
You have obtained credentials for a low-privilege Azure AD user. Your goal is to reason through privilege escalation paths in the Azure environment.

**Identity & Role Analysis**
- What Azure AD roles, subscription roles (RBAC), and custom roles should you enumerate?
- How do Owner, Contributor, and User Access Administrator differ in exploitation potential?
- What does "privileged role administrator" allow you to do?

**Service Principal & App Registration Abuse**
- How can you abuse an app registration with high-privilege API permissions?
- What is the difference between delegated permissions and application permissions, and which is more dangerous?
- How do you add credentials to an existing service principal if you have the right permissions?

**Managed Identity Exploitation**
- What is a managed identity and when does it represent a privilege escalation vector?
- How do you query the IMDS endpoint from inside an Azure VM or Function App?
- If a VM's managed identity has Contributor on a subscription, what can you do next?

**Common Escalation Paths**
- Logic App → Key Vault → credentials
- Automation Account → RunAs Account → subscription access
- Function App with system-assigned identity → resource access

Constraints:
- Authorized assessment only
- For each path, reason about what evidence gets logged in Azure

Output:
- Escalation decision tree
- 3 most common real-world paths with step-by-step reasoning
- Detection indicators per path


Azure Privilege Escalation Paths


You are assessing an Azure environment for data exposure and secret leakage.

Develop a systematic hunting strategy for exposed data and credentials:

**Public Storage Blob Enumeration**
- How do you discover Azure Storage accounts associated with a target organization?
- What naming conventions are commonly used for storage accounts and containers?
- How do you test if a blob container is publicly accessible?
- What file types are highest value when found in exposed blobs?

**Key Vault Enumeration**
- If you have read access to a Key Vault, what should you look for?
- How do you determine which applications and identities have access to a Key Vault?
- What is the difference between vault access policies and RBAC for Key Vaults?

**Credential Leakage in Azure Resources**
- Where do developers commonly hard-code secrets in Azure? (App Service config, Function App env vars, ARM templates, DevOps pipelines)
- How do you extract environment variables from an App Service if you have Contributor access?
- How do you find connection strings and API keys stored as Azure App Settings?

**Automation & Pipeline Secrets**
- What secrets are typically stored in Azure DevOps pipelines and how do you access them?
- How do you extract secrets from Azure Automation Account runbooks?

Output:
- Discovery checklist ordered by ease of exploitation
- Common findings with business impact description
- Responsible disclosure notes for the report


Azure Storage & Secret Hunting


You are a penetration tester beginning an external Azure assessment. You have a target organization's domain name and potentially a set of valid email addresses.

Plan a structured Azure tenant reconnaissance campaign:

**Unauthenticated Enumeration**
- How do you confirm whether a domain uses Azure AD vs on-premises AD?
- What information can be extracted from login.microsoftonline.com endpoints without credentials?
- How do you enumerate valid users in a tenant without triggering lockouts?
- What does the tenant ID reveal and how do you find it?

**Post-Authentication Enumeration**
- Given a low-privilege user account, what is the first set of commands you run?
- How do you enumerate: subscription access, resource groups, app registrations, service principals?
- What roles does your current principal have, and what can each role do?

**Service Exposure Discovery**
- How do you identify publicly exposed Azure Storage blobs?
- What Azure services are most commonly misconfigured in real engagements?
- How do you find Azure Function Apps and Logic Apps that might expose internal logic?

Constraints:
- Authorized assessment only
- Reason about which techniques leave logs in Azure Monitor / Defender for Cloud

Output:
- Ordered recon checklist (unauthenticated → authenticated)
- Logging risk per technique
- Key misconfigurations to look for


Azure Tenant Reconnaissance


You have access to an Azure AD tenant during a penetration test and need to assess the effectiveness of Conditional Access Policies.

**Policy Enumeration & Gap Analysis**
- How do you enumerate all Conditional Access policies if you have Global Reader or Security Reader?
- What are the most common gaps in CA policy configurations?
- How do you identify applications, users, or platforms that are excluded from key policies?

**Bypass Techniques**
- If MFA is enforced on all apps, what legacy authentication protocols might bypass it?
- What is the significance of "legacy authentication clients" and how do you test for them?
- How does CA policy evaluation change when accessing from a compliant device vs a non-compliant one?
- What happens when a Named Location is misconfigured?

**Token Abuse**
- How can Conditional Access be bypassed using a Primary Refresh Token (PRT)?
- What is the difference between an access token and a refresh token from a CA bypass perspective?
- How do device compliance claims affect token issuance?

**Assessment Methodology**
- Build a matrix of all CA policies vs all applications — how do you identify coverage gaps?
- Which service accounts and break-glass accounts typically bypass MFA and why is that risky?

Output:
- Gap analysis framework (policy vs. app matrix approach)
- Top 5 CA bypass scenarios with conditions required
- Remediation recommendations


Cloud Azure

Azure Privilege Escalation Paths

Azure Storage & Secret Hunting

Azure Tenant Reconnaissance

Conditional Access Policy Analysis