Cloud Security Assessment
Read-only assessment. This report is generated from supplied, read-only findings and methodology output; it performs no live scanning and contains no exploit payloads. Distribution is restricted to authorized recipients.
The assessment recorded 9 findings in the in-scope environment (1 Critical, 4 High, 2 Medium, 1 Low, 1 Informational).
The highest-severity modeled attack path, AZ-PATH-001 (Critical), “Public web app to subscription Owner,” traces a route ending in Subscription Owner.
9 of 9 findings are in an open or unresolved state and warrant remediation tracking.
4 findings participate in at least one modeled attack path and should be prioritized to break those chains.
Modeled routes an adversary could take through the environment. Nodes linked to a finding are clickable and jump to the detailed finding.
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-web-prod/providers/Microsoft.Web/sites/contoso-public-portalAn internet-facing App Service has a system-assigned managed identity that can read a Key Vault holding a service principal credential. That principal holds roleAssignments/write at the subscription scope, enabling self-elevation to Owner.
Public web entry -> SSRF/code exec -> managed identity token -> Key Vault secret -> privileged SP -> roleAssignments/write -> subscription Owner
Full administrative control of the production subscription, including all data stores and the ability to disable logging.
Remove roleAssignments/write from the service principal (replace with PIM-eligible, time-bound assignment). Scope the managed identity's Key Vault access to only the secrets it needs and enable Key Vault RBAC with purge protection.
/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleAssignments/sp-deploy-prodThe CI/CD service principal 'sp-deploy-prod' is assigned a custom role that includes Microsoft.Authorization/roleAssignments/write — an escalation primitive that lets the principal grant itself Owner.
Any compromise of the SP credential yields a one-step path to subscription Owner.
Privilege escalation to full subscription control; this is the pivot that turns the public-web entry point into a Critical chain.
Replace the standing assignment with a least-privilege deployment role that excludes roleAssignments/write. If role assignment is required, gate it behind PIM with approval.
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-infra/providers/Microsoft.Network/networkSecurityGroups/nsg-jumpboxNSG 'nsg-jumpbox' has an inbound rule allowing TCP 3389 from source 0.0.0.0/0 (Any). The associated VM is directly reachable for RDP brute-force.
Internet-wide RDP brute force / credential stuffing against the jumpbox.
Initial access foothold on a management host with line of sight to internal resources.
Remove the 0.0.0.0/0 RDP rule. Use Azure Bastion or just-in-time VM access, and restrict management ports to known admin IP ranges.
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-data/providers/Microsoft.Storage/storageAccounts/contosopublicdataStorage account 'contosopublicdata' has allowBlobPublicAccess enabled and a container with an anonymous access level of 'container', allowing unauthenticated enumeration and download of all blobs.
Unauthenticated internet user lists and downloads blobs directly over HTTPS.
Exposure of any sensitive data stored in the public container; reconnaissance aid for further attacks.
Set allowBlobPublicAccess=false on the storage account and set every container's public access level to 'private'. Use SAS or Entra-authenticated access for legitimate sharing.
/tenants/00000000-0000-0000-0000-0000000000aa/directoryRoles/GlobalAdministratorThree accounts holding the Global Administrator role have no registered MFA method and are not covered by a Conditional Access policy requiring MFA.
Password-only access to tenant-wide admin; phishing or credential stuffing yields Global Admin.
Compromise of any one account grants full control of the Entra tenant and all subscriptions.
Enforce phishing-resistant MFA for all privileged roles via Conditional Access, and make the roles PIM-eligible rather than permanently active.
/subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/rg-ai/providers/Microsoft.CognitiveServices/accounts/contoso-openaiThe Azure OpenAI account 'contoso-openai' has publicNetworkAccess=Enabled with no IP restrictions, exposing the inference endpoint and any deployed models to the internet (key-based auth only).
If an API key leaks (e.g. in client code), the endpoint is directly callable from anywhere.
Model abuse, data exfiltration via prompts, and unbudgeted spend.
Set publicNetworkAccess=Disabled and use a private endpoint, or restrict to known IP ranges. Prefer Entra ID (managed identity) auth over API keys and rotate keys.
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-web-prod/providers/Microsoft.KeyVault/vaults/kv-web-prodKey Vault 'kv-web-prod' (the vault on the Critical attack path) has no diagnostic setting sending AuditEvent logs anywhere, so secret-read activity is invisible.
An attacker reading secrets through the managed identity leaves no audit trail.
The most dangerous step in the Critical chain is undetectable — exploitable AND invisible.
Add a diagnostic setting on the vault sending AuditEvent (and AllMetrics) to a Log Analytics workspace, and alert on anomalous secret reads.
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-web-prod/providers/Microsoft.Web/sites/contoso-public-portalThe public portal accepts TLS 1.0/1.1 and is not fronted by Azure Front Door or Application Gateway WAF.
Downgrade attacks and direct exploitation of the origin without a WAF inspection layer.
Weak transport security and no edge protection for the most-exposed app.
Set minimum TLS to 1.2+, and place the app behind Front Door or App Gateway with WAF in Prevention mode.
