Azure Adversary Ops: Offensive Playbook

Course Details

Who is it for?

This course is designed for professionals responsible for assessing, defending, or architecting Microsoft Azure environments, including:

• Cloud administrators and architects
• Penetration testers and red teamers
• CSIRT/SOC analysts and engineers/blue teams
• Developers
• Security/IT managers and team leads

The training is suitable for anyone with a direct stake in Azure security—from hands-on practitioners to decision-makers who need a deeper understanding of cloud attack surfaces. The curriculum blends Azure misconfigurations, identity abuse, and advanced cloud exploitation techniques, enabling attendees to effectively identify, validate, and communicate real security gaps in enterprise cloud environments.

Through a structured, offensive testing methodology and hands-on labs, participants gain practical experience in discovering, exploiting, and interpreting Azure security risks. These skills directly translate to day-to-day penetration testing, red team operations, and defensive validation, including environments hosting AI workloads or exposed APIs.

To ensure participants get maximum value from the course, the following baseline is recommended:

• Basic to intermediate knowledge of cybersecurity (1.5+ years’ experience)
• Familiarity with command-line tooling, including Azure CLI

Top 3 Takeaways

• Execute full kill-chain exploitation across Azure services, chaining weaknesses in Azure Resource Manager, Azure DevOps, and identity layers to demonstrate realistic privilegeescalation paths and understand how attackers traverse interconnected cloud workloads.
• Master high-fidelity enumeration techniques, including the use of AI-assisted tooling (such as our Graphunter-based workflows), to rapidly uncover misconfigurations, insecure identities, and exposed assets within Azure environments.
• Deeply understand Microsoft Entra ID weaknesses, including misconfigured roles, app registrations, and advanced techniques for bypassing Conditional Access Policies to achieve unauthorized access or escalate privileges.

What You Will Learn

This course uses a Defence by Offense methodology built on real-world red-team engagements and offensive research—not theory. Every technique demonstrated has been used and validated in live environments and can be immediately applied in real assessments. By the end of the course, you will be able to:

• Adopt the mindset and workflow of a modern threat actor, mapping attacker objectives to Azure-specific tradecraft.
• Identify and exploit advanced misconfigurations across Microsoft Azure, including identity, resource, network, and automation layers.
• Design penetration tests that mirror real adversarial behavior, using attacker-grade tooling, reconnaissance methods, and post-exploitation techniques.
• Understand the attack surface created by core Azure services, including virtual machines, storage accounts, containers/Kubernetes, service principals, serverless functions, and CI/CD pipelines.
• Leverage AI where it truly matters in cloud pentesting, such as accelerating enumeration, analysis, and attack-path discovery through AI-assisted tools and workflows.

What You Will be Doing

This is a highly hands-on, operator-focused course. You will spend the majority of your time in live labs, practicing real offensive techniques:

• Engaging in lab-driven exercises for ~70% of the course, following attacker workflows end-toend.
• Exploring and compromising lifelike Azure environments, simulating enterprise-grade cloud deployments.
• Executing offensive, defensive, and auditing techniques across identity, compute, storage, and automation services.
• Participating in a Capture the Flag (CTF) challenge to validate your skills under realistic constraints.
• Reviewing case studies based on real-world breaches, understanding the operational impact and defensive lessons from each exploitation path.

Why it is Relevant

The cybersecurity skills shortage is felt perhaps nowhere as deeply as in the cloud. With new rulebooks and standards, practitioners often find themselves playing catch up with the latest developments in technology and in the threat landscape. This course is designed to be a highly informative boot camp to help you advance your skills in the most important and relevant areas of cloud security. Across 2 days, you’ll learn about the high-impact misconfigurations and flaws that could be open in your organization right now and how to fix them.

Our syllabuses are revised regularly to reflect the latest in-the-wild hacks, the newest system releases, and whatever proof of concepts we’ve been developing in our own research. Because they remain so up to date with the threat landscape and security industry standard, many delegates return every 1-2 years to update their skills and get a refresh.

Details of the course content:

Note: Our syllabuses are subject to change based on new vulnerabilities found and exploits released.

INTRODUCTION TO AZURE AND CLOUD COMPUTING

This module introduces the core concepts of cloud computing, emphasizing the importance of security. It explores the shared responsibility model, comparing cloud security with traditional models. Additionally, it sheds light on the significance of cloud metadata APIs from an attacker's perspective. This module lays the groundwork for a deeper understanding of cloud security and its unique challenges.

