Azure security audit
In Azure, identity is the perimeter. We review your Entra ID tenant and Azure subscriptions together against the CIS Microsoft Azure Foundations Benchmark, because a weak conditional access policy undoes every network control below it.
Who it is for
- Organizations whose Microsoft 365 and Azure grew up together and share one Entra ID tenant.
- Teams that want to know which accounts can actually reach production subscriptions.
- Companies preparing for ISO 27001 or SOC 2 with Azure in scope.
What we assess
- Management groups, subscriptions and Azure Policy assignments.
- Entra ID: privileged role assignments, Privileged Identity Management, conditional access, multi-factor authentication and guest accounts.
- Defender for Cloud plans and recommendations.
- Storage accounts: public access, shared keys and shared access signatures.
- Network security groups, public IPs and management ports open to the internet.
- Key Vault access, and activity and diagnostic logging.
What you receive
- CIS Azure Foundations Benchmark results, reviewed by hand.
- An identity findings section covering who can reach what, and how.
- Findings that name the exact policy, role or setting to change.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to two weeks for one tenant with up to ten subscriptions.
Common questions
What access do you need?
Reader and Security Reader at the management group, and the Global Reader role in Entra ID. All read-only.
Can you include Microsoft 365?
Entra ID is always in scope because it controls Azure access. Microsoft 365 settings such as external sharing and mail protection can be added on request.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Azure security audit
We reply within one business day.
Nothing you send is shared outside Calibre.