Microsoft 365 & Entra ID (Azure AD) penetration testing

// 01 What M365 & Entra ID testing is

It's a security assessment focused on an organisation's cloud identity and productivity platform - Microsoft 365 for email, files and collaboration, and Entra ID (formerly Azure Active Directory) as the identity service that controls who can sign in and what they can access. The test evaluates how well the tenant is configured and defended: the strength of authentication and multi-factor enforcement, the conditional-access rules that decide when access is allowed, the permissions and roles granted to users and applications, and the exposure of email and file-sharing. Because so much of an organisation now lives in this one platform, and because identity has become the primary way attackers get in, testing the M365 and Entra ID configuration has become as important as testing the traditional network - and complements the on-premises Active Directory picture in hybrid environments.

// 02 Why cloud identity is the new perimeter

For most organisations the network perimeter no longer defines the boundary of their systems, because email, documents and applications are accessed from anywhere through a cloud identity. That means the identity itself - the user account and the controls around signing in - has become the main thing standing between an attacker and the organisation's data. If an attacker can obtain a valid identity - through phishing, stealing a session token, or abusing a misconfiguration - they can often reach a great deal without ever touching the internal network. This is why security effort has shifted toward protecting and testing identity: strong multi-factor authentication, well-designed conditional-access policies, careful management of application permissions, and monitoring for suspicious sign-ins. Testing the identity platform reveals whether those protections actually hold up against realistic attacks - the same “prove it works” logic behind every penetration test.

// 03 The main risks

The dominant risk is account compromise through phishing and token theft: an attacker obtains credentials or approval, or steals a token that bypasses the login, then operates as that user. Around it sit conditional-access and MFA gaps, over-privileged users and admin roles, and application-consent abuse - where a user is tricked into granting a malicious application ongoing permissions to their mailbox or files. Excessive external sharing, weak legacy authentication that bypasses modern protections, and poor separation of administrative accounts all add to the exposure. Testing looks for these specific weaknesses because they're the paths attackers actually use against cloud tenants - many beginning with a phishing lure.

// 04 What a test covers & how it's done

A test reviews the configuration and security of the identity and productivity platform end to end. On the identity side: authentication and MFA enforcement, conditional-access policies, the roles and permissions assigned to users and applications, legacy authentication exposure, and how administrative accounts are protected. On the productivity side: email security and anti-phishing controls, external sharing settings for files, and the permissions applications hold over data. It also considers how an attacker who compromised one account could escalate or move to reach more, and whether monitoring would detect them. The assessment is typically conducted with a defined level of access to the tenant so the configuration can be reviewed thoroughly, and its output is a prioritised set of hardening recommendations. It sits alongside cloud penetration testing and follows our methodology, with findings retested to closure.

// 05 Frequently asked questions

// 06 Related reading

• Cloud penetration testing and Active Directory attack paths (the hybrid picture).
• Social engineering & phishing — how most tenant compromises begin.
• OAuth & SSO testing — consent and token flows.