• Introduction to the Cloud
• Importance of Cloud Security
• Importance of Cloud Metadata API from an Attacker’s perspective
• Introduction to the Azure

CLOUD ASSET ENUMERATION FOCUSING AZURE ENVIRONMENT

This module will explore DNS-based Enumeration techniques, gaining insights into identifying cloud assets through DNS records.

The module then delves into "OSINT Techniques for Cloud Asset Enumeration," equipping participants with open-source intelligence methods to uncover valuable information. Additionally, it covers "Username Enumeration using Cloud Provider APIs," and Leaked database empowering attendees to utilize cloud provider APIs to enumerate usernames effectively.

• Importance of DNS in the Cloud
• DNS-based Enumeration
• Open-Source Intelligence Gathering (OSINT) techniques for Cloud Asset Enumeration
• Username enumeration using Cloud provider APIs and Leaked Database

AZURE STORAGES

This module culminates with a focus on securing Azure's Shared Access Signature (SAS) URLs. Attendees will gain the knowledge and skills to secure their cloud storage effectively, avoiding common pitfalls and optimizing data protection in these cloud environments.

• Introduction to Azure Storage
• Azure: Shared Access Signature (SAS) URL Misconfiguration

ATTACKING MICROSOFT AZURE RESORUCE MANAGER SERVICES

The module extensively covers "Azure Resource Manager Attacks" across critical components such as App Service, Function App, Database, Automation Account, Key Vault and Logic Apps. Techniques for exploiting misconfigurations and escalating privileges across these services are explained in depth.

• Azure Application Attacks on App Service, Function App and Storages
• Azure Database
• Automation Account
• Hybrid Automation Account Abuse
• Azure Key Vault
• Azure Logic Apps

ATTACKING AZURE DEVOPS

This module provides an in-depth analysis of the security implications of Azure DevOps, focusing on potential privilege escalation scenarios we have reported to Microsoft—content not commonly found in other courses.

Participants will also learn how to enumerate other key DevOps services, such as Azure Repos and Azure Container Registry, which are closely integrated with Azure DevOps for daily operations.

• Introduction to Azure DevOps
• Understanding Azure DevOps Service Connection and potential abuse.
• Kerberos authentication
• Exploiting Azure repository and Azure container registry for sensitive information.

AZURE ARC SERVICE

This module provides an in-depth analysis of the security implications of Azure Arc, focusing on potential privilege escalation scenarios in a hybrid cloud environment.

Participants will learn how Azure Arc integrates with on-premises and multi-cloud environments, enabling the management of resources across different infrastructures.

ABUSING ENTRA ID MISCONFIGURATIONS

This module provides an in-depth analysis of Microsoft Entra ID, focusing on its authentication methods, security risks, and attack scenarios in cloud environments. It covers MFA bypass, Conditional Access policy evasion (using our noprompt tool), enumeration and attack path discovery using Graph tokens and our AI-assisted Graphhunter tool, Dynamic Membership Policy abuse, and persistent access using refresh tokens across Office 365 and SharePoint.

• Introduction to Microsoft Entra ID authentication methods and associated risks.
• Attacking Microsoft Entra ID, focusing on Managed User Identities
• Bypassing MFA security and evading Conditional Access Policies
• Exploiting Dynamic Membership Policies for privilege escalation
• Leveraging Azure Identity Protection to detect and respond to threats
• Using Refresh Tokens to Maintain Persistent Access to Office 365 and SharePoint Drive

BACKDOORING AZURE ENVIRONMENTS: PERSISTENCE TECHNIQUES

This module explores techniques attackers use to backdoor Azure environments, ensuring persistent access while remaining unnoticed. Participants will learn how to manipulate Azure configurations, exploit identity and access management (IAM) flaws, and abuse legitimate services to maintain unauthorized access. The session also covers defensive measures to detect and mitigate such threats.

Participants will learn how Azure Arc integrates with on-premises and multi-cloud environments, enabling the management of resources across different infrastructures.

AZURE AD IDENTITY PROTECTION

This module provides an in-depth understanding of Azure AD Identity Protection, focusing on its security mechanisms, risk detection, and potential attack vectors. Participants will learn how Microsoft Entra ID analyzes sign-in behavior, detects threats, and enforces security policies.