Azure Tenant Reconnaissance

You are a penetration tester beginning an external Azure assessment. You have a target organization's domain name and potentially a set of valid email addresses.

Plan a structured Azure tenant reconnaissance campaign:

**Unauthenticated Enumeration**
- How do you confirm whether a domain uses Azure AD vs on-premises AD?
- What information can be extracted from login.microsoftonline.com endpoints without credentials?
- How do you enumerate valid users in a tenant without triggering lockouts?
- What does the tenant ID reveal and how do you find it?

**Post-Authentication Enumeration**
- Given a low-privilege user account, what is the first set of commands you run?
- How do you enumerate: subscription access, resource groups, app registrations, service principals?
- What roles does your current principal have, and what can each role do?

**Service Exposure Discovery**
- How do you identify publicly exposed Azure Storage blobs?
- What Azure services are most commonly misconfigured in real engagements?
- How do you find Azure Function Apps and Logic Apps that might expose internal logic?

Constraints:
- Authorized assessment only
- Reason about which techniques leave logs in Azure Monitor / Defender for Cloud

Output:
- Ordered recon checklist (unauthenticated → authenticated)
- Logging risk per technique
- Key misconfigurations to look for