Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,762 questions
Can I conduct pentesting from Azure resources to client estates?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 79%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EST%3C/text%3E%3C/svg%3E)
S Taylor
0
Reputation points
Hi,
Can I set up a Pentesting infrastructure in Azure to test clients infrastructure both inside and outside Azure?
This tenant will contain VMs containing a number of applications used for performing penetration testing. Kalivm, nessus, qualys etc. Is this allowed in Azure?
My main reason for wondering is my source IP will be Azure IP, when I perform test against my clients.
Thank you in advance.
Azure Virtual Network
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 27,471 Reputation points Microsoft Employee Moderator2023-11-21T19:27:26.3966667+00:00 Thank you for reaching out. Currently question related Microsoft Security Response Center (MSRC) are not covered by this forum. I am just providing some additional resources below which can help answer your query here.
As per the Penetration testing fundamentals documentation here
Below some Standard tests you can perform include:
- Tests on your endpoints to uncover the Open Web Application Security Project (OWASP) top 10 vulnerabilities
- Fuzz testing of your endpoints
- Port scanning of your endpoints
One type of pen test that you can't perform is any kind of Denial of Service (DoS) attack. This test includes initiating a DoS attack itself, or performing related tests that might determine, demonstrate, or simulate any type of DoS attack.
As per the Penetration Testing Rules of Engagement just highlighting a few points below.
The following activities are prohibited:
- Scanning or testing assets belonging to any other Microsoft Cloud customers.
- Gaining access to any data that is not wholly your own.
- Performing network intensive fuzzing against any asset except your Azure Virtual Machine
- Deliberately accessing any other customer’s data.
- Using our services in a way that violates the Acceptable Use Policy, as set forth in the Microsoft Online Service Terms.
The following activities are encouraged:
- Create a small number of test accounts and/or trial tenants for demonstrating and proving cross-account or cross-tenant data access. However, it is prohibited to use one of these accounts to access the data of another customer or account.
- Fuzz, port scan, or run vulnerability assessment tools against your own Azure Virtual Machines.
You can also explore additional resources below.
- Security Update Guide FAQs (microsoft.com)
- FAQs - Report an issue and submission guidelines (microsoft.com)
- MSRC - Microsoft Security Response Center
- MSRC Support Form (office.com)
I also think it will be a good idea to engage the MSRC team via their Twitter handle here and also on their GitHub Repo.
Thank you!
-
S Taylor 0 Reputation points
2023-11-22T09:34:42.2166667+00:00 @ChaitanyaNaykodi-MSFT is there a forum for me to raise such a question with MSRC as I cannot find one? Not keen on using Twitter.
I understand the testing process for internal scans and what can and cannot be completed internal to my own tenancy. The question is more around testing out from Azure to client estates either on Premise or in public cloud hostings.
As far as I can tell from the Terms of Service there is nothing in there preventing this service being run from Azure as long as the customer estates being scanned are agreed and approved by their owners.
-
ChaitanyaNaykodi-MSFT 27,471 Reputation points Microsoft Employee Moderator
2023-11-22T20:03:48.9966667+00:00 Thank you for getting back. Actually, I also could not find a forum for MSRC questions. I think it will help if you can create a support ticket for this request. If you have a support plan you may follow this documentation here to file a support ticket. If you do not have a support plan, could you please send an email to azcommunity@microsoft.com with the below details. I will enable a one-time free support for you in this case.
Subject : Attn Chaitanya
Thread URL: Link to this thread.
Azure Subscription ID
Please let me know once you have done the same. Thank you!
-
ChaitanyaNaykodi-MSFT 27,471 Reputation points Microsoft Employee Moderator
2023-11-28T02:13:47.68+00:00 Just following up here to see if you were able take a look at my comment above. Thank you!
-
ChaitanyaNaykodi-MSFT 27,471 Reputation points Microsoft Employee Moderator
2023-11-29T23:03:42.4966667+00:00 Just following up here to see if you were able take a look at my comment above. Thank you!
Sign in to comment
Sign in to answer