For most companies on Microsoft, Azure isn’t only where the product runs. The same tenant holds employee email in Microsoft 365, files in SharePoint, and the logins for everyone in the company through Entra ID (the identity service formerly called Azure Active Directory). One weak setting in that identity layer can open the door to all of it at once.
Microsoft secures the platform itself. How your tenant, subscriptions, and apps are configured is your responsibility, and an Azure penetration test checks exactly that part. Testers start with access an attacker could realistically get, such as one employee’s password or an app’s credentials, and see how far it reaches. CYBRI’s Azure penetration testing guide covers the basics.
This list compares five US-based firms that test Azure and Microsoft cloud environments, and the kind of company each one fits best.
The five companies on this list:
- CYBRI: best for SaaS companies on Azure that want manual-first testing of the cloud and the app in one engagement
- TrustedSec: best for companies that run their whole business on Microsoft 365, Entra ID, and Azure
- SpecterOps: best for enterprises with years of Active Directory history now connected to Entra ID
- Kroll: best for regulated companies that want cloud testing from a firm that also handles incident response and investigations
- Rhino Security Labs: best for teams that want a cloud-focused firm testing the wider Microsoft cloud, from Azure to Intune and Dynamics 365
Why Azure Needs Its Own Pentest
A network test or a web app test can each miss the Azure control layer entirely: the roles, app permissions, and access policies that decide who can do what inside your tenant. Two features of Microsoft’s cloud make that layer worth a dedicated test.
Identity Is the New Perimeter
In an Azure tenant, most attacks don’t break through a firewall. They log in. A phished password, an app registration with too many permissions, or a guest account nobody removed can each give an outsider a valid identity. From there, the question is which roles that identity can reach, and whether a chain of small permissions leads to Global Administrator.
Conditional Access policies (the rules that decide when to demand multi-factor authentication or block a sign-in) often have gaps nobody notices until someone tests them. An Azure pentester checks those gaps by hand, along with role assignments, service principals (the identities apps use), and the consent users grant to third-party apps. A configuration scanner flags the settings. A tester shows which ones an attacker could chain together.
Microsoft Doesn’t Need to Approve the Test
Since June 2017, Microsoft hasn’t required pre-approval to penetration test your own Azure resources. Testers must still follow the Microsoft Cloud Unified Penetration Testing Rules of Engagement, which ban denial-of-service testing and any attempt to reach other customers’ data.
For compliance, the reasoning is simple. SOC 2, ISO 27001, PCI DSS, and HIPAA reviews look for proof that systems holding customer data were tested and fixed. When those systems live in Azure, the tenant and subscription settings are part of that picture. CYBRI’s Azure security best practices list the settings worth reviewing before a test.
How These Companies Were Chosen
Each firm had to clear the same bar before its “best for” line was written:
- Based in the United States. All five companies are US-based.
- Microsoft cloud named in writing. The firm’s own pages list Azure, Entra ID, or Microsoft 365 as environments it tests.
- People lead the testing. Tools gather data on the tenant. A person decides which permissions to chain and what each finding means.
- Experienced testers. Hands-on certifications such as OSCP, or a long public record of Microsoft security work.
- A clear fit. Each firm does something specific well, which is what its “best for” line describes.
Crowdsourced platforms and AI-first products were left out. Identity testing in Azure depends on a known team learning how your roles, apps, and policies fit together.
The 5 Best Azure Penetration Testing Companies in 2026
1. CYBRI
Best for: SaaS companies on Azure that want manual-first testing of the cloud and the app in one engagement
CYBRI is a New York penetration testing company founded in 2017, and it works manual-first. Tools help collect data on the environment, and OSCP-certified testers (OSCP is a hands-on certification earned by breaking into live systems) do the attacking by hand. Its Azure penetration testing starts with identity: Entra ID, multi-factor authentication, Conditional Access gaps, and role assignments that could let a user raise their own privileges.
From there, testers move through Azure services such as Key Vault, Storage, databases, AKS, Functions, and App Service, then network segmentation and firewall rules. The last step ties everything together. Testers chain individual findings into realistic attack paths with controlled proof-of-concept work, so the report shows how an attacker would get from a single weak setting to your data. For a SaaS company, the same team can also test the app running in Azure as each user role.
Reports include an executive summary, technical findings with evidence and steps to reproduce them, visual attack-path maps, and Azure-specific fixes ordered by priority. Findings map to SOC 2, ISO 27001, PCI DSS, HIPAA, and GDPR. A retest within the 90-day remediation window confirms each fix.
2. TrustedSec
Best for: companies that run their whole business on Microsoft 365, Entra ID, and Azure
TrustedSec was founded by David Kennedy in 2012 and is based in Fairlawn, Ohio. It offers two ways into a Microsoft cloud. The Microsoft Cloud Security Assessment covers Microsoft 365, Entra ID, Azure subscriptions, and services such as Exchange Online and SharePoint, using adversary-informed testing to check how misconfigurations or privilege assignments could be abused. Its cloud testing service goes further on the offensive side, adding an Assumed Access Model to a traditional penetration test to show what an attacker could reach after compromising credentials or an application.