/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-web-prodProduction resource groups have no CanNotDelete or ReadOnly locks, so a compromised or mistaken Contributor can delete production resources.
Destructive action (resource deletion) by any Contributor.
Availability impact; not a confidentiality issue on its own.
Apply CanNotDelete locks to production resource groups and critical resources.
Findings consolidated into prioritized, actionable remediations. Items flagged breaks attack path sever a modeled chain and are weighted higher.
Remove roleAssignments/write from the service principal (replace with PIM-eligible, time-bound assignment). Scope the managed identity's Key Vault access to only the secrets it needs and enable Key Vault RBAC with purge protection.
Replace the standing assignment with a least-privilege deployment role that excludes roleAssignments/write. If role assignment is required, gate it behind PIM with approval.
Remove the 0.0.0.0/0 RDP rule. Use Azure Bastion or just-in-time VM access, and restrict management ports to known admin IP ranges.
Set allowBlobPublicAccess=false on the storage account and set every container's public access level to 'private'. Use SAS or Entra-authenticated access for legitimate sharing.
Enforce phishing-resistant MFA for all privileged roles via Conditional Access, and make the roles PIM-eligible rather than permanently active.
Add a diagnostic setting on the vault sending AuditEvent (and AllMetrics) to a Log Analytics workspace, and alert on anomalous secret reads.
Set publicNetworkAccess=Disabled and use a private endpoint, or restrict to known IP ranges. Prefer Entra ID (managed identity) auth over API keys and rotate keys.
Set minimum TLS to 1.2+, and place the app behind Front Door or App Gateway with WAF in Prevention mode.
Apply CanNotDelete locks to production resource groups and critical resources.
Assets referenced by findings, deduplicated and ranked by worst observed severity, with a roll-up of in-scope tenants and subscriptions.
Microsoft.Web/sites1Microsoft.Authorization/roleAssignments1Microsoft.Network/networkSecurityGroups1Microsoft.Storage/storageAccounts1tenant/directoryRoles1Microsoft.CognitiveServices/accounts1Microsoft.KeyVault/vaults1resourceGroups1| Severity | Asset | Type | Scope | Findings |
|---|---|---|---|---|
| Critical | contoso-public-portal | Microsoft.Web/sites |
00000000-0000-0000-0000-000000000000 | |
| High | sp-deploy-prod | Microsoft.Authorization/roleAssignments |
00000000-0000-0000-0000-000000000000 | |
| High | nsg-jumpbox | Microsoft.Network/networkSecurityGroups |
00000000-0000-0000-0000-000000000000 | |
| High | contosopublicdata | Microsoft.Storage/storageAccounts |
00000000-0000-0000-0000-000000000000 | |
| High | GlobalAdministrator | tenant/directoryRoles |
tenant:00000000-0000-0000-0000-0000000000aa | |
| Medium | contoso-openai | Microsoft.CognitiveServices/accounts |
00000000-0000-0000-0000-000000000001 | |
| Medium | kv-web-prod | Microsoft.KeyVault/vaults |
00000000-0000-0000-0000-000000000000 | |
| Informational | rg-web-prod | resourceGroups |
00000000-0000-0000-0000-000000000000 |
All modeled attack paths merged into a single graph. Shared assets are deduplicated so cross-path pivots are visible at a glance.
Finding distribution across security domains and the control frameworks referenced by the findings.
| Domain | Findings | Crit | High | Medi | Low | Info |
|---|---|---|---|---|---|---|
| AI | 1 | · | · | 1 | · | · |
| Attack Path | 1 | 1 | · | · | · | · |
| Governance | 1 | · | · | · | · | 1 |
| Identity | 1 | · | 1 | · | · | · |
| Logging | 1 | · | · | 1 | · | · |
| Network | 1 | · | 1 | · | · | · |
| RBAC | 1 | · | 1 | · | · | · |
| Storage | 1 | · | 1 | · | · | · |
| Web | 1 | · | · | · | 1 | · |
This assessment was produced by a coordinated team of read-only Azure security agents. Each agent specializes in a domain (identity, network, storage, RBAC, logging, AI, web, and governance) and contributes structured findings to a shared evidence model. An orchestrator deduplicates overlapping observations and an attack-path analyst correlates findings into multi-step chains.
Only resources and configurations represented in the supplied findings dataset are in scope. Tenants and subscriptions listed on the cover define the engagement boundary.
The methodology is read-only and evidence-driven: configuration and posture are evaluated against documented control baselines and known attack techniques. No exploitation, write operations, or live credential use is performed, and no exploit payloads are included.
Absence of a finding is not proof of security; it reflects only what was evaluated with the supplied inputs. Severity and confidence are analytical judgments. Attack paths are models intended to prioritize remediation, not guarantees of exploitability. Findings should be validated against the live environment before remediation is finalized.
This document is a self-contained HTML report. It loads no external scripts, styles, fonts, or network resources, and is safe to open offline or archive as evidence. Use Print / Save PDF to produce a paginated copy.
| Generated | 2026-06-10T13:20:06.614Z |
| Generator version | 2.0.0 |
| Findings | 9 |
| Attack paths | 2 (1 modeled, 1 derived) |