessment of AzureVault Analytics — a data analytics and business intelligence platform running entirely on Microsoft Azure. We found everything from publicly accessible Blob Storage containers leaking customer datasets to a Global Admin account with no MFA. CIS Azure Foundations Benchmark compliance: 9%. SOC2 coverage: 12%.
AzureVault Analytics operates a fully Azure-native BI and data analytics platform serving 180 enterprise customers across financial services and retail. Their stack runs on Azure subscriptions managed through Azure DevOps, with data workloads in Azure SQL, Blob Storage, and Azure Functions — all orchestrated through AKS. The engagement began with a read-only Azure AD role handoff. Within 3 hours, we had identified customer analytics datasets leaking from a public Blob Storage container with anonymous read access enabled.
The most alarming discovery wasn't a single misconfiguration — it was the complete absence of identity controls and detection infrastructure. Zero Conditional Access policies in Azure AD. Microsoft Defender for Cloud disabled at the subscription level. No Azure Activity Log forwarded to any SIEM. AzureVault's Global Admin account — the highest-privilege identity in the tenant — had no MFA configured. A single phishing email to the right address would hand an attacker irrecoverable full tenant control.
Across three days of assessment, we mapped every misconfiguration, demonstrated live data exposure from the public Blob container, and documented the Service Principal privilege escalation path: a service principal with Owner rights on the subscription could trivially modify any resource, exfiltrate any secret from Key Vault, and delete production infrastructure. The Key Vault had soft-delete disabled — meaning accidental or malicious key deletion would be permanent and unrecoverable.
Every major Azure service in the AzureVault stack had at least one critical misconfiguration. This is what the infrastructure looked like from an attacker's perspective.
8 Critical, 9 High, 8 Medium. Every finding maps to CIS Azure Foundations Benchmark controls, SOC2 trust service criteria, and NIST 800-53 control families.
azurevault-customer-exports and azurevault-analytics-reports containers had anonymous access set to Blob, allowing any unauthenticated HTTP request to enumerate and download every analytics report, dashboard export, and customer dataset. 180 enterprise customers' proprietary BI data was publicly readable.Set anonymous access to None on all storage containers immediately. Enable the "Allow Blob public access" block at the storage account level. Use Shared Access Signatures (SAS) with expiry or Azure AD-based authorization for all application access.
Enable MFA on the Global Admin account immediately — use Microsoft Authenticator app or a hardware FIDO2 key. Create a Conditional Access policy requiring MFA for all privileged roles. Consider creating a dedicated break-glass account with hardware key stored physically, and remove the Global Admin role from daily-use accounts.
0.0.0.0/0 on TCP port 22 (SSH) and 9 NSGs allowed 0.0.0.0/0 on TCP port 3389 (RDP). Every associated VM is directly reachable from the internet for brute-force and credential-stuffing attacks around the clock.Remove all inbound rules allowing 0.0.0.0/0 on ports 22 and 3389. Use Azure Bastion for all VM administrative access — it provides browser-based SSH/RDP over TLS 443 without exposing management ports. If direct SSH is required, restrict source IPs to specific corporate NAT ranges.
Disable the public endpoint on all Azure SQL servers and switch to Private Endpoint access via Azure Private Link. Add a firewall rule denying all public IP access (Deny all). Enforce Azure AD-only authentication and disable SQL authentication. Use Managed Identity for application connections.
Owner role assigned directly on the production subscription. Owner provides full control — read and write to all resources, manage role assignments, and modify identity configurations. Any compromise of the DevOps pipeline (e.g., via a supply chain attack or malicious commit) would grant an attacker subscription-level administrative access.Replace the Owner role assignment with a custom role scoped to the minimum permissions the pipeline actually requires (e.g., deploy to specific resource groups, not the entire subscription). Use Azure RBAC conditions where available. Rotate the service principal credentials and enable Managed Identity for Azure-hosted pipeline agents.
Enable soft-delete (90-day retention) and purge protection on all Key Vault instances immediately. Purge protection prevents permanent deletion even by administrators during the retention window. Note: these settings cannot be disabled once enabled — which is intentional by design.
Create baseline Conditional Access policies: (1) Require MFA for all users, (2) Require MFA for all privileged roles, (3) Block legacy authentication protocols, (4) Require compliant device for access to sensitive data. Use Azure AD Identity Protection risk-based policies to automatically require step-up auth on anomalous sign-ins.
Attach an NSG to every VM NIC and every subnet with a default-deny inbound rule. Remove public IP assignments from VMs that do not need direct internet access — use Azure Load Balancer or Application Gateway for inbound traffic. Audit all public IP assignments using Azure Policy.
Rotate both access keys for all storage accounts immediately. Enable Azure Key Vault key rotation policy for automatic rotation. Migrate all applications to use Managed Identity or SAS tokens with expiry instead of storage account keys. Azure Policy can flag storage accounts using key-based auth.
terraform.tfstate) was stored in an Azure Blob container with no blob versioning enabled and no state locking via Azure Cosmos DB or equivalent. Terraform state contains a plaintext map of all infrastructure: resource IDs, managed identity client IDs, Key Vault URIs, database FQDNs, and any sensitive output values. Without locking, concurrent pipeline runs can corrupt state. Without versioning, corrupted or deleted state is unrecoverable.Enable blob versioning and soft-delete on the state storage container. Implement state locking using an Azure Cosmos DB backend or Terraform Cloud remote state. Store the state storage account access key in Key Vault — never in pipeline environment variables or source code.
Enable TDE on all Azure SQL databases immediately — it can be toggled in the Azure portal with no downtime. Migrate from service-managed keys to customer-managed keys (CMK) stored in Key Vault for full cryptographic control. Enable TDE by default on all new databases via Azure Policy.
Update the Application Gateway SSL policy to AppGwSslPolicy20220101 (TLS 1.2 minimum, TLS 1.3 preferred). Disable all cipher suites below 128-bit strength. Apply the same policy to any Azure Front Door or API Management endpoints.
@azurevault.io email without authentication failures — enabling external phishing attacks against AzureVault's enterprise customers using the company's own domain for credibility.Add SPF record to the sending domain's DNS: v=spf1 include:sendgrid.net ~all. Enable DKIM signing in the Azure Communication Services domain settings and add the DKIM CNAME records to DNS. Enable DMARC with policy p=reject after verifying DKIM/SPF alignment.
Create Azure Cost Management budgets at the subscription level with alert thresholds at 80% and 100% of expected monthly spend. Enable anomaly detection alerts. Set up daily cost export to a Log Analytics Workspace for trend monitoring. A $5,000 single-day spike is a reliable cryptomining signal that should trigger immediate investigation.
Three frameworks govern Azure cloud security. AzureVault's pre-assessment scores reflect an organization that has never run a formal cloud security review — and was using Azure's default configurations throughout.
A screen-share walkthrough of the AzureVault findings — service by service, finding by finding. Coming soon to the Sentinel Stacks video channel.
Each use case covers a different industry, stack, and threat profile. All findings are realistic and reference-able for sales conversations.
If your team uses Blob Storage, Azure AD, Azure SQL, AKS, or Azure Functions — your environment may have findings like these. Run a free cloud audit or schedule a full Azure security assessment.