That split suits companies whose email, files, and logins all live in one Microsoft tenant. The assessment results come with technical evidence, remediation priorities, and alignment with Microsoft Secure Score and CIS benchmarks, plus a leadership briefing on business impact and next steps.
3. SpecterOps
Best for: enterprises with years of Active Directory history now connected to Entra ID
SpecterOps was founded in 2017 and develops BloodHound, a tool for mapping how permissions connect across an identity system. Its Attack Path Assessment uses the enterprise version of that tool to map chains of abusable privileges across on-premises Active Directory and Entra ID, along with platforms such as Okta and GitHub. The output points to choke points: single changes that close off many attack paths at once.
That approach helps most in older, larger environments, where years of group memberships and delegated rights have piled up and nobody can say for sure who can reach what. SpecterOps also runs penetration tests built around the objectives a client cares most about, plus red team and purple team work.
4. Kroll
Best for: regulated companies that want cloud testing from a firm that also handles incident response and investigations
Kroll is headquartered in New York and is widely known for risk, investigations, and incident response work. Its cloud penetration testing covers Azure along with AWS and Google Cloud, and its consultants work with services such as Azure Virtual Machines, Azure Functions, Blob Storage, and Azure Active Directory. Container and Kubernetes testing extends to AKS.
For banks, insurers, and other regulated companies, the draw is having testing and response under one roof. The firm that finds the gaps in your tenant is the same one you’d call if something went wrong. Kroll also offers cloud configuration reviews and red team work alongside its penetration testing.
5. Rhino Security Labs
Best for: teams that want a cloud-focused firm testing the wider Microsoft cloud, from Azure to Intune and Dynamics 365
Rhino Security Labs was founded in Seattle in 2013 and focuses heavily on cloud testing across Azure, AWS, and GCP, alongside network and web app work. Its Azure testing reaches beyond the core platform to other Microsoft cloud services, with Microsoft Intune, Dynamics 365, Office 365, and Microsoft accounts named among the examples on its service page.
The firm’s engagements are manual and deep-dive by design. Azure reports follow the same structure as its network and web app reports, with technical detail for the engineers doing the fixing and strategic insight for leadership, plus recommendations for both your Azure setup and your wider cloud environment. Sample Azure reports are offered on its website.
How to Choose an Azure Pentest Partner
Two firms can both list “Azure” and run very different tests. Use these points to compare the shortlist:
| Criteria | What to look for |
| Identity coverage | Entra ID roles, Conditional Access, service principals, app consent, guest accounts, and any link to on-premises Active Directory. |
| Microsoft 365 | Whether Exchange Online, SharePoint, and Teams settings are in scope, if your company runs on them. |
| Starting access | Whether testers begin from an assumed foothold (one user’s login or an app’s credentials), from the outside, or both. |
| App and cloud together | Whether the same team can test your app and the Azure subscriptions behind it. |
| Who tests | Named, senior testers with hands-on certifications such as OSCP. |
| Retesting | Whether a retest is included, how long the window stays open, and whether you get an updated report. CYBRI’s guide to retesting explains the usual process. |
| Reporting | An executive summary, severity scores, Azure-specific fixes, and mapping to SOC 2, ISO 27001, or PCI DSS. Compare samples with this checklist of what a pentest report should contain. |
Final Thoughts
Each of these five firms can test a Microsoft cloud environment, and the right pick depends on how much of your business runs in the tenant, how old your directory is, and whether your app needs testing too. For SaaS companies that want OSCP-certified testers working manual-first from Entra ID down to the app, CYBRI is a strong fit. A short call is enough to map the subscriptions and services in scope, so contact CYBRI to talk it through.
Frequently Asked Questions
Do I need Microsoft’s approval before an Azure penetration test?
No. Microsoft dropped its pre-approval requirement in June 2017. Testing must follow the Microsoft Cloud Unified Penetration Testing Rules of Engagement, which forbid denial-of-service testing, attacks on other tenants, and anything that disrupts shared Microsoft infrastructure. Your testing firm should work within those rules and confirm the scope with you in writing.
Does an Azure pentest cover Microsoft 365?
Only if it’s in scope. Entra ID sits under both Azure and Microsoft 365, so most Azure tests look at identity settings that affect email and files too. Exchange Online, SharePoint, and Teams configuration usually need to be named in the scope to get full attention. Ask each firm which Microsoft 365 services its test covers.
What should I give testers before an Azure pentest?
Plan on a read-only account for the tenant and subscriptions in scope, a list of the subscriptions and key services, and a test account in your app for each user role if the app is in scope. If you want an assumed-breach test, agree on a test user with normal employee permissions. Name one technical contact who can unblock access quickly.
Ready for an Azure Pentest?
CYBRI tests Azure tenants, subscriptions, and the apps that run on them, manual-first, with OSCP-certified testers leading every project. Reports include attack-path maps and Azure-specific fixes mapped to SOC 2, ISO 27001, PCI DSS, HIPAA, and GDPR, and fixes are retested within 90 days. Get a quote to scope a test for your Azure environment